4

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS which collects the url of the sites which uses ssl and prevents the user from accessing the insecure http version of that site.

But in sslstrip+ (sslstrip2) a new method the attacker use a different domain name like http://wwww.facebook.com/ instead of http://www.facebook.com/ so that the browser will not find the domain in the hsts list and allows an insecure http connection with facebook (the attacking proxy of course).

But I just cant use sslstrip+ successfully in certain websites like mail.google.com, www.facebook.com etc...

It is said in Man-in-The-Middle Framework (MiTMF) - The tool that is available for linux (I installed it in kali linux) that it can evade HSTS also when we use --hsts handler (It uses sslstrip + when we use --hsts handler).

But this is not working well with the sites such as facebook and google. Anyway the tool mitmf redirects me to http://social.facebook.com/ (non-existing website and of course this may not be there in HSTS list of browser) when I visit http://www.facebook.com/ from victim's computer. But soon leads to a could not find www.facebook.com error. I think the url http://social.facebook.com may not be present in the hsts list of browser still I am unable to access the fake url of facebook from a victim machine.

Why does sslstrip + (I am not talking about the old sslstrip by Moxie Marlinspike) fail in these cases? Can someone explain the method which is used by these sites to evade sslstrip+ ? I googled a lot but didn't end up with an exact answer.

2

That's because Facebook, GMail and other websites are able to inform the browser that it is supposed (or not) to be secured with SSL thanks to HTTP Strict Transport Security (HSTS). This fixes the key problem with previous SSL implementations and what made SSLstrip possible.

  • But it is said in Man-in-The-Middle Framework (MiTMF) - The tool that is available for linux (I installed it in kali linux) that it can evade HSTS also when we use --hsts handler. But this is not working well with the sites such as facebook and google. Anyway the tool mitmf redirects me to the social.facebook.com when I type facebook.com in victims computer. But soon leads to a could not find www.facebook.com error. I think the url social.facebook.com may not be present in the hsts list of browser still I am unable to access facebook. – Sandeep Thedarkprince C Oct 18 '15 at 17:56
  • 1
    @SandeepThedarkprinceC google for includeSubDomains modificator of hsts. – Cthulhu Oct 19 '15 at 8:08
  • @Cthulhu do you mean that social.facebook.com is treated as a subdomain of facebook.com? This is not always the case sometimes mitmf redirects to url like webfacebook.com which is entirely a different domain and not a subdomain of facebook.com – Sandeep Thedarkprince C Oct 19 '15 at 11:29
  • @SandeepThedarkprinceC what happens when you submit your crendentials on the fake domain? In my case I am able to sniff out the creds but just after the first attempt it redirects me to https site, and then I am unable to sslstrip anything again unless i clear victim's browser cookies. – Asak Dec 5 '15 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.