Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.

Anyone know how Chrome defends against that tool?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.

share|improve this answer
    
Just checked and yes, Firefox 17.0.1 has this fixed. The funny part is that also tried in my own system (Debian Testing) and the latest version of Iceweasel is vulnerable. –  yzT Dec 24 '12 at 19:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.