CVE-2016-2402

Testing Vulnerable libraries in Xamarin Project - using OWASP dependency-check and SafeNuGet

#Xamarin Security - Vulnerable App: Xamarin Cross Platform App - currently Android only - which imports two vulnerable libraries: 1 SystemNetSecurity: 430 2 SquareOkHTTP3: 301 Checking vulnerabilities using OWASP dependency-check and SafeNuGet Steps to install / run solution: Import the solution to a Xamarin / C# compatible IDE (ie Visual Studio / Xamarin Studio)

Simple script for testing CVE-2016-2402 and similar flaws

cert pinning flaw POC Simple POC script for testing CVE-2016-2402 and similar flaws Read my blog post for details This utility will set up a HTTPS server that servers a malicious certificate chain to the client for a specific domain If traffic from an app with a vulnerable certificate pinning implementation is redirected to this server, the pinning control will be bypassed a

OkHttp sample app vulnerable to CVE-2016-2402

OkHttp simple-client app vulnerable to CVE-2016-2402 This is a fork of the default simple-client from the okhttp project Simple-client is a Java app that just does a GET request to apigithubcom and fetches the names of okhttp's contributors This fork has been edited so that OkHttp 301 is used for networking connections and certificate pinning is also used Ok