1

I have been using sslstrip for a while and it works fine on websites on which HSTS is not enabled. However when the SSL server is running on some custom ports sslstrip fails.
eg: For links like https://example.com:400 the striping doesnt seem to work even though the site doesnot implement HSTS. How to get around this problem?

2
  • OP has a poor understanding of SSLstrip.
    – mootmoot
    Jul 27, 2017 at 11:10
  • Please enlighten OP.
    – Sunny
    Jul 29, 2017 at 5:47

1 Answer 1

1

I suppose the sslstrip breaks the bridge between the http and https. One of the cases where the tool works is the case of redirection. The tool checks the 'Location' header and strips off the HTTPS from it. It then embeds the HTTP URL for the client so that the browser should not go for SSL handshake. In short, the SSLStrip intercepts the traffic before it gets negotiated to secure tunnel. The url you mentioned is the https URL is a direct https url where the http->https transition will not happen. Hence the tool [sslstrip] will not give you the expected output even though HSTS is not enabled. I hope this is useful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .