2

Let's say you are performing a SSL strip. From what I can understand, it modifies either the client or server packets (in the http/https protocol), which indicate that it supports encryption to not supporting encryption.

I was wondering if it is possible during these exchanges to tell the server that the client is not supporting encryption, but then tell the client that it is, with goal of forging the packets so that the encryption protocol takes place between the proxy and the client.

  • And secondly are certificate a factor in this procedure? would need a valid one? – C.Christophe Sep 12 '18 at 15:01
  • That is done by corporate proxies: they decrypt the client request, inspect, reencrypt, send to server. And the reverse: decrypt server response, inspect, reencrypt, send to client. – ThoriumBR Sep 12 '18 at 15:28
  • Just to add to this post. Let's not forget what happens when the ntp protocol is abused :) github.com/PentesterES/Delorean youtube.com/watch?v=hkw9tFnJk8k – Teddy Katayama Sep 12 '18 at 15:55
3

Unless the attacker is able to install a new certificate authority (CA) at the users system he can not make the client visit the original site by https through the attacker proxy without the client getting certificate warnings. And, installing a CA just from inside the browser without any explicit user interaction is not possible.

The attacker could though change the target URL's within an SSL stripping attack not only from https:// to http:// like the normal sslstrip program does but could keep https:// and instead change the site which gets visited. For example if the attacker owns example.org he could change the access from https://example.com to https://example.org and mirror the original site at his attackers site. Many users would probably not notice such change and happily fill in credentials and similar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.