Abusing Certificate Transparency Logs

Certificate Transparency System

The Certificate Transparency system provides public logs of TLS certificates. While primarily used to uncover certificate security issues, CT data has additional value for reconnaissance and exploitation.

Alternative Use Cases

Beyond security purposes, CT data can be exploited to discover common web applications. The presentation demonstrates novel ways to exploit these applications using Certificate Transparency information.

Targeting CMS Platforms

Common CMS platforms like WordPress, Joomla, and Typo3 can be discovered and targeted through CT log analysis. Understanding deployment patterns from certificate data enables targeted attacks.

Secure Standards Impact

Certificate Transparency has helped uncover incidents where certificate authorities violated rules. In September 2017, Google made CT mandatory for all new certificates, making this an opportune time to examine potential abuse vectors and help organizations understand attack possibilities.