I am trying to use SSLstrip tool with Ettercap on Kali Linux to attack my personal bank account and yahoo account for testing purposes.

I followed the instructions of this video (I run it on Kali Linux not on Backtrack5) and I was able to sniff many websites credentials of mine.

However, I have encountered the following problems:

  1. Websites that have strict transport security (HSTS) enabled (like YAHOO Mail) has resisted the attack. Any work around? (How to perform SSLstrip attack on HSTS enabled web portals?)

  2. My bank web portal does not have HSTS enabled as indicated by SSLlabs. So I was able to login to my bank account over an SSLstrip connection. The google chrome address bar was showing a red cross mark (x) to indicate the false SSL certificate used over SSLstrip connection. This indicate that the attack was successful, however, Ettercap tool did not show the entered username and password on my bank login web portal !!! Any idea about how they were able to protect the credentials from being displayed over an SSLstrip connection?

You can check it by just trying to provide your personal web banking credentials via an SSLstrip connection established through a virtual machine on your personal computer. You will realize that everything goes smoothly as if the attack was successful but the Ettercap tool won't display the credentials information of your bank account as what it does for other websites. I tested various bank portals including bankofamerica and I have discovered that all of them does not support HSTS but Ettercap tool won't display the entered credentials for any of them for unknown reason.

closed as unclear what you're asking by Steffen Ullrich, WhiteWinterWolf, Bob Brown, Xander, Rory Alsop Dec 28 '15 at 18:59

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You are asking about the protections used by one specific web site without revealing the web site. Thus the best you will get are educated guesses. – Steffen Ullrich Dec 28 '15 at 9:32
  • True, but there must be a known technique. I do not think that bank systems are developed just locally in the bank. It must be an international system approved by industry standards. Something like HSTS followed by Yahoo, facebook etc. The issue is that I tested so many banks portals, including bankofamerica, all of them does not support HSTS and are immune to sslstrip! So what technique they are using if it is not HSTS? it must be another standard. How ettercap is unable to capture credentials though it looks like the attack is successful as browser shows the certificate is not trusted. – user3480226 Dec 28 '15 at 11:09
  • Moreover, why banks are not using HSTS? it is really protecting from sslstrip when I try it with yahoo and facebook. They should have been using a better standard then. What is it? – user3480226 Dec 28 '15 at 11:12
  • I have this information that most of the banks in India use a solution named Core Banking by Infosys. Googling it up or checking their website for technologies used might give you some info. – Arun Anson Dec 28 '15 at 11:29
  • If you successfully used SSLStrip on your bank, they you should be able to view the unencrypted contents of your http session. What did you see go across the wire? I've seen at least one website where the login credentials are sent using public key crypto implemented in Javascript. This would only protect against passive listening, and not an active MiTM attack crafted against this specific site. – Steve Sether Dec 28 '15 at 15:34

Browse other questions tagged or ask your own question.