I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.

Anyone know how Chrome defends against that tool?


Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.

| improve this answer | |
  • Just checked and yes, Firefox 17.0.1 has this fixed. The funny part is that also tried in my own system (Debian Testing) and the latest version of Iceweasel is vulnerable. – Ay0 Dec 24 '12 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.