Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.

Anyone know how Chrome defends against that tool?

share|improve this question
up vote 5 down vote accepted

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.

share|improve this answer
Just checked and yes, Firefox 17.0.1 has this fixed. The funny part is that also tried in my own system (Debian Testing) and the latest version of Iceweasel is vulnerable. – Ay0 Dec 24 '12 at 19:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.