Tag Info

New answers tagged

0

since Internet Explorer seems to be the only browser vulnerable to this attack. That is the false assumption which is largely responsible of your situation because on February 2015, Microsoft already released HTTP Strict Transport Security in Internet Explorer 11. It is clear, regarding the error message you got, that your IE version is 11 or higher. ...


2

You can't authenticate as the server The problem is not that the server will "throw a fuss" it won't. You can easily spoof the server into thinking you are the user. The user isn't authenticating with an SSL cert. The problem is you can't trick the user or more specifically the user's browser. Remember for a MITM attack the attacker needs to establish ...


0

What are you asking for? Technical details or legal aspects? Technical details will rely on your company's infrastructure. In general, you have to create your own Certificate Authority, install its certificate as trusted in company's computers and then generate false certificates for each domain you want to test. Legal aspects cover 2 things: Company ...


1

To answer the original question - most people never type https://something.com directly. They rely either on links (click here to access our secure login server) or on redirects (type "gmail.com" in the browser, and you will be automatically redirected to a secure site). This is where SSLStrip comes in - it intercepts the original, unsecured HTTP reply, and ...



Top 50 recent answers are included