Conversation started Jan 19, 2015 at 20:42.
Jan 19, 2015 20:42
I think the best I have seen is the null byte hack of moxie (I think it was him) where you could get a certificate for google.com\0.yourdomain.com in FF @rdlowrey
user895378
@PeeHaa that one was sweet!
user895378
My first iteration of the SAN name matching code was actually vulnerable to that but I realized it months before 5.6 was released :)
 
Conversation ended Jan 19, 2015 at 20:43.