New answers tagged

0

I would guess because you are arp spoofing the gateway IP address. Therefore when your victim navigates to 192.168.1.5, their traffic is going directly to 192.168.1.5 and not via the spoofed internet gateway (local traffic does not require the gateway). With ARP spoof, enter 192.168.1.5 as the last command argument intead of the gateway IP, and it should ...


4

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


0

HSTS is there to prevent users from acessing specific webpages without SSL for a specified time. Also there is a list maintained by google where website owners can add their website. Webpages that are listed there will never be contected using HTTP even if the server never requested the client to use SSL by HSTS. You can anyway prevent HSTS from working by ...


2

Yes, in a MITM scenario, an initial HTTP request is all it takes to successfully attack (if the user doesn't notice the missing HTTPS). And the only way to prevent this initial HTTP request is HTTP Strict Transport Security (HSTS). As you know, HSTS means that your server's HTTPS responses include a HSTS header telling the browser only to use HTTPS, i.e. ...


0

It seems they are different tools which achieve the same result. They don't really break TLS though. Both tools just perform a MITM, initiate the TLS handshake to the server and then send the victim a HTTP page. So if the victim is aware he will notice a missing green key in his browser. To avoid these types of attacks, HSTS was invented which forces the ...


5

Short answer: Yes, for resonable defintions of safe. HSTS protects you against sslstrip type attacks for sites you have visited recently using a non-compromised connection (or for some browsers sites that are stored in a hardcoded "preload list"). The regular SSL CA system protects you against MITM attacks of ssl connections where the attacker has not ...


0

An X.509 certificate is a format for sharing a public key along with the name of the entity that holds that public/private key pair and optional extensions such as usage. It is usually signed by a certificate authority in order that it is trusted. A X.509 certificate is used in many applications that rely on public/private keys for authentication and/or ...


0

X509 is the type for SSL certificates, these can differ in the purpose they have. When using a SSL connection with a server you use a X509 certificate with the purpose of server authentication: TLS Web Server Authentication (1.3.6.1.5.5.7.3.1) when using it for client authentication (2 way SSL) you need a certificate with TLS Web Client Authentication ...


0

Some browsers includes a mechanism named "HSTS preload", which consists of a list of sites which uses HSTS to avoid this "first-access" attack. Chromium Firefox Google made a website which can be used to request the insertion of your website in those lists.



Top 50 recent answers are included