Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
5
-
1I'm confused as to what you mean by "Can it be done without using browsers cache?". You could test the server for port 80 to see if it has HTTP, but I expect you aren't looking to know if the port is open.– amccormackMay 21, 2015 at 4:51
-
2Try both URLs? Can you explain why you want to know? Maybe that will help.– schroeder ♦May 21, 2015 at 4:55
-
@amccormack if my earlier requests are cached I can find out whether the website uses http or https(except when the cached page redirects to an http page from https or vice versa)– faraz khanMay 21, 2015 at 5:03
-
@schroeder yes that is a possible solution.But I am wondering in case of ssl strip attack the user always gets back http response even if the website is https.– faraz khanMay 21, 2015 at 5:05
-
1@farazkhan BTW, Welcome to Information Security. If you have a particular use case in mind with respect to SSL Strip then you should edit your question and include that. It will help other members of the community understand what you are trying to determine. If you have a forensics question (did this happen), vs a reconnaissance question (does this website support HTTPS) you'll want to make that clear too.– amccormackMay 21, 2015 at 5:10
Add a comment
|
1 Answer
I'm going to assume that you are talking about HSTS.
HSTS is TOFU (Trust on first use). So from the second use onwards, you are protected.
But what about that first use?
I don't think there's a unified strategy. But here's some ideas:
What works today
- HSTS Preloading: Use a browser that makes use of the HSTS preload lists. (Chrome, Firefox) And hope that the developers of the website you want to visit have had their website listed for HSTS preloading..
- HTTPS Everywhere: There the EFF's HTTPS Everywhere project that uses a browser side plugin (Chrome, Firefox) and a large list of redirect rules, to redirect plain HTTP requests to encrypted HTTPS sites. This plugin only works if a rule has in fact been created for the website you want to visit. But -- other than HSTS pre-loading -- this does not depend on the webmaster's cooperation. Rules can be submitted by anyone.
What might work in the future
DANE/DNSSEC: DNS is a general purpose vehicle for storing info about domain names. Wikipedia's article about HSTS hints that this might be used in the future to indicate HTTPS support. -- "DANE" is a mechanism that uses DNSSEC (the signed form of DNS) to communicate crypto info about a domain name. For example to say "only this CA may sign my HTTPS certificates". This is achieved by placing something like this record in your DNS server:
_443._tcp.www.example.com. IN TLSA (
0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
7983a1d16e8a410e4561cb106618e971 )
Now this tells anyone (who cares to ask) that a specific crypto key is associated in some way with a service that's running on port 443 on www.example.com.
Now a human can easily guess: "Okay, 443 will probably be HTTPS", and then connect with HTTPS instead of plain HTTP. But what you can't deduce from an existing DANE record is that HTTPS is fully supported for every bit of the web site. (For example HTTPS might only be used for login to that site and not work for the rest of the site.)
But AFAIK there is no mechanism yet to communicate "Use HTTPS!" to a browser.
answered May 21, 2015 at 6:29
