Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Ive been playing around with sslstrip, arpspoof and ip_forward.

I read about the whole process at: http://www.thoughtcrime.org/software/sslstrip/index.html

My goal was to sniff HTTPS connections, passwords and such.

So i have a test setup with different IP´s and i can only see the passwords when i use Internet Explorer. When i try with Chrome or another browser, it just wont work. The connection persist to stay on an HTTPS if i check on my WM-Windows 7 Mashine.

Is there a solution to this?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

SSLStrip will work on any browser. This attack will fail to work under Firefox and Chrome for websites protected with HSTS. For example Google.com and gmail.com should not be affected by SSLStrip because of HSTS. Internet Explorer is not complaint with RFC-6797, which describes the HSTS security measure and is therefore more susceptible to attacks like SSLStrip.

share|improve this answer
    
Perfect answer, many thanks. –  Daniel Sep 9 '13 at 19:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.