3

If a website is running on on https no http:80 is listening, if a browser issued a request to http://website.com, could this info be seen via MITM attack?

  • Are you assuming that the MITM can only read data, not write? Or both read and write? – Anders Oct 20 '17 at 10:54
5

If the website is not listening on port 80 and the address http://website.com (or whatever URL, assuming website.com here means the domain that is listening on port 443 and not listening on port 80) is entered in the browser then you will only see a couple TCP SYN packets, not the HTTP request. This is because the TCP connection is attempted but not completed and so no HTTP protocol request gets sent.

On the other hand if the website redirects HTTP to HTTPS (and so is listening on port 80 and 443) then the initial HTTP request will be seen and will receive a 302 (redirect) response.

  • 1
    I would add that if there is an active MITM she can make the connection and then read and modify all subsequent traffic. – Anders Oct 20 '17 at 10:54
1

Depending on where the MITM sits (I assume client-local), yes:

In addition to the failing TCP connection, there will likely be a DNS request shortly before the TCP connection. If this is a „new“ visitor with no cookies or other data sent to the server that is special, this will give away as much information as will the an actual request (given that the browser information in the request can be gathered from other connections)

Yet, the same information would be leaked from a successful TLS connection and for any previous visitors if you have HSTS set and set cookies as secure, the browser would (should) not leak more data (except maybe for the path) to an existing port 80 instance that redirects.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.