0

I was pentesting a website that didn't have any security against MITM attacks and discovered that when I was trying to steal the log in credentials attacking myself that the CAPTCHA couldn't connect to the internet (the website was sslstripped to http) therefore I couldn't send the credentials to the website and steal them with my other PC.

Is this a standard response, can it be bypassed? Is it secure to implement it as a defense to MITM attacks?

Searching Google, I found that it isn't, but for some reason, it was good protection when I was attacking myself in that website, so I don't really know what to think.

  • 2
    Do you know how the CAPTCHA data flow works on the server side? – schroeder Jun 4 at 20:00
  • 1
    As a general rule, no website has "any security against MITM attacks" unless you mean HSTS (or technically HPKP, but that's extremely rare); is that what you're referring to or is it something else? – CBHacking Jun 5 at 2:14
  • @CBHacking yes! it wasn't very clear, but i mean HSTS header – Tomi Begher Jun 5 at 2:17
3

It sounds like the site you were testing doesn't use HTTP Strict Transport Security (HSTS), or at least doesn't pre-load it. However, it's entirely plausible that the CAPTCHA service is hosted on a site that does use HSTS (for example, Google does for most of its sensitive sites); if your SSL-stripping proxy blocked all HTTPS traffic, then that would simply break the CAPTCHA service. Simply allowing requests that go over HTTPS despite stripping to succeed would fix that. It's certainly not going to prevent MitM attacks from succeeding;

Alternatively, it's possible that your SSL stripping itself broke the CAPTCHA. SSLStrip by necessity modifies the HTTP responses; it's possible that it makes some modification which just breaks something (either accidentally, or because there's some explicit check for SSL stripping in the CAPTCHA's JS). It's not hard to detect SSL stripping. On the other hand, it's not hard to modify the stripping functionality to fool any particular instance of detection code, either.


Bottom line, CAPTCHAs do not protect against SSL stripping attacks, or any other kind of MitM. There's nothing, transport security wise, different about a CAPTCHA than about any other cross-origin (or, sometimes, same-origin) script-initiated request. They (like anything else) might accidentally or deliberately break in the presence of such attacks, but a competent attacker would be able to un-break them, and verify that they are unbroken, before targeting a victim.

  • nice and clear answer, thanks! – Tomi Begher Jun 5 at 2:29
  • @TomiBegher Please avoid "Thanks!" comments. They add unnecessary clutter to the side. Instead, use the voting system. – MechMK1 Jun 5 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.