Description

Detects SSL certificates using dangerous wildcard patterns that could allow attackers to spoof legitimate subdomains. A wildcard certificate matching pattern like *.example.com allows any subdomain to be validated, potentially enabling phishing attacks if an attacker can register arbitrary subdomains.

Detection Strategy

• Certificate's subject alternative names (SANs) include wildcard patterns (e.g. *.example.com)

• The accessed domain name does not exactly match any of the certificate's valid domain names

• The accessed domain matches one of the certificate's wildcard patterns