#9 PKI continued + shellshock payload examples
Channel: ralienpp
Date: 2014-11-30

- what does a CSR look like?
- the contents of an X509 certificate
- examples of OIDs used in certificates
- LDAP as a directory for the storage of certificates
- examples of OCSP requests 
@11:20 ERRATA: when I say "revoke with OCSP" I should say "with CMP". OCSP is for checking the status; revocation itself is done via CMP (see one of the earlier classes for details: https://www.youtube.com/watch?v=yvYB1Vap6Is)
- phishing and spearphishing
- using certificates for HTTP client authentication


A review of the shellshock vulnerability
- what are environment variables?
- what is CGI-BIN used for?
- some examples of payloads that attempt to exploit it
  - some could be an AVT - advanced volatile threat