12

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the internet but when the same attack happens against Gmail or MSN traffic I get no stuff back. It is completely static in that case. I'm using a go-daddy certificate to secure my ssl exchange.

Does it mean their ssl is secure and mine is not? Like the rogue ssl cert generated by sslstrip is caught and blocked by their ssl cert security and mine is configured in a insecure mode? Do devices like KEMP load balancer do anything to prevent such attacks?

What do I need to do to prevent my site from such attacks? Thanks.

Improve this question

2 Answers 2

Reset to default
9

IIRC, SSLStrip does not do a traditional SSL-MITM attack. What it does is watch HTTP traffic, look for links and redirects to HTTPS traffic, and rewrite those links/redirects to HTTP. A quick look at their website confirms this.

So, you must have some non-ssl page which links/redirects to an ssl page. SSLStrip sees that and changes the link/redirect to a non-secured link/redirect. For example, you might have index.php linking to https://domain.com/login.php. SSLstrip changes it to http://domain.com/login.php. You could verify this by typing into your browser https://domain.com/login.php and see if SSLStrip still sees the username and password (or when you click on the login link, see if it has http or https in the url bar in the browser).

You thwart this attack by

  1. Make your site only SSL.
  2. For whatever webserver you use (Apache, IIS, etc), there should be a way to force certain directories to only be accessable over SSL connections. Make all authenticated content SSL-only. A simple google search should reveal how to do this for a given piece of server software.
Improve this answer
4
  • 4
    Suggestion 2. problematic, since the attacker can use https to access the server, but still present it as http to the user.
    – CodesInChaos
    Jan 25, 2012 at 15:01
  • @CodeInChaos, agreed, but the attack you are talking about is completely different from what SSLStrip does, and the question is about thwarting SSLStrip.
    – mikeazo
    Jan 25, 2012 at 17:17
  • @mikeazo but sslstrip could easily be modified to use the HTTPS page
    – curiousguy
    Jun 26, 2012 at 4:44
  • I'm conscious my comment comes 9 years after this answer, but the first link is broken.
    – jub0bs
    Mar 1, 2021 at 11:30
2

IIRC you should get a warning when going over HTTPS that the certificate has a mismatch, unless you have the real certificate.

SSLstrip rewrotes HTTPS to clear HTTP apparently.

Also why would SSL strip use a "rogue" public key ? It uses the public key of the website.

There is a way to secure yourself, but your browser needs to support it. (read down)

The reason why it doesn't work is because you are probably doing it with Chrome or Firefox or any other major browser. They use HTTP Strict Transport Security.

It has two properties :

  1. Automatically turn any insecure links to the website into secure links. (For instance, http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server.)
  2. If the security of the connection cannot be ensured (e.g. the server's TLS certificate is self-signed), show an error message and do not allow the user to access the site.
Improve this answer
13
  • Thanks for your help. I made an error in the public key comment you are right since the attacker posses itself as rogue CA and generates a public key on its behalf so anything encrypted using 'his' public key would automatically gets decrypted on his end in the man in middle attack.
    – Saladin
    Jan 25, 2012 at 5:19
  • But this doesn't answer my question i want to know why the same attack doesn't work in gmail or yahoo scenario? Why they are protected and not me.
    – Saladin
    Jan 25, 2012 at 5:20
  • updated my answer
    – Lucas Kauffman
    Jan 25, 2012 at 6:44
  • 2
    SSLStrip doesn't do an SSL MitM attack. It does a MitM attack on normal HTTP connections and watches for links/redirects to HTTPS pages and rewrites them as HTTP links/redirects.
    – mikeazo
    Jan 25, 2012 at 12:34
  • 2
    @user970533, SSLStrip does not do anything with certificates AFAIK.
    – mikeazo
    Jan 25, 2012 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .