Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc...

The thing I saw is my session id is always on my URL.. I copy/pasted it on another browser and I successfully logged in from it without entering username/password(on the new browser).

So my question is whether https:// (get) links sniffable over the wire (e.g., with ettercap)? Should I be worried?

share|improve this question

marked as duplicate by Gilles, AJ Henderson, Rory Alsop Apr 5 '13 at 7:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4 Answers 4

up vote 12 down vote accepted

HTTPS uses TLS, which is Transport Layer Security. HTTP as a protocol, runs above the transport layer. This means that all of the communication made by HTTPS, including the URL is protected.

Passing the session id in the URL is insecure for other reasons. For example it exposes the possibility of Session Fixation. The Session ID written to paper if a user prints a webpage. It also defeats the use of HTTPOnly cookies... This is just a bad idea and its likely that this bank has made other poor choices in regards to security.

share|improve this answer
1  
is right, but I think understates this. The bank's implementation is fundamentally flawed. I would switch banks. –  Mark C. Wallace Feb 15 '13 at 18:26
2  
To elaborate on session fixation, an attacker Eve can get the bank to issue her a fresh session ID while not logged in. If she then convinces you to follow a link with this session ID, and you then log in, Eve already knows the session ID for your authenticated session. There are mitigation measures, like resetting sessions on authentication. But as Rook stated, the fact that your bank is making a trivial security misstep like this virtually guarantees that it is making others as well. –  Stephen Touset Feb 15 '13 at 18:43

No the URL is not passed in plain text when making an HTTP request but as Rook stated, there are other vulnerabilities in passing session id in the URL. One of them is that your sessions ID will be listed as the referrer url. So if you click a link from your banks website to another website, the linked site will now log your session id. The same will happen with any images or scripts loaded. On top of the problem with the linked site storing the information, if the link is to a non-https site, then that referrer url containing your session id will be sent in plain text allowing anyone sniffing the network to get the URL.

share|improve this answer

When using HTTPS the traffic will be encrypted. The only catch here is that if a malicious user had access to sniff your traffic he may also be able to abuse act as the destination server and setup an encrypted connection with you that looks as if it is your bank. The attacker will then create another session with the bank and forward all your requests to the bank and all responses back to you. This gives you the illusion that you are in fact communicating with your bank when you are not.

This is where certificates come in to play as they can be used to verify that the destination is who they say they are. In this case you bank.

There are also some ways to abuse certificates to make them look legitimate.

I would recommend you check out: http://www.thoughtcrime.org/software/sslsniff/

A great video around this topic can be be found here: https://www.youtube.com/watch?v=ibF36Yyeehw

share|improve this answer

I'm going to have to disagree with some of the answers here. In a strict sense no URLs cannot be purely sniffed as they are protected by SSL as rightly stated.

In the spirit of the "am I safe" sense of the question be aware that if they are in a position to sniff they commonly could conduct a MITM attack, gaining details even with sites you're typically using SSL for. (See sslstrip).

Point being always pay attention to your browser and don't take things for granted :)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.