Finding Threat Actor Infrastructure With SSL Certificates
7The presentation will focus on practical tips and case studies. Attendees of all skill levels will understand how to use new tools and techniques to help them with their work. Some topics are basic, some are more advanced.
Each tip/tool in the talk will focus on a recent real-world use case and accessible tooling. Most of the examples will relate to cyber crime or hostile nation state info ops (nothing sensitive or critical will be covered).
The talk will cover:
SSL certificates 101 (briefly)
How to attribute infrastructure with SSL certificates
Finding hidden infrastructure with crt.sh
Using sslyze to verify and find infrastructure behind Cloudflare
Needle in a haystack: using Zgrab2 to find SSL certificates and hidden infrastructure across the whole web.
View upcoming Summits: http://www.sans.org/u/DuS
SANS Open-Source Intelligence Summit 2025
Finding Threat Actor Infrastructure With SSL Certificates
Steven Harris, SANS Certified Instructor