4

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS which collects the url of the sites which uses ssl and prevents the user from accessing the insecure http version of that site.

But in sslstrip+ (sslstrip2) a new method the attacker use a different domain name like http://wwww.facebook.com/ instead of http://www.facebook.com/ so that the browser will not find the domain in the hsts list and allows an insecure http connection with facebook (the attacking proxy of course).

But I just cant use sslstrip+ successfully in certain websites like mail.google.com, www.facebook.com etc...

It is said in Man-in-The-Middle Framework (MiTMF) - The tool that is available for linux (I installed it in kali linux) that it can evade HSTS also when we use --hsts handler (It uses sslstrip + when we use --hsts handler).

But this is not working well with the sites such as facebook and google. Anyway the tool mitmf redirects me to http://social.facebook.com/ (non-existing website and of course this may not be there in HSTS list of browser) when I visit http://www.facebook.com/ from victim's computer. But soon leads to a could not find www.facebook.com error. I think the url http://social.facebook.com may not be present in the hsts list of browser still I am unable to access the fake url of facebook from a victim machine.

Why does sslstrip + (I am not talking about the old sslstrip by Moxie Marlinspike) fail in these cases? Can someone explain the method which is used by these sites to evade sslstrip+ ? I googled a lot but didn't end up with an exact answer.

Improve this question

1 Answer 1

Reset to default
2

That's because Facebook, GMail and other websites are able to inform the browser that it is supposed (or not) to be secured with SSL thanks to HTTP Strict Transport Security (HSTS). This fixes the key problem with previous SSL implementations and what made SSLstrip possible.

Improve this answer
4
  • But it is said in Man-in-The-Middle Framework (MiTMF) - The tool that is available for linux (I installed it in kali linux) that it can evade HSTS also when we use --hsts handler. But this is not working well with the sites such as facebook and google. Anyway the tool mitmf redirects me to the social.facebook.com when I type facebook.com in victims computer. But soon leads to a could not find www.facebook.com error. I think the url social.facebook.com may not be present in the hsts list of browser still I am unable to access facebook.
    – Sandeep Thedarkprince C
    Commented Oct 18, 2015 at 17:56
  • 1
    @SandeepThedarkprinceC google for includeSubDomains modificator of hsts.
    – Cthulhu
    Commented Oct 19, 2015 at 8:08
  • @Cthulhu do you mean that social.facebook.com is treated as a subdomain of facebook.com? This is not always the case sometimes mitmf redirects to url like webfacebook.com which is entirely a different domain and not a subdomain of facebook.com
    – Sandeep Thedarkprince C
    Commented Oct 19, 2015 at 11:29
  • @SandeepThedarkprinceC what happens when you submit your crendentials on the fake domain? In my case I am able to sniff out the creds but just after the first attempt it redirects me to https site, and then I am unable to sslstrip anything again unless i clear victim's browser cookies.
    – Asak
    Commented Dec 5, 2015 at 13:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .