1

I am using SSLStrip against my own computer, but am not being redirected to HTTP. Skype automatically starts up and logs in at my computer's startup, so I was wondering whether the fact that port 80 is already in use (by Skype) defeats SSLStrip. It is my understanding that except for the fact that they are being redirected to a non-encrypted connection, it is impossible for a victim (or their AV) to tell SSLStrip is being used against them. If that is correct I would like to know if anyone has a way to cause Skype to restart on the victim computer so I can get port 80.

  • Just thought of a possible way while writing the question, sending a DeAuth token to the browser and disconnecting them for a second. I will test and see if it works. – KnightOfNi Dec 16 '13 at 15:55
  • Microsoft is ignoring the RFC's to address SSLStrip, IE contains more known vulnerabilities than any other piece of activity maintained code. The reflective XSS filter is completely and totally non-functional. – rook Dec 16 '13 at 16:08
1

SSLStrip does not downgrade from HTTPS. It tries to prevent upgrade to HTTPS.

I think this is a misunderstanding of how SSLStrip works.

The idea is that SSLStrip stops plain text HTTP sites from upgrading to HTTPS. It will not work if you start by entering "https://" in your browser right away.

What it does is that it installs itself as a man-in-the-middles and then transparently forwards traffic largely without changing it. HOWEVER: If the HTTP page contains any HTTPS links then SSLStrip will "strip" these HTTPS links out and replace them with plain old HTTP.

So if your web server does not even speak plain text HTTP, on default port 80 or elsewhere, then you can't upgrade to HTTPS either. And in that case SSLStrip is not the right tool for whatever you're trying to do.

0

SSLstrip works by listening for https traffic and redirecting it to http.

For one thing Skype does not use http it uses its own proprietary protocol. For another they do not offer a non-encrypted version of their protocol the way https does with http so the concept of an SSLstrip type attack will not work.

For those reasons SSLstrip will not work against Skype.

  • This is true, but my question is asking if Skype will prevent SSLstrip from working at all by preventing it from binding to port 80. – KnightOfNi Mar 21 '14 at 19:13
  • Skype does not bind port 80, why should it?. And usually sslstrip is not running on the same computer as Skype does. Maybe your are missing some understanding of how client-server communication with TCP works, what the bind is for and who will do it. – Steffen Ullrich Mar 22 '14 at 6:34
  • @KnightOfNi I apologize if my answer was not clear. One way of using SSLstrip is to listen on an unrelated port like 1234. When traffic destined for a https port (443) passes through the attacker's computer, it is redirected to SSLstrip's port (1234), through firewall rules for example. Even if SSLstrip is running on the same machine as Skype, it is not a problem what port Skype wants to use. – user2675345 Mar 24 '14 at 9:12
  • When I was working with SSL-inspection, Lync (Lync later became part of Skype for business) proved impossible to decrypt due to SSL certificate pinning. I do not know if Skype does the same. – Dog eat cat world Aug 27 '18 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.