66

For pentesting/VA, it is, of course, imperative to always be able to see the HTTP site of a target. If present, HSTS conflicts with this need.

Without using a proxy to address the problem (e.g. Burp), is it possible to natively disable HSTS in Firefox?

Improve this question
7
  • 4
    I doubt it. It would run counter to the No User Resource desire in the HSTS standard.
    – user
    Oct 9, 2015 at 12:41
  • Out of curiosity, why the "without using a proxy" requirement? Web pentesting without an intercepting proxy would be like trying to write code in Notepad; you could technically do it, but you'd be wasting far more of your time than it would take do download a minimally-proper tool for the task. HSTS can be easily bypassed or suppressed (set the max-age to 0) in a proxy.
    – CBHacking
    Oct 9, 2015 at 19:05
  • This is a pure Firefox question, not an InfoSec question. I'd ask over on Firefox forums.
    – schroeder ♦
    Oct 9, 2015 at 20:57
  • 1
    @CBHacking "without a proxy" is no requirement of mine; it was just a way to avoid getting answers that say "you could do this in your proxy". I was simply interested as to whether anyone knew if it could be switched off in the browser.
    – Cheekysoft
    Oct 12, 2015 at 14:02
  • 2
    @MichaelKjörling, "No User Resource" refers to "should not be presented with a dialog". But we ain't talking about dialogs here, shouldn't the browser provide at least some obscure settings for testers who wish to disable it?
    – Pacerier
    Nov 6, 2015 at 9:36

4 Answers 4

Reset to default
43
  1. Type about:support in firefox
  2. Click Profile Folder | Open Folder which should open your profile folder.
  3. Find file called SiteSecurityServiceState.txt and open it
  4. Find the entry for your site url and remove it. Entry would looks something like - github.com:HSTS 120 17242 1521194647604,1,1
  5. Make sure for above firefox is closed so that it does not overwrite it.

Firefox stores HSTS entries in this file with their expiration periods. Removing this entry should allow you to hit http url. TO further prevent it you can probably change permission of this file to read only.

More details - Understanding HTTP Strict Transport Security (HSTS)

NOTE : This will not work for well known sites like google as those lists are preloaded by browsers. Works fine for others. See above link for details.

Improve this answer
1
  • A bit clunky but I can confirm this works in Firefox 79.
    – user1258361
    Dec 4, 2020 at 18:46
28

I was able to disable it by setting network.stricttransportsecurity.preloadlist to false in about:config

Then, to see the add exception button you may need to refresh the cache doing the 5 steps listed here: https://security.stackexchange.com/a/154176

Improve this answer
9
  • Does not work on 67.0.2+build2-0ubuntu0.16.04.1
    – Willem
    Jun 17, 2019 at 9:06
  • Works on FF 68.0.
    – harvzor
    Jul 18, 2019 at 11:31
  • Tested on Firefox 67 and 68. Does not work. -1
    – user1258361
    Aug 15, 2019 at 19:13
  • 4
    Works on Firefox 71, you might also want to remove the site from your history first by using the "Forget about this site" feature (from the History)
    – Romuald Brunet
    Dec 13, 2019 at 19:16
  • Works on Linux - Firefox 71. No need to do anything else.
    – Stefanos Chrs
    Jan 7, 2020 at 0:01
24

According to several forums, you can disable HSTS by introducing a new configuration variable. First, go to the Firefox configuration page (about:config), right-click, choose "New Integer", then provide the name "test.currentTimeOffsetSeconds" (no quotes) with a value of 11491200. This should bypass HSTS, although you may also need to clear the Cache and Active Logins in the Clear Recent History dialog (Ctrl-Shift-Del).

This apparently works because of a function called GetPreloadListEntry that checks to see if the current time is less than the next list expiration time; since the time is effectively calculated to be later than the expiration time, no check is performed. This effectively disables HSTS checks.

Improve this answer
7
  • This does not work on Firefox 45.0.2 for Mac. Check is not disabled.
    – MST
    May 31, 2016 at 17:51
  • Doesn't work on Linux with failfox 46.0
    – Super-intelligent Shade
    Jun 5, 2016 at 20:38
  • 1
    Works in Firefox 47.0 in Windows if "Forget About This Site" is also used.
    – Neurotransmitter
    Jul 11, 2016 at 10:36
  • Doesn't work on Linux with Firefox 49.0, even if "Forget About This Site" is also used.
    – LegionMammal978
    Nov 22, 2016 at 18:27
  • 1
    It does work on Linux with Firefox 51.0.1. To "Forget About This Site" press "Ctrl+h", search for the domain you want to forget (perhaps you need to do that not only on "example.com" but also on "a.example.com", "b.example.com" etc), right-click and select "Forget ..." on all the matches. Maybe you will also require restart.
    – derenio
    Feb 27, 2017 at 11:20
1

If your scenario is that you've accidentally set HSTS on a site you're working on and need to clear it, "Forget about this site" does the trick.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .