OpenSSL TLS 1.2 Renegotiation NULL Pointer Dereference

This repository provides a proof-of-concept (PoC) exploit for CVE-2021-3449, a denial-of-service vulnerability in OpenSSL versions prior to 1.1.1k. The exploit is implemented in Go and works by connecting to a TLS server and performing a malicious renegotiation handshake, which triggers a NULL pointer dereference in the server's OpenSSL library, causing it to crash. The main exploit logic is in `main.go` and the custom TLS logic is in the `tls/` directory, which is a modified copy of Go's standard library TLS implementation to allow for the crafted handshake. The repository also includes a comprehensive `demo/` directory with Dockerfiles and configurations for various popular server applications (OpenSSL s_server, Apache, HAProxy, lighttpd, nginx, Node.js) to demonstrate the exploit against real targets using the vulnerable OpenSSL version. The Makefile automates building the exploit and running it against these demo targets. The exploit is network-based and targets any TLS server using a vulnerable OpenSSL version with TLSv1.2 and secure renegotiation enabled. No fake or destructive payloads are present; the exploit is a legitimate denial-of-service PoC.