Skip to main content
Information Security

Return to Answer

Commonmark migration
Source Link
Community Bot
Community Bot
  • 1

SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS.

#SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS. II think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

#SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS. I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS.

I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

deleted 1 character in body
Source Link
Benoit Esnard
Benoit Esnard
  • 14.7k
  • 7
  • 70
  • 69

#SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS. I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTPSHTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

#SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS. I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTPS.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

#SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS. I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

Source Link
StackzOfZtuff
StackzOfZtuff
  • 18.2k
  • 1
  • 54
  • 86

#SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS. I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTPS.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.