SSLstrip is an attack against mixed HTTP/HTTPS connection where a man-in-the-middle downgrades HTTPS links to HTTP.

learn more… | top users | synonyms

3
votes
1answer
508 views

hsts bypass with sslstrip2 + dns2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite ...
2
votes
0answers
56 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
0
votes
0answers
68 views

sslstrip not stripping any redirected traffic

I am using the following configuration to set up sslstrip sudo echo "1" > /proc/sys/net/ipv4/ip_forward sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 666 ...