This post might help some of you out there that working as a pentester/security consultant/IT staff/etc.
During pentest,after scanned the server/host/ip, u might get a result saying that the server/host/ip using old version of SSL. The latest one currently is version 3.
So,how to ensure this is a true positive or false positive? U can check it by using Internet Explorer browser.
go to Tools > Internet Options
then
go to the Advance tab.
tick the box like i show below if u want to check either that server/host/ip using old version of SSL in this case v2.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhahEgny7Yh7MDydlHv4CL6dI2s26h9HvIk-BmrgIRBqEAKsRcEF6QpSjVZgN8RDQcC6gHykvCt_Aijcf7803-rAZyCqDSQzhYr3foD_jN1ZgB0jiowjnYtQbxQO5DcwUu-Akws7um8CLs/s320/1.png)
then click OK.
go the server/host/ip using the same browser.
if u can get to the webpage, this means the server/host/ip is using v2 of SSL.
if not,u'll get an error/too long to load/timeout connection/,this means the server/host/ip is not using the v2 of SSL.
then,try to check for the other version,in this case is version 3.
the same thing u need to check. after tick the v3 SSL box, check the server/host/ip
like u did for v2 SSL.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPuYz3ZSL2pb7AWHoh3H-xAVzPyBjA4lFfDZrwkSXh6iIKWh6_J8XFLYbJi_3J-BooAOopFUQsLb-AWKGrDtXe6dSJkRTsFbNpBvsII7mL2fvVnVThazN-djnHAY0XuyQ1XUUQUD3kNbI/s320/2.png)
hope u all can understand my post :)
p0pc0rn
0 comments:
Post a Comment