Timeline for SSL stripping - how is it possible to send back the HTTP page? [duplicate]
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 24, 2021 at 16:58 | comment | added | mti2935 |
So, the client makes the original request to http://paypal.com. Attacker passed the request through to Paypal. Paypal responds with a 301 redirect to https://paypal.com. Attacker ditches the redirect, and instead makes his own request to https://paypal.com. Attacker changes all of the https links in the response to http, and sends this back to the client. Client inputs his login credentials to the login form, and submits the form. You can guess what happens next...
|
|
| Apr 24, 2021 at 16:57 | comment | added | mti2935 | OP, it's possible if the attacker is between the client and the server, and the client makes the request by HTTP (and not HTTPS). In this case, the attacker can manipulate the request and/or the response in any way he wants. | |
| Apr 24, 2021 at 15:44 | comment | added | banonazna | @mti2935 I understand the basic setup, intercepting the HTTP request and becoming a MITM by serving the client back HTTP pages. my question is how is that possible? how is the stripped version of a page sent back to the client? how is the redirect manipulated? | |
| Apr 24, 2021 at 15:38 | comment | added | banonazna | @schroeder yes, that's my main question, apologies! How does the attacker manipulate the redirect? fundamentally, how is the stripped version of the page being served back to the client from the MITM? | |
| Apr 24, 2021 at 13:32 | comment | added | mti2935 | OP, In the article that you cited, where it reads 'but if an attacker can manipulate the redirect', this only works is the victim's initial request is by http. The attacker then 'strips' the 301 or 302 redirect to the https site from the response, and instead returns the page, but with all the htttps links changed to http. However, tf the victim makes the initial request by https, this attack doesn't work. This is why standards such as HSTS prevent sslstrip attacks. See blog.cloudflare.com/… for more info. | |
| Apr 24, 2021 at 11:00 | comment | added | mti2935 | OP, the initial request by the victim must by by http (not https) for the sslstrip attack to work. See youtube.com/watch?v=MFol6IMbZ7Y for more info. | |
| Apr 24, 2021 at 8:02 | history | duplicates list edited | schroeder♦ | duplicates list edited from HSTS bypass with SSLstrip2 + DNS2proxy to How does SSLstrip work?, HSTS bypass with SSLstrip2 + DNS2proxy | |
| Apr 24, 2021 at 8:02 | history | closed | schroeder♦ | Duplicate of HSTS bypass with SSLstrip2 + DNS2proxy | |
| Apr 24, 2021 at 7:54 | history | edited | schroeder♦ | CC BY-SA 4.0 |
deleted 681 characters in body
|
| Apr 24, 2021 at 7:53 | comment | added | schroeder♦ | "Clone" means a copy of the site. Since this is a short answer and basically a quick definition, And since your guess at what clone means is wrong, I've removed that part of the question to focus on the meatier part. | |
| Apr 24, 2021 at 7:51 | comment | added | schroeder♦ | "if an attacker can manipulate the redirect" -- that's the answer to your second question. Are you asking how an attacker can manipulate? | |
| Apr 24, 2021 at 7:44 | review | First posts | |||
| Apr 24, 2021 at 8:09 | |||||
| Apr 24, 2021 at 7:43 | history | asked | banonazna | CC BY-SA 4.0 |