3

I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.

Anyone know how Chrome defends against that tool?

1 Answer 1

6

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.

1
  • Just checked and yes, Firefox 17.0.1 has this fixed. The funny part is that also tried in my own system (Debian Testing) and the latest version of Iceweasel is vulnerable.
    – user15194
    Dec 24, 2012 at 19:55

You must log in to answer this question.