TLS Attacks: BEAST, POODLE & Downgrade

TLS attacks fall into: protocol-level (BEAST, POODLE, DROWN), cryptographic (RC4 biases, Lucky13), and implementation (Heartbleed, BERserk). TLS 1.3 eliminates the protocol-level attacks by removing vulnerable algorithms.

Browser Exploit Against SSL/TLS: exploits CBC mode in TLS 1.0 where the IV for each record is the last ciphertext block of the previous record (predictable IV). Attacker injects chosen plaintext blocks to recover session cookies via a chosen-boundary attack.