I am very new to MITM attacks and have been faffing around on my home network today..

When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating the connection is unsafe, then asks if you want to just continue or close the connection. If continue is pressed it will send the email and password in plain text.

Anyway, I was wondering if there was any way to prevent any connections via https and force all through http. I'm not concerned if it prompts the user or not.

  • Google SSLStrip and/or Fiddler. Both can do what you're looking for, although they're not super big on ease of use. – KnightOfNi Oct 11 '14 at 16:15

If you aren't concerned about the user being prompted, then you intercept most HTTPS connections by proxying them. Instead of allowing the user to directly connect to the site they've requested, you connect them to a intermediary you control, and then use it to connect out to the to site that they've requested. This way the client's HTTPS session is terminating on your box, with your SSL cert that you own the private key for, and thus you decrypt the client-side traffic, and since it's your proxy that is then making the connection out to the server they actually wanted to talk to, your proxy is now the client for that SSL connection, and you have full access to the traffic from that side as well.

This will prompt the user because of course your SSL cert, the one on their server the users are connecting to, will not be a valid cert for the sites they're actually trying to access, so client apps will (or should at least) view this as an attack and warn the users not to trust the connection. As P4cK3tHunt3R mentioned, you can avoid the warning by installing your cert as a trusted root on the client devices, in which case they will no longer be able to discern (generally speaking) that the cert is not in fact valid and trusted for the site they're trying to connect to.

Aside from proxying, there are other ways to downgrade connections as an active MitM, such as SSLStrip, which will work in some cases, and not in others.

In some cases, proxying works even better than advertised, with mobile apps particularly, which are notorious for ignoring certificate warnings and happily accepting untrusted certs without bothering to inform the user than anything is amiss. In other cases, it won't work at all, due to practices like certificate pinning where a browser or other application only trusts specific certificates, and will refuse to accept your certificate, even if it would otherwise be valid and trusted.


You can not force any website to use http instead of https. You can do only one thing create your own certificate and attach in all browsers then whenever you will in between client and server it will not prompt to the user. Other than that you can also try downgrade the ssl version to use the known vulnerability against ssl.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.