# Offensive Tls Attacks

Comprehensive methodology for auditing and exploiting TLS/SSL implementations and...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-tls-attacks -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-tls-attacks -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-tls-attacks -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-tls-attacks -g -a gemini-cli -y`

## Description

Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication attacks including client certificate theft and relay, and Certificate Transparency log monitoring for reconnaissance. Primary tooling includes testssl.sh for comprehensive TLS auditing, sslyze for Python-integrated scanning, sslscan for quick cipher enumeration, and tlsx for high-speed TLS probing at scale. Maps to CWE-295 (Improper Certificate Validation), CWE-319 (Cleartext Transmission of Sensitive Information), and CWE-757 (Selection of Less-Secure Algorithm During Negotia

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# TLS/SSL Attacks and Misconfiguration Exploitation

You are performing offensive TLS/SSL analysis against target infrastructure. This skill covers the full attack surface of transport layer security -- from protocol-level cryptographic weaknesses to implementation bugs, certificate validation failures, and deployment misconfigurations. You treat every TLS handshake as an opportunity for enumeration and every certificate chain as a trust boundary to probe.

## Quick Workflow

1. Enumerate the target's TLS configuration -- supported protocols, cipher suites, certificate chain, extensions.
2. Identify deprecated protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1) and weak cipher suites (export, NULL, RC4, DES, 3DES).
3. Check for known protocol vulnerabilities -- POODLE, DROWN, FREAK, BEAST, Heartbleed.
4. Test compression oracle exposure -- CRIME at the TLS layer, BREACH at the HTTP layer.
5. Validate certificate handling -- chain verification, hostname matching, pinning enforcement, revocation checking.
6. Assess TLS 1.3 features -- 0-RTT replay, downgrade sentinel presence, supported groups.
7. For mobile targets, bypass certificate pinning and intercept traffic.
8. Document findings with protocol evidence and remediation priorities.

---

## TLS Enumeration and Scanning

Begin every TLS engagement with comprehensive enumeration. Use testssl.sh as the primary tool -- it requires no dependencies beyond bash and OpenSSL and produces detailed output covering protocols, ciphers, vulnerabilities, and certificate details.

```bash
# Full scan with all checks, output to JSON and HTML
testssl.sh --jsonfile results.json --htmlfile results.html \
  --ip one --sneaky --warnings batch \
  target.com:443

# Quick protocol and cipher check
testssl.sh --protocols --ciphers target.com:443

# Check only for specific vulnerabilities
testssl.sh --heartbleed --ccs-injection --ticketbleed \
  --robot --poodle --beast --crime --breach --drown --freak \
  --logjam --sweet32 target.com:443

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/crypto/offensive-tls-attacks/SKILL.md