What can I do to sniff the traffic by SSLStrip when the user has automatic login to the site?

closed as unclear what you're asking by Adi, Steffen Ullrich, Mark, WhiteWinterWolf, schroeder Nov 1 '15 at 17:54

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • why do you think that you would have a problem with auto-login? – schroeder Oct 31 '15 at 22:27
  • @schroeder think about it. anyway sslstrip is useless on sites like facebook twitter etc because hsts . – Antonio Oct 31 '15 at 23:36
  • your comment makes no sense – schroeder Nov 1 '15 at 1:04
  • @schroeder why? – Antonio Nov 1 '15 at 15:44

Because HTTP is a stateless protocol each request from the client contains information which let the server resume the established logged in session. This information is usually in the form of a session cookie and if you get access to the unencrypted request you can extract the session cookie and use it to take over the established session.

For more details see the Wikipedia article about session hijacking.

Not the answer you're looking for? Browse other questions tagged or ask your own question.