Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ive been playing around with sslstrip, arpspoof and ip_forward.

I read about the whole process at:

My goal was to sniff HTTPS connections, passwords and such.

So i have a test setup with different IP´s and i can only see the passwords when i use Internet Explorer. When i try with Chrome or another browser, it just wont work. The connection persist to stay on an HTTPS if i check on my WM-Windows 7 Mashine.

Is there a solution to this?

share|improve this question
up vote 4 down vote accepted

SSLStrip will work on any browser. This attack will fail to work under Firefox and Chrome for websites protected with HSTS. For example and should not be affected by SSLStrip because of HSTS. Internet Explorer is not complaint with RFC-6797, which describes the HSTS security measure and is therefore more susceptible to attacks like SSLStrip.

share|improve this answer
Perfect answer, many thanks. – Daniel Sep 9 '13 at 19:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.