Setting Up SSL on 0xsp-Mongoose

[abbddkr]

In this article, we'll show you the easiest way to set up SSL on 0xsp in order to feel securely either on your local or on public networks.

We are going to use let's encrypt, however, you have the freedom to choose what ever you want, if you're working on local network we highly recommend to use let's encrypt since it's one of the most trusted certificates by different browsers.

What’s Certbot?

Certbot is a free, open source software tool for automatically using Let’s Encrypt certificates on manually-administrated websites to enable HTTPS.

Installing Cerbot

for Ubuntu/Debian:

root@pentesting:~# sudo apt-add-repository -r ppa:certbot/certbot
root@pentesting:~# sudo apt update
root@pentesting:~# apt install certbot

after we installed cerbot, let's generate a new SSL certificate

root@pentesting:~# certbot certonly

OR manually

root@pentesting:~# certbot certonly --manual

Follow the instructions given in the terminal in order to complete the process. Anyway, at the end you'll get something similar to the following notes

    IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/allexploits.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/allexploits.com/privkey.pem
   Your cert will expire on 2021-03-30. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

for further information, click here

Connecting to 0xsp HTTPS Server

In order to have access to 0xsp server, we'll have to write certification's path.

.env

.env file is consisted of 4 important variables, we must add each path of the certificate we recently generated.

CHAIN_PATH=/etc/letsencrypt/live/allexploits.com/fullchain.pem
CERT_PATH=/etc/letsencrypt/live/allexploits.com/cert.pem
KEY_PATH=/etc/letsencrypt/live/allexploits.com/privkey.pem

Start the application

node index.js useSSL

Conclusion!

In conclusion, that was the easiest way to set up SSL certificate, however, you have a lot of ways to do these methods, using different tools and libraries, feel free to comment and share your new ideas.

Resources

1. Let's Encrypt
2. Cerbot
3. Self Signed SSL

[lawrenceamer]

thanks for sharing that