So, lately I've been really into penetration testing and learning the nitty-gritty of tech. I'm dong courses on computer architecture, cryptography, surveillance law, and computer networks. I never realized how much I love this stuff.
So, I have an unused computer at home that I set up to play with. Right now I'm trying to sniff passwords over the network with SSLsplit and arp-spoofing. Of course, with HSTS, this becomes a little harder.
Apparently, if you can manipulate the NTP server on a target, you could then pass the max-age set by HSTS, thereby making the client connect without SSL again before HSTS sets a new one.
My question is, how do I does this? I've seen tools like delorean, but for whatever reason no matter what I type in, delorean always just displays it's help screen...
Tl;Dr How can you perform an attack on the NTP server of a computer during a man in the middle attack to move the time forward on the machine.