HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

learn more… | top users | synonyms

4
votes
2answers
39 views

HSTS on a subdomain with includeSubdomains

Suppose that my site is located at foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS: Strict-Transport-Security: max-age=31536000; includeSubDomains ...
2
votes
1answer
44 views

Does HSTS make using a public WiFi safe?

What attacks, if any, are possible if I connect to a public WiFi network and only use my computer to access a previously-visited site that uses HSTS. I believe that attacks such as SSLstrip are not ...
0
votes
1answer
42 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
4
votes
1answer
43 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
1
vote
0answers
91 views

SSLStrip and bank portals [closed]

I am trying to use SSLstrip tool with Ettercap on Kali Linux to attack my personal bank account and yahoo account for testing purposes. I followed the instructions of this video (I run it on Kali ...
3
votes
2answers
95 views

How is HSTS handled on subdomains?

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com). According to the response headers, HSTS ...
1
vote
1answer
57 views

HSTS Policy being enforced *sometimes*

I've implemented an HSTS policy for our site. I have the header being served on our main domain and it's sent on the very first response from the server. (From the response that serves the 304 ...
7
votes
3answers
662 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
4
votes
1answer
271 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
4
votes
0answers
76 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
4
votes
1answer
2k views

Can HSTS be disabled in Firefox?

For pentesting/VA, it is, of course, imperative to be always be able to see the HTTP site of a target, if present. HSTS conflicts with this need. Without using a proxy to address the problem (e.g. ...
5
votes
2answers
77 views

Is there a HSTS equivalent for specifying TLS version?

HSTS allows me to force clients to connect to my website using HTTPS, but it doesn't specify the version of SSL, TLS, or what ciphers I'm prohibiting. Is there any HSTS alternative or extension that ...
4
votes
1answer
151 views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
4
votes
1answer
172 views

HPKP-based persistent denial-of-service attack on web sites

HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
2
votes
1answer
206 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
5
votes
1answer
357 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
0
votes
2answers
450 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
0
votes
2answers
116 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
8
votes
1answer
2k views

How does bypassing HSTS with SSLSTRIP+ work exactly?

I am doing research on bypassing HSTS. I read this guide on bypassing HSTS using SSLSTRIP+, but there are a few things that I don't understand. First thing to do is to fire up MITMf in SSLstrip+ ...
0
votes
1answer
83 views

HSTS implementation [closed]

I have a little doubt on using HSTS, as per this video, once HSTS is implemented , all the URLs will be going in HTTPS, but as we all know in using SSL we need pre-specified encryption algorithms and ...
2
votes
1answer
86 views

Certificate Pinning and Corporate MITM

What I still don't understand about certificate pinning is - why am I still able to access Google apps through a corporate MITM? I know that I have the root cert for my corporation installed on my PC, ...
8
votes
2answers
2k views

HSTS bypass with SSLstrip2 + DNS2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite ...
3
votes
1answer
110 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
15
votes
2answers
785 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
2
votes
2answers
167 views

The Need for includeSubDomains in HSTS RFC

I am trying to understand the includeSubDomains directive in the HTTP Strict Transport Security standard. In particular section 14.4 of RFC 6797 confuse me. Point 2. says The HTTP request sent to ...
2
votes
1answer
643 views

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources ...
2
votes
2answers
2k views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
3
votes
2answers
4k views

Checking domains HSTS status

The Google Chrome browser offers a quick way to check a domain's HSTS (HTTP Strict Transport Security) status via the page chrome://net-internals/#hsts (section Query domain). The query result looks ...
1
vote
1answer
154 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
1
vote
4answers
799 views

True or False: HSTS is absolutely useless against MITM attacks

I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents. Statement 1: If clients IO traffic goes through MITM from the start, can the ...
11
votes
2answers
600 views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
3
votes
1answer
1k views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
1
vote
2answers
227 views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
2
votes
2answers
289 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
7
votes
3answers
3k views

Why did Facebook not use HSTS for a long time after it became available?

(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.) To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP ...
2
votes
1answer
152 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
2
votes
1answer
719 views

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
15
votes
2answers
895 views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
5
votes
2answers
2k views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
8
votes
1answer
1k views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
23
votes
4answers
1k views

How can a web application protect users when the browser doesn't support HSTS?

HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. This ...