I've heard about the new SSLStrip
and how it is able to bypass HSTS
.
- Where can I find an article that talks about this?
- How does this work?
- Where can I download it? Moxie's website has not been updated with new versions since 2011.
There is no new version of sslstrip since 2011 and the feature is already there.
How It works:
First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the first time and you intercept the traffic in between don't allow the header to reach to the client.
The important header field of HSTS that allows client to communicate over HTTPS to the server domains and subdomains is
Strict-Transport-Security:max-age = "value"
So if you are intercepting the header and not allowing HSTS to reach to the client then SSLStrip will do a job.
Cons of described method
The above described method will not work if the client is configured to use HSTS(Preloaded and static methods) for some domains and there sub-domains. Since there are many browsers like Chrome which uses Preloaded HSTS(not static) configuration for the some sites. Refer this link to see the HSTS lists with max-age defined
But It can also be evaded, refer this link
From Wikipedia:
The HSTS Policy is communicated by the server to the user agent via a HTTP response header field named
"Strict-Transport-Security"
. HSTS Policy specifies a period of time during which the user agent shall access the server in a secure-only fashion.
In short, just trim out this response header field to the browser and it will never know that it has to enforce this. Nothing to do with redirection.