34

For pentesting/VA, it is, of course, imperative to always be able to see the HTTP site of a target. If present, HSTS conflicts with this need.

Without using a proxy to address the problem (e.g. Burp), is it possible to natively disable HSTS in Firefox?

  • 3
    I doubt it. It would run counter to the No User Resource desire in the HSTS standard. – a CVn Oct 9 '15 at 12:41
  • Out of curiosity, why the "without using a proxy" requirement? Web pentesting without an intercepting proxy would be like trying to write code in Notepad; you could technically do it, but you'd be wasting far more of your time than it would take do download a minimally-proper tool for the task. HSTS can be easily bypassed or suppressed (set the max-age to 0) in a proxy. – CBHacking Oct 9 '15 at 19:05
  • This is a pure Firefox question, not an InfoSec question. I'd ask over on Firefox forums. – schroeder Oct 9 '15 at 20:57
  • @CBHacking "without a proxy" is no requirement of mine; it was just a way to avoid getting answers that say "you could do this in your proxy". I was simply interested as to whether anyone knew if it could be switched off in the browser. – Cheekysoft Oct 12 '15 at 14:02
  • 1
    @MichaelKjörling, "No User Resource" refers to "should not be presented with a dialog". But we ain't talking about dialogs here, shouldn't the browser provide at least some obscure settings for testers who wish to disable it? – Pacerier Nov 6 '15 at 9:36
20

According to several forums, you can disable HSTS by introducing a new configuration variable. First, go to the Firefox configuration page (about:config), right-click, choose "New Integer", then provide the name "test.currentTimeOffsetSeconds" (no quotes) with a value of 11491200. This should bypass HSTS, although you may also need to clear the Cache and Active Logins in the Clear Recent History dialog (Ctrl-Shift-Del).

This apparently works because of a function called GetPreloadListEntry that checks to see if the current time is less than the next list expiration time; since the time is effectively calculated to be later than the expiration time, no check is performed. This effectively disables HSTS checks.

  • This does not work on Firefox 45.0.2 for Mac. Check is not disabled. – MST May 31 '16 at 17:51
  • Doesn't work on Linux with failfox 46.0 – Innocent Bystander Jun 5 '16 at 20:38
  • 1
    Works in Firefox 47.0 in Windows if "Forget About This Site" is also used. – TranslucentCloud Jul 11 '16 at 10:36
  • Doesn't work on Linux with Firefox 49.0, even if "Forget About This Site" is also used. – LegionMammal978 Nov 22 '16 at 18:27
  • 1
    It does work on Linux with Firefox 51.0.1. To "Forget About This Site" press "Ctrl+h", search for the domain you want to forget (perhaps you need to do that not only on "example.com" but also on "a.example.com", "b.example.com" etc), right-click and select "Forget ..." on all the matches. Maybe you will also require restart. – derenio Feb 27 '17 at 11:20
17
  1. Type about:support in firefox
  2. Click show in folder which should open your profile folder.
  3. Find file called SiteSecurityServiceState.txt and open it
  4. Find the entry for your site url and remove it. Entry would looks something like - github.com:HSTS 120 17242 1521194647604,1,1
  5. Make sure for above firefox is closed so that it does not overwrite it.

Firefox stores HSTS entries in this file with their expiration periods. Removing this entry should allow you to hit http url. TO further prevent it you can probably change permission of this file to read only.

More details - Understanding HTTP Strict Transport Security (HSTS)

NOTE : This will not work for well known sites like google as those lists are preloaded by browsers. Works fine for others. See above link for details.

2

I was able to disable it by setting network.stricttransportsecurity.preloadlist to false in about:config

1

If your scenario is that you've accidentally set HSTS on a site you're working on and need to clear it, "Forget about this site" does the trick.

protected by Community Dec 10 '18 at 8:15

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.