HTTPS over C - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Hacking
HTTPS over C

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Hacking Discuss the art of hacking, your experiences, etc...

HTTPS over C

This is a discussion on "HTTPS over C" within the Hacking part of the Computer Security: Discussions section; I would like to know if their is some person here experienced with the HTTPS protocol over C without the use of http://curl.haxx.se/libcurl/, I guess I should use OpenSSL, but Im not sure. I will use ...

Reply

Page 1 of 2

1

#1 (permalink)

Old

09-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

HTTPS over C

I would like to know if their is some person here experienced with the HTTPS protocol over C without the use of http://curl.haxx.se/libcurl/, I guess I should use OpenSSL, but Im not sure.

I will use this lib (libcurl) for a project but would be nice to have some feedbacks/codes samples about this without the use of this external lib to have a better understand of what I'm coding. Thanx you.

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

Sponsor

Advertiser

#2 (permalink)

Old

10-07-05

Guest

Posts: n/a

Default

well I dont know about this too

but these links might be useful .
----------------------
talking to SSL in the iis-ssl DoS exploit : http://www.security.nnov.ru/files/sslbomb.c
char cipher_suites[] = /* 52 */
char bin_data[] = /* 1308 */
on making sessions and those shits .
---------------------
ASN1.1 parsing remember ?
http://cert.uni-stuttgart.de/archive/bu ... 00126.html
---------------------
and at last that damn openssl-too-open I remember that time wow many servers got 0wned with this shit .
good case study done by phreedom:
http://www.phreedom.org/solar/exploits/apache-openssl/
---------------------
this wont hurt too ! :
http://security.nnov.ru/exploits/?keyword=ssl

Reply With Quote

#3 (permalink)

Old

10-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

ok thx man

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#4 (permalink)

Old

12-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

this one you sent me:

http://www.phreedom.org/solar/exploits/apache-openssl/

clear explanations, good paper

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#5 (permalink)

Old

12-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

well I will explain better what Im trying to do because there is prolly much faster to do this with a win api that I dont know yet:

Im coding a small c program connection the MSN network via MSNP9, the auth is no more in clear text and I need to request to a ssl server a challenge ticket at "https://nexus.passport.com/rdr/pprdr.asp", to be able then to submit the encrypted password and to be logged on as a normal client, this will help me then to identify client bugs while sending them a msg, because rumours says that big vulnerabilities are identified while sending a crafted msg to some popular clients

Have found a .NET sample about all this:

HttpWebRequest ServerRequest = (HttpWebRequest)WebRequest.Create("https://nexus.passport.com/rdr/pprdr.asp");

if someone can submit me a small C sample on how to request a https:// via a smiliar way, thanx you.

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#6 (permalink)

Old

12-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

looks like I can do only this with .NET framework libs
http://msdn.microsoft.com/library/defau ... temnet.asp

correct me or link me to something other if Im wrong.

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#7 (permalink)

Old

15-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

got it, AfxParseURL

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#8 (permalink)

Old

18-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

http://support.microsoft.com/default.as ... -us;168151

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#9 (permalink)

Old

19-07-05

Guest

Posts: n/a

Default

useful links :> I will post if I found sth .
our telephone line was cut off for a week ! ( not so astonishing in my country ) anyway
I am looking for a paper/book/ebook/everything that has introduced talking to different daemons in C , like https which is just mentioned .
any useful link ?

Reply With Quote

#10 (permalink)

Old

20-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

to do the https connection , Im using finally as msdn mention , the wininet lib, you should initiate those functions in the same order if im not wrong, much infos at msdn:

http://msdn.microsoft.com/library/en-us ... etopen.asp
http://msdn.microsoft.com/library/en-us ... onnect.asp
http://msdn.microsoft.com/library/en-us ... equest.asp
http://msdn.microsoft.com/library/en-us ... equest.asp

you can initizate several type of connection with , http/https/gopher/ftp/etc...

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

Sponsor

Advertiser

Reply

Page 1 of 2

1

Tags
https

« 2class & otherz | GetPC shellcode for WinXPSP1? »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Tiny MSN Fuzzer	class101	Applications, Tools & Papers	13	02-10-07 01:34
MailEnable HTTPS Buffer Overflow	rscience	Private	10	14-11-05 17:36
MSN password flaw	class101	General Discussions	5	24-08-05 13:54

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59