Back to Details

offensive-tls-attacks

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

TLS/SSL & PKI Configuration Audit (
offensive-tls-attacks
)

TLS/SSL 与 PKI 配置审计 (
offensive-tls-attacks
)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.
授权与范围声明： 本 skill 是 REA_Skill + claude-red Unified Security & Reverse Engineering Suite 的一部分。它仅适用于对您拥有或已获得明确测试许可的软件、基础设施和资产进行授权安全评估、防御性架构审查、漏洞分诊、漏洞赏金验证和修复工程。

Overview

概述

TLS/SSL and PKI security configuration auditing covering TLS 1.2/1.3 cipher suite selection, forward secrecy (ECDHE), HSTS preload, Certificate Authority Authorization (CAA) DNS records, OCSP stapling, and mTLS validation.
涵盖 TLS 1.2/1.3 cipher suite 选择、前向保密（ECDHE）、HSTS preload、Certificate Authority Authorization（CAA）DNS 记录、OCSP stapling 和 mTLS 验证的 TLS/SSL 与 PKI 安全配置审计。

Operational Workflow

操作工作流

  1. Surface & Architecture Inventory
    • Identify all entrypoints, trust boundaries, parsers, and configuration files relevant to TLS/SSL & PKI Configuration Audit (
      crypto
      domain).
    • Combine static code/binary inspection (via REA MCP tools, 
      rg
      , AST analysis, or decompilation) with runtime configuration verification.
  2. Hypothesis & Vulnerability Verification
    • Test each security invariant systematically against known CWE and OWASP patterns.
    • Record concrete evidence: affected file/procedure, line numbers or binary offsets, request/response trace, and root cause.
  3. Impact & Reachability Triage
    • Evaluate whether the issue is reachable across trust boundaries, whether defense-in-depth controls mitigate it, and compute an accurate CVSS v3.1 / v4.0 score.
  4. Remediation & Regression Verification
    • Implement or provide production-ready, copy-pasteable remediation code.
    • Write an automated regression test or verification command to prove the flaw is resolved with 0 regressions.
  1. 攻击面与架构清单
    • 识别与 TLS/SSL 与 PKI 配置审计（
      crypto
      domain）相关的所有 entrypoint、trust boundary、parser 和配置文件。
    • 将静态代码或二进制检查（通过 REA MCP tools、
      rg
      、AST analysis 或 decompilation）与运行时配置验证相结合。
  2. 假设与漏洞验证
    • 针对已知 CWE 和 OWASP 模式，系统地测试每项安全不变量。
    • 记录具体证据：受影响的文件或过程、行号或二进制偏移量、request/response trace 以及根本原因。
  3. 影响与可达性分诊
    • 评估问题是否可跨 trust boundary 到达、纵深防御控制是否能够缓解问题，并计算准确的 CVSS v3.1 / v4.0 分数。
  4. 修复与回归验证
    • 实施修复或提供生产就绪、可直接复制粘贴的修复代码。
    • 编写自动化回归测试或验证命令，证明漏洞已解决且存在 0 个回归问题。

Audit & Verification Checklist

审计与验证清单

PhaseCheckVerification MethodExpected Secure State
1. DiscoveryEnumerate all 
crypto
surfaces and dependencies		Source search / REA binary & bundle inspectionComplete inventory of trust boundaries
2. Input & StateValidate parser behavior, type safety, and state transitionsBoundary testing & static taint analysisStrict schema validation and invariant checks
3. Auth & IsolationVerify caller identity, tenant isolation, and least privilegeHorizontal/vertical privilege matrix checkExplicit deny-by-default enforcement
4. Defense-in-DepthInspect secondary controls, logging, and compiler/runtime flagsConfig & header/binary flag auditFull hardening and telemetry enabled
5. RemediationApply fix and execute automated regression test
npm test
/ toolchain build & test suite		0 vulnerabilities, 0 build errors
阶段检查项验证方法预期安全状态
1. 发现枚举所有 
crypto
攻击面和依赖项		源代码搜索 / REA binary 与 bundle 检查完整的 trust boundary 清单
2. 输入与状态验证 parser 行为、类型安全性和状态转换边界测试与静态 taint 分析严格的 schema 验证和 invariant 检查
3. 身份验证与隔离验证调用者身份、租户隔离和最小权限水平/垂直权限矩阵检查显式 default-deny enforcement
4. 纵深防御检查辅助控制、日志记录以及 compiler/runtime flags配置与 header/binary flag 审计完整加固并启用 telemetry
5. 修复应用修复并执行自动化回归测试
npm test
/ toolchain build 与 test suite		0 个漏洞、0 个构建错误

Integration with REA MCP & Tooling

与 REA MCP 及工具的集成

  • Static & Binary Analysis: Pair with 
    rea-universal-orchestrator
    , 
    rea-binary-disassembly
    , 
    rea-web-bundle-recovery
    , or 
    rea-mobile-app-recovery
    when source code is unavailable.
  • Interactive Scoping: Invoke 
    /rea-grill-me
    before large-scale assessments to clarify scope, target environments, and acceptance criteria.
  • Reporting: Pair with 
    offensive-reporting
    to format findings with CVSS vectors, CWE mappings, and remediation patches.
  • 静态与二进制分析： 当源代码不可用时，可配合使用 
    rea-universal-orchestrator
    、
    rea-binary-disassembly
    、
    rea-web-bundle-recovery
    或 
    rea-mobile-app-recovery
    。
  • 交互式范围界定： 在开展大规模评估前，调用 
    /rea-grill-me
    以明确范围、目标环境和验收标准。
  • 报告： 配合使用 
    offensive-reporting
    ，按照 CVSS vector、CWE 映射和修复补丁的格式生成审计发现。