I have been using sslstrip for a while and it works fine on websites on which HSTS is not enabled. However when the SSL server is running on some custom ports sslstrip fails.
eg: For links like https://example.com:400 the striping doesnt seem to work even though the site doesnot implement HSTS. How to get around this problem?

  • OP has a poor understanding of SSLstrip. – mootmoot Jul 27 '17 at 11:10
  • Please enlighten OP. – Sunny Jul 29 '17 at 5:47

I suppose the sslstrip breaks the bridge between the http and https. One of the cases where the tool works is the case of redirection. The tool checks the 'Location' header and strips off the HTTPS from it. It then embeds the HTTP URL for the client so that the browser should not go for SSL handshake. In short, the SSLStrip intercepts the traffic before it gets negotiated to secure tunnel. The url you mentioned is the https URL is a direct https url where the http->https transition will not happen. Hence the tool [sslstrip] will not give you the expected output even though HSTS is not enabled. I hope this is useful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.