HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

learn more… | top users | synonyms

1
vote
1answer
35 views

How can I add my website to preload entries set of well-known browsers like Firefox or Chrome?

I have a website like https://www.example.com. I need to force all users visiting my site to use HTTPS connections. I thought about HSTS but I don't know how to add my site to the preload entries of ...
2
votes
1answer
29 views

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS)?

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS) and if so, why? With preloading: Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Without ...
27
votes
5answers
3k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
3
votes
2answers
41 views

How to see when a HSTS domain is about to expire?

We have a customer who claims his site (which we host) is under HSTS, but we cannot confirm this. I told him to open that chrome page chrome://net-internals/#hsts and query for his domain, and indeed ...
0
votes
1answer
52 views

Does ARP or DNS spoofing play a role when performing MITM in fake AP attacks?

I have a test environment, where I try some wireless hacking tools and approaches, and lately I have been interested in evil twin attacks. I created a fake AP using airbase-ng, and specified the IP ...
1
vote
1answer
64 views

How do websites prevent certificate forgery?

I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack ...
0
votes
0answers
37 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
3
votes
1answer
69 views

May HSTS block access to your site when you renew your SSL certificate?

I've thinking in using HSTS in my sites but I don't understand if I need to sync the HSTS timing with the time when the certificate is going to be renewed or not. Can I use safely a static time for ...
1
vote
0answers
34 views

Does NSURLConnection on iOS support HSTS?

I have an app for iOS that uses NSURLConnection to retrieve things from a server. Will enabling HTTP Strict Transport Security (HSTS) on the server have any impact on the app? Will it refuse to ...
6
votes
2answers
1k views

How does HSTS stop MitM attacks?

I know that until a few years ago, someone could set up a fake wireless AP, and use something like SSLStrip to lure the victims into connecting to insecure versions of the major websites, such as ...
1
vote
1answer
32 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def....
2
votes
2answers
89 views

Should HSTS be declared on all assets, or just on HTML files?

I am curious if the HSTS response header should be declared on every asset of a sitewide secure site, or just on the HTML pages? I imagine it should be included on all assets including all JS, CSS, ...
4
votes
2answers
105 views

Should HSTS header be sent on an error response?

We need to configure our loadbalancer to send the HSTS header and we are debating whether or not to send the header on HTTP 4xx/5xx responses. Our main concern is application layer DDos attacks. We ...
6
votes
3answers
1k views

Does HTTP Strict Transport Security (HSTS) make any sense in server to server communication?

We occasionally get findings for not having HSTS enabled on our HTTPS interfaces, but since these interfaces are server to server only, would enabling HSTS make any difference security wise?
3
votes
1answer
16 views

Is this HSTS header set correctly in LAMP?

I have a LAMP server and my SSL certificate provider recommended me to set HSTS header as follows. I am wondering about two things. Header always set Strict-Transport-Security "max-age=63072000; ...
1
vote
2answers
28 views

Strict-transport-security Mixed Conent - same domain?

I'm reasearching the strict-transport-security protocol, and am writing a plugin for Firefox to highlight some of the issues with the protocol. One of the things that i'm looking at is mixed content. ...
2
votes
0answers
74 views

If I clear my browsing data, is HSTS protection removed?

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?
7
votes
1answer
1k views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
3
votes
1answer
57 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
5
votes
2answers
223 views

HSTS on a subdomain with includeSubdomains

Suppose that my site is located at foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS: Strict-Transport-Security: max-age=31536000; includeSubDomains ...
2
votes
1answer
95 views

Does HSTS make using a public WiFi safe?

What attacks, if any, are possible if I connect to a public WiFi network and only use my computer to access a previously-visited site that uses HSTS. I believe that attacks such as SSLstrip are not ...
0
votes
1answer
234 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
5
votes
1answer
69 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
1
vote
0answers
124 views

SSLStrip and bank portals [closed]

I am trying to use SSLstrip tool with Ettercap on Kali Linux to attack my personal bank account and yahoo account for testing purposes. I followed the instructions of this video (I run it on Kali ...
4
votes
2answers
166 views

How is HSTS handled on subdomains?

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com). According to the response headers, HSTS ...
1
vote
1answer
101 views

HSTS Policy being enforced *sometimes*

I've implemented an HSTS policy for our site. I have the header being served on our main domain and it's sent on the very first response from the server. (From the response that serves the 304 ...
6
votes
3answers
788 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
4
votes
1answer
460 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
4
votes
2answers
162 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
6
votes
1answer
7k views

Can HSTS be disabled in Firefox?

For pentesting/VA, it is, of course, imperative to be always be able to see the HTTP site of a target, if present. HSTS conflicts with this need. Without using a proxy to address the problem (e.g. ...
6
votes
2answers
106 views

Is there a HSTS equivalent for specifying TLS version?

HSTS allows me to force clients to connect to my website using HTTPS, but it doesn't specify the version of SSL, TLS, or what ciphers I'm prohibiting. Is there any HSTS alternative or extension that ...
3
votes
1answer
196 views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
4
votes
1answer
241 views

HPKP-based persistent denial-of-service attack on web sites

HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
3
votes
1answer
303 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
5
votes
1answer
1k views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
0
votes
2answers
653 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
0
votes
2answers
147 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
10
votes
1answer
4k views

How does bypassing HSTS with SSLSTRIP+ work exactly?

I am doing research on bypassing HSTS. I read this guide on bypassing HSTS using SSLSTRIP+, but there are a few things that I don't understand. First thing to do is to fire up MITMf in SSLstrip+ ...
0
votes
1answer
92 views

HSTS implementation [closed]

I have a little doubt on using HSTS, as per this video, once HSTS is implemented , all the URLs will be going in HTTPS, but as we all know in using SSL we need pre-specified encryption algorithms and ...
2
votes
1answer
115 views

Certificate Pinning and Corporate MITM

What I still don't understand about certificate pinning is - why am I still able to access Google apps through a corporate MITM? I know that I have the root cert for my corporation installed on my PC, ...
9
votes
2answers
4k views

HSTS bypass with SSLstrip2 + DNS2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite don'...
5
votes
1answer
139 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
16
votes
2answers
850 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
2
votes
2answers
184 views

The Need for includeSubDomains in HSTS RFC

I am trying to understand the includeSubDomains directive in the HTTP Strict Transport Security standard. In particular section 14.4 of RFC 6797 confuse me. Point 2. says The HTTP request sent to ...
3
votes
1answer
900 views

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources http://...
1
vote
2answers
2k views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
7
votes
2answers
7k views

Checking domains HSTS status

The Google Chrome browser offers a quick way to check a domain's HSTS (HTTP Strict Transport Security) status via the page chrome://net-internals/#hsts (section Query domain). The query result looks ...
2
votes
1answer
215 views

How can non-secure or non-HTTP-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and HTTP-only and remaining 5 are neither. In this scenario, in what ways can we ...
2
votes
4answers
1k views

True or False: HSTS is absolutely useless against MITM attacks

I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents. Statement 1: If clients IO traffic goes through MITM from the start, can the ...
11
votes
2answers
788 views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...