0

Been trying to wrap my head around SSL stripping.

An explanation here writes:

Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs. Those original HTTP URLs still exist, though. Usually, you use 301 or 302 redirects to ensure users can’t reach the HTTP site, but if an attacker can manipulate the redirect, they can still send the user to that page.

How is it possible to get the user to the HTTP page if the server does an automatic redirect?

I am a newbie at networking and attacks so any help is appreciated helping me wrap my head around this!

Improve this question
8
  • "if an attacker can manipulate the redirect" -- that's the answer to your second question. Are you asking how an attacker can manipulate?
    – schroeder ♦
    Commented Apr 24, 2021 at 7:51
  • "Clone" means a copy of the site. Since this is a short answer and basically a quick definition, And since your guess at what clone means is wrong, I've removed that part of the question to focus on the meatier part.
    – schroeder ♦
    Commented Apr 24, 2021 at 7:53
  • OP, the initial request by the victim must by by http (not https) for the sslstrip attack to work. See youtube.com/watch?v=MFol6IMbZ7Y for more info.
    – mti2935
    Commented Apr 24, 2021 at 11:00
  • 1
    OP, In the article that you cited, where it reads 'but if an attacker can manipulate the redirect', this only works is the victim's initial request is by http. The attacker then 'strips' the 301 or 302 redirect to the https site from the response, and instead returns the page, but with all the htttps links changed to http. However, tf the victim makes the initial request by https, this attack doesn't work. This is why standards such as HSTS prevent sslstrip attacks. See blog.cloudflare.com/… for more info.
    – mti2935
    Commented Apr 24, 2021 at 13:32
  • @schroeder yes, that's my main question, apologies! How does the attacker manipulate the redirect? fundamentally, how is the stripped version of the page being served back to the client from the MITM?
    – banonazna
    Commented Apr 24, 2021 at 15:38

0

Reset to default

Browse other questions tagged .