0

i am aware of HSTS and their directives... If you had enabled HSTS on your site however, and this user has visited your site before, the browser will remember it should go back to https. As the fake site does not have an SSL certificate, the user can’t visit the site, and will be safe.

However i am unable to reproduce a mitm attack when i had visited the site before, only when deleting all cookies and trying again it works just fine. For some reason the website is acting like it had HSTS but it doesn't... so what is wrong here?? if the website doesn't have HSTS then the browser shouldn't remember to connect to HTTPS

What i am doing:

1- if i delete cookies and try to connect to example.com the mitm works just perfect.

2- if i visit the site and and close browser, and then try to reproduce the mitm attack it doesn't work. it connects to HTTPS directly. (it should work because the website doesn't have HSTS)

3- if i visit example.com and close the browser, and then try to reproduce the mitm attack typing example.com/about the mitm attack works perfectly.

4- if i visit example.com/about and close the browser, and then try yo reproduce the mitm attack typing example.com/about the mitm doesn't work.

For some reason the website doesn't have HSTS but looks and works like it's implemented

11
  • Does it do a 301 redirect from HTTP -> HTTPS? 301 is permanent, so browsers can cache them however long they want. Commented May 21, 2019 at 3:01
  • Did it ever have HSTS enabled? The browser will remember it for a long time, and deleting cookies doesn't affect this at all. Commented May 21, 2019 at 3:10
  • 1-if i delete cookies and try to connect to example.com the mitm works just perfect. 2- if i visit the site and and close browser, and then try to reproduce the mitm attack it doesn't work. it connects to HTTPS directly Commented May 21, 2019 at 3:13
  • 1
    Very likely a permanent redirect (301) cached by the browser. See also the very similar question Does SSLSTRIP in MITMF only works when the victim visits for the first time?. Commented May 21, 2019 at 4:10
  • 1
    @TomiBegher: 301 are kind of cached forever, i.e. they might be removed automatically only when the browser cache gets too big and old and long unused entries get deleted. Commented May 21, 2019 at 11:00

0

You must log in to answer this question.

Browse other questions tagged .