Exploiting the flaws

Once you've scanned for SSL/TLS cipher issues or certificate woes, there is a lot that can be done to look for specific weaknesses that attackers will be using, and these same attacks can be delivered via some of the tools we have already visited in previous chapters. Let's look at a few of the more famous vulnerabilities.

POODLE – all bark, no bite (usually)

Padding Oracle On Downgraded Legacy Encryption (POODLE) (CVE-2014-3566) is a vulnerability that allows a man-in-the-middle exploit by taking advantage of a downward negotiation of the cipher to the affected SSLv3.0 Cipher Block Chaining (CBC) cipher suites. Using a MITM attack, POODLE requires 256 SSL requests to reveal each byte...