Anti-MitM TLSCAPTCHA (PoC) par Anon

This extension uses your CAPTCHA answer to verify TLS certificate that you get from website you're visiting. Warning: you can see it in action only if a website has server-side part of such verification scheme.

3 (2 critiques)

14 utilisateurs·trices

Télécharger Firefox et obtenir l’extension

Télécharger le fichier

À propos de cette extension

Every time when you solve CAPTCHA, the CAPTCHA answer can be used as a common secret for a short time. Mainly, It can be used to prevent TLS certificate spoofing.

Since ordinary web pages (and their JavaScript) doesn't have access to TLS certificate data, I was have to make this extension. Actually it does the following:

let clientsideDigest = <Digest of TLS certificate that you get from website you're visiting>;
let yourAnswer = <Your CAPTCHA answer>;
let resultDigest = PBKDF2(clientsideDigest, "SHA-512", yourAnswer);
//Where yourAnswer is PKBDF2 salt.
cookies["TLSCaptcha"] = representAsHexString(resultDigest);

To see it in action, you need to visit a website that have server-side implementation of this scheme.
At the moment of publishing this extension, there is no server-side implementations. If you want to make your own, please look into source code for details.

New additional featue: you can use this addon to establish additional encryption. See source code for details.

Commentaires du développeur

At the moment of publishing this extension, there is no server-side implementations. If you want to make your own, please look into source code for details. It's very simple to understand.

WARNING: this extension cannot be ported to Chromium-based browsers due to API limitations.

Noté 3 par 2 personnes

Autorisations nécessaires :