1

I've heard about the new SSLStrip and how it is able to bypass HSTS.

  1. Where can I find an article that talks about this?
  2. How does this work?
  3. Where can I download it? Moxie's website has not been updated with new versions since 2011.
8

There is no new version of sslstrip since 2011 and the feature is already there.

How It works:

First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the first time and you intercept the traffic in between don't allow the header to reach to the client.

The important header field of HSTS that allows client to communicate over HTTPS to the server domains and subdomains is

Strict-Transport-Security:max-age = "value"

So if you are intercepting the header and not allowing HSTS to reach to the client then SSLStrip will do a job.

Cons of described method

The above described method will not work if the client is configured to use HSTS(Preloaded and static methods) for some domains and there sub-domains. Since there are many browsers like Chrome which uses Preloaded HSTS(not static) configuration for the some sites. Refer this link to see the HSTS lists with max-age defined

Preloaded HSTS lists

But It can also be evaded, refer this link

Bypassing HSTS Preloaded policy

  • Do you mean it doesn't allow the header to reach the client by ensuring the connection is never redirected from HTTP to HTTPS? – SilverlightFox Oct 18 '14 at 10:57
  • 2
    I can't see anything in the original sslstrip code that changes the HSTS headers. I thought this was what sslstrip2 was meant to do github.com/LeonardoNve/sslstrip2 – Cybergibbons Feb 25 '15 at 10:01
  • 1
    @Cybergibbons I don't think it is necessary to delete the HSTS header (and I think the answer is incorrect in this regard). The RFC says that the UA only processes the header if it was received over a secure transport: "If an HTTP response, received over a secure transport, includes an STS header field[...]". Since sslstrip talks to the client via HTTP, it can forward the HSTS header and it won't be processed by the client. – efie Apr 5 '15 at 9:40
  • 1
    Furthermore it states: "If an HTTP response is received over insecure transport, the UA MUST ignore any present STS header field(s).". – efie Apr 5 '15 at 10:18
2

From Wikipedia:

The HSTS Policy is communicated by the server to the user agent via a HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent shall access the server in a secure-only fashion.

In short, just trim out this response header field to the browser and it will never know that it has to enforce this. Nothing to do with redirection.

  • Interesting, simple, and elegant... – Goodies Feb 25 '15 at 5:41
  • The header should not even need to be trimmed - browsers should only obey HSTS headers if the page is served over HTTPS. As SSLStrip forces plain HTTP browsing, the header itself should be ignored. – SilverlightFox Sep 30 '15 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.