Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using SSLStrip against my own computer, but am not being redirected to HTTP. Skype automatically starts up and logs in at my computer's startup, so I was wondering whether the fact that port 80 is already in use (by Skype) defeats SSLStrip. It is my understanding that except for the fact that they are being redirected to a non-encrypted connection, it is impossible for a victim (or their AV) to tell SSLStrip is being used against them. If that is correct I would like to know if anyone has a way to cause Skype to restart on the victim computer so I can get port 80.

share|improve this question
    
Just thought of a possible way while writing the question, sending a DeAuth token to the browser and disconnecting them for a second. I will test and see if it works. –  KnightOfNi Dec 16 '13 at 15:55
    
Microsoft is ignoring the RFC's to address SSLStrip, IE contains more known vulnerabilities than any other piece of activity maintained code. The reflective XSS filter is completely and totally non-functional. –  Rook Dec 16 '13 at 16:08
add comment

1 Answer

SSLstrip works by listening for https traffic and redirecting it to http.

For one thing Skype does not use http it uses its own proprietary protocol. For another they do not offer a non-encrypted version of their protocol the way https does with http so the concept of an SSLstrip type attack will not work.

For those reasons SSLstrip will not work against Skype.

share|improve this answer
    
This is true, but my question is asking if Skype will prevent SSLstrip from working at all by preventing it from binding to port 80. –  KnightOfNi Mar 21 at 19:13
    
Skype does not bind port 80, why should it?. And usually sslstrip is not running on the same computer as Skype does. Maybe your are missing some understanding of how client-server communication with TCP works, what the bind is for and who will do it. –  Steffen Ullrich Mar 22 at 6:34
    
@KnightOfNi I apologize if my answer was not clear. One way of using SSLstrip is to listen on an unrelated port like 1234. When traffic destined for a https port (443) passes through the attacker's computer, it is redirected to SSLstrip's port (1234), through firewall rules for example. Even if SSLstrip is running on the same machine as Skype, it is not a problem what port Skype wants to use. –  user2675345 Mar 24 at 9:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.