Dan Kaminsky Exploits and Proofs of Concept

Showing 5 PoCs on this page

ExploitDB

Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

ExploitDB exploitPublished 2009-11-10StubCVE-2009-35551 file

EDB-10071

Analysisdeepseek-v4-pro:cloud · 2026-07-30

Technical assessment

The artifact contains a private key, a certificate request, and a signed certificate for a subject with a null character (CN=*\x00thoughtcrime.noisebridge.net). It describes the NSS null-character CA certificate validation bypass vulnerability but provides no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a text file containing a description of CVE-2009-3555, a private RSA key, a certificate request, and a signed certificate. The content demonstrates a known SSL/TLS renegotiation vulnerability (NULL character in CN) but contains no executable code, concealed payload, or instructions for the reviewer. No backdoor or deceptive behavior is observed.

ClassificationStub

Model confidence95%

AuthenticationNot required

Languagestext

Target softwareMozilla NSS

Attack typesman-in-the-middleimpersonation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a text file containing cryptographic material (private key, certificate request, signed certificate) and a vulnerability description. It lacks any executable code, scripts, or instructions to perform the attack or scan for the vulnerability. It is a placeholder demonstrating the certificate material but is not a functional exploit or scanner.

exploits/multiple/remote/10071.txt:1-155

Requirements

Attacker must be able to perform a man-in-the-middle attack.exploits/multiple/remote/10071.txt:7
Target must use a vulnerable version of Mozilla NSS that fails to properly validate null characters in CA certificates.exploits/multiple/remote/10071.txt:3

Observed behavior

The file contains a private RSA key and a certificate request with a subject common name containing a null byte (\x00) to exploit NSS's improper domain name validation.exploits/multiple/remote/10071.txt:66exploits/multiple/remote/10071.txt:92-106exploits/multiple/remote/10071.txt:107-119
The file includes a signed certificate issued by ipsCA for the crafted subject, which could be used to impersonate a trusted server if the CA's root is trusted.exploits/multiple/remote/10071.txt:120-155

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Private Key: Payload withheldThe file includes a full RSA private key in PEM format, which is part of the proof-of-concept for the certificate validation bypass. It is not hidden or obfuscated and is presented as demonstration material.exploits/multiple/remote/10071.txt:92-106
Certificate: Payload withheldThe certificate contains a NULL byte in the Common Name, illustrating the CVE-2009-3555 vulnerability. This is the core of the PoC and is not a concealed payload.exploits/multiple/remote/10071.txt:120-155

Review boundaries

What the analysis did not establish

The artifact is a static text file with no executable code; it cannot be classified as an exploit or scanner.
The analysis is based solely on the provided text; no external tools or libraries were inspected.
Only the supplied text file was reviewed; no external resources or referenced URLs were fetched or analyzed.
The file contains a private key and certificate, but no active or concealed behavior is present in the text itself.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ExploitDB