What do you think would happen if someone accesses a site that has the HTST mechanism enabled, for the first time? Would SSL Stripping still be possible?
1
-
Does the thread HSTS bypass with SSLstrip2 + DNS2proxy answers to your question (in particular "If the client is requesting for the first time the server, it will work anytime")?– WhiteWinterWolfCommented Jan 18, 2016 at 10:25
Add a comment
|
1 Answer
Some browsers includes a mechanism named "HSTS preload", which consists of a list of sites which uses HSTS to avoid this "first-access" attack.
Google made a website which can be used to request the insertion of your website in those lists.
answered Jan 18, 2016 at 11:17
