Tag Info

New answers tagged

0

You may want to look into setting your webserver to HSTS (Strict Transport Security) which uses a special response header to tell the browser to only accept https traffic. Full Disclosure: As you might have expected, IE support < 11 I believe is limited. If you must use something client-side to check for https I think you could use ...


0

You might try the following: Create a cookie with Javascript. Set the secure flag on the cookie, so that it is only usable for https connections. Make a https request to the server and check if the secure cookie was received. If it was not received then you can assume that the request on the client side was not done with https, i.e. something like sslstrip ...


0

AFAIK, there is no alternative to just trying it out. You also want to check, that both requests return the same content; in principle it is possible to configure, e.g., the popular Apapche httpd such that it returns different content depending on the protocol used.


2

I'm going to assume that you are talking about HSTS. HSTS is TOFU (Trust on first use). So from the second use onwards, you are protected. But what about that first use? I don't think there's a unified strategy. But here's some ideas: What works today HSTS Preloading: Use a browser that makes use of the HSTS preload lists. (Chrome, Firefox) And hope ...


-2

SSLstrip was a tool to test for MITM weaknesses agains the SSL protocol during the initial handshake process. It performed a cipher downgrade attack which tricked the server into using a very weak encryption cipher leaving the connection open for further attacks with frequency analysis etc. The weakness it tested against has long been fixed. The handshake ...


0

This depends on how the site handles the user going straight to HTTPS. If the site redirects back to plain HTTP at any point, then the SSL strip attack can succeed. Some sites only enforce https for pages they deem sensitive, like the checkout. They may purposely redirect their users to plain HTTP for other pages. If they do, then the user typing https does ...


4

No, that is not possible. In case the user types 'https://', the secure tunnel is generated, and SSLStrip cannot interfere anymore. SSLStrip works by intercepting HTTPS redirects sent from the server. SSLstrip then sets up a HTTPS connection with the server (the server thus thinks everything is ok), but keeps an HTTP connection with the victim. SSLStrip ...


0

There is a walkthrough of the entire process here -- http://sign0f4.blogspot.com/2014/10/mitmf-v07-released-sslstrip-integration.html In summary, the author of the blog posts demonstrates using sslstrip2 and dns2proxy to capture credentials. While the author is using his own MITMf tool, the tool encapsulates sslstrip2 and dns2proxy, as well as the hsts ...



Top 50 recent answers are included