1

I am using SSLStrip against my own computer, but am not being redirected to HTTP. Skype automatically starts up and logs in at my computer's startup, so I was wondering whether the fact that port 80 is already in use (by Skype) defeats SSLStrip. It is my understanding that except for the fact that they are being redirected to a non-encrypted connection, it is impossible for a victim (or their AV) to tell SSLStrip is being used against them. If that is correct I would like to know if anyone has a way to cause Skype to restart on the victim computer so I can get port 80.

Improve this question
2
  • Just thought of a possible way while writing the question, sending a DeAuth token to the browser and disconnecting them for a second. I will test and see if it works.
    – KnightOfNi
    Commented Dec 16, 2013 at 15:55
  • Microsoft is ignoring the RFC's to address SSLStrip, IE contains more known vulnerabilities than any other piece of activity maintained code. The reflective XSS filter is completely and totally non-functional.
    – rook
    Commented Dec 16, 2013 at 16:08

2 Answers 2

Reset to default
1

SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS.

I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

Improve this answer
0

SSLstrip works by listening for https traffic and redirecting it to http.

For one thing Skype does not use http it uses its own proprietary protocol. For another they do not offer a non-encrypted version of their protocol the way https does with http so the concept of an SSLstrip type attack will not work.

For those reasons SSLstrip will not work against Skype.

Improve this answer
4
  • This is true, but my question is asking if Skype will prevent SSLstrip from working at all by preventing it from binding to port 80.
    – KnightOfNi
    Commented Mar 21, 2014 at 19:13
  • Skype does not bind port 80, why should it?. And usually sslstrip is not running on the same computer as Skype does. Maybe your are missing some understanding of how client-server communication with TCP works, what the bind is for and who will do it.
    – Steffen Ullrich
    Commented Mar 22, 2014 at 6:34
  • @KnightOfNi I apologize if my answer was not clear. One way of using SSLstrip is to listen on an unrelated port like 1234. When traffic destined for a https port (443) passes through the attacker's computer, it is redirected to SSLstrip's port (1234), through firewall rules for example. Even if SSLstrip is running on the same machine as Skype, it is not a problem what port Skype wants to use.
    – user2675345
    Commented Mar 24, 2014 at 9:12
  • When I was working with SSL-inspection, Lync (Lync later became part of Skype for business) proved impossible to decrypt due to SSL certificate pinning. I do not know if Skype does the same.
    – Dog eat cat world
    Commented Aug 27, 2018 at 6:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .