2

I've seen that if I delete cookies and other data on Google Chrome, SSLStrip+ works successfully on those web sites that are not included in the browser list. Is it because HSTS data is cleared too?

  • Probably yes - why don't you have a look at the HSTS list chrome has? – Tobi Nary Apr 8 '16 at 19:40
  • 2
    SSLStrip+ works without deleting browser data too. The script needs a fake DNS server to work, in fact modifying DNS queries you have an huge possibility to bypass HSTS. So you don't need to clear your data. Also HSTS depends on the HTTP request header, so for example when you navigate to Google you make a GET request and the response header says to the browser that it can access the website only with a valid HTTPS session – Cricco95 Apr 8 '16 at 19:43
  • In the HSTS list I only see preloaded sites. – HenryC Apr 8 '16 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.