> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/tcp/443-https.md).

# HTTPS | 443

## 00. Basics

* Headers 

```bash
Content-Security-Policy	        ## Restricts resources loaded by the browser to prevent XSS attacks.
Strict-Transport-Security	## Enforces HTTPS-only access, blocking HTTP connections.
X-Content-Type-Options	        ## Prevents MIME-type sniffing, reducing drive-by download risks.
X-Frame-Options	                ## Blocks clickjacking by controlling frame embedding.
X-XSS-Protection	        ## Enables browser’s XSS filter to block some XSS attacks.
Referrer-Policy	                ## Controls referrer information in requests.
Permissions-Policy	        ## Limits access to features like geolocation and camera.
Cross-Origin-Resource-Policy	## Controls resource access from other origins.
Cross-Origin-Embedder-Policy	## Restricts cross-origin resource embedding.
Cross-Origin-Opener-Policy	## Isolates browsing context to prevent cross-origin access.
Cache-Control	                ## Prevents caching of sensitive data.
Access-Control-Allow-Origin	## Specifies allowed origins for resource access (CORS).
Access-Control-Allow-Methods	## Defines allowed methods for cross-origin requests (CORS).
Access-Control-Allow-Headers	## Specifies allowed headers in cross-origin requests (CORS).
Expect-CT	                ## Enforces Certificate Transparency to prevent fake certificates.
Feature-Policy	                ## Restricts browser features (now called Permissions-Policy).
Public-Key-Pins	                ## Specifies trusted public keys (deprecated).
X-Permitted-Cross-Domain-Policies	## Controls cross-domain interactions for Flash and PDF files.

## Set-Cookie
Secure	     ## Sends the cookie only over HTTPS, preventing interception on unencrypted connections.
HttpOnly     ## Blocks access to the cookie from JavaScript, protecting it from XSS attacks.
SameSite     ## Controls cross-site request behavior to prevent CSRF attacks. Options are:
    > Strict ## Sends the cookie only in same-site requests (not in cross-site requests).
    > Lax    ## Sends the cookie in top-level, same-site requests; partial protection for CSRF.
    > None   ## Sends the cookie in all requests; requires Secure if used.
```

## 01. Heartbleed

```bash
sslyze --heartbleed 10.10.10.79
```

## 02. Sniff Traffic

```bash
sudo mitmdump -p 443 --mode reverse:https://<SERVER-IP> --ssl-insecure --flow-detail=3          
```

## 03. SSL ERRORS

`SSL_ERROR_UNKNOWN_CA_ALERT` / `SSL_ERROR_HANDSHAKE_FAILURE_ALERT`

Need to create CA certificate.

```bash
## ------------------| Grab certificate
openssl s_client -connect IP:443

## ------------------| Verify/Check certificate
## Extension also can be pem,csr
openssl x509 -in PublicKey.cert -text

## ------------------| Create CA certificate
### Generate our key
openssl genrsa -out certificate.key 2048
### Generate certificate signing request 
### Place something for Internet Widgits and FQDN:h4rithd@fourtune.htb      
openssl req -new -key certificate.key -out certificate.csr
### Certificate signing
openssl x509 -req -in certificate.csr -CA PublicKey.cert -CAkey PrivateKey.pem -CAcreateserial -out certificate.pem -days 1024 -sha256             
### Package pkcs12 format for browsers
openssl pkcs12 -export -out certificate.pfx -inkey certificate.key -in certificate.pem -certfile PublicKey.cert
```

## 04. Extract .crt & .key files from .pfx

```bash
openssl pkcs12 -in [yourfile.pfx] -nodes -nocerts -out [drlive.key]
openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [drlive.crt]
openssl rsa -in [drlive.key] -out [drlive-decrypted.key]

openssl rsa -in [keyfile-encrypted.key] -outform PEM -out [keyfile-encrypted-pem.key]
```