Linked Questions

1
vote
0answers
603 views

Why do we redirect port 80 traffic for SSLstrip and not 443? [duplicate]

I watched a video on youtube about using SSLstrip after conducing a MITM using arpspoof. The video, unfortunately, didn't provide any information about how it works. During the video, the guy typed ...
-1
votes
1answer
275 views

Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip? [duplicate]

Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip?
1
vote
0answers
35 views

Can man in the middle on spoofed wifi decrypt ssl data? [duplicate]

I've been searching on google and I found other topics like this one (Does https prevent man in the middle attacks by proxy server?) that say man in the middle on public wifi will not be able to ...
0
votes
0answers
31 views

Why doesn't Google login enforce ssl redirect at the server end? [duplicate]

I was playing about with ssl strip against an ie8 target, just for learning more about it. To my surprise I was able to capture the credentials of the ie8 victim when signing into Google accounts. I ...
0
votes
0answers
12 views

SSL stripping - initiate HTTPS or HTTP first? [duplicate]

I am quite confused. I have been reading about SSL stripping and what I have found is that The client (victim) has to initiate the first connection via HTTP The server will redirect to HTTPS - here ...
8
votes
3answers
8k views

Does sslstrip work only on websites which use both HTTP and HTTPS?

Does sslstrip attack only work on websites which uses both HTTP and HTTPS? On Quora a commenter says that: One thing to note is that, SSL Strip only works on websites which uses both HTTP & ...
7
votes
4answers
7k views

Can someone steal cookie contents via a phishing attack?

If someone successfully set up a phishing website on a fake wireless network for say, bankofamerica.com, and lets pretend that SSL was not used, would they be able to run a script on the server that ...
1
vote
3answers
6k views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
1
vote
1answer
1k views

Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

My scenario: I connected to an open WiFi at Kuala Lumpur Airport to read a news site from home (I know I was being absolutely careless). I forgot to turn off sync on my Android phone, so all my apps "...
2
votes
5answers
331 views

Can you avoid ever sending a password over the wire?

Let's say I want to secure authentication on a web app or a mobile app or even a machine to machine app. My first approach to secure the password is to enable HTTPS and some sort of client-side ...
3
votes
3answers
480 views

How to prevent browser from rendering malicious content if request or response is hacked?

We are currently working on OWASP security fixes and we identified one attack scenario for which we are trying to figure out a possible solution: User hits a valid HTTPRequest to our application. The ...
0
votes
2answers
760 views

If I browse a website over HTTPS using a VPN, can the data be sniffed somehow?

I bought yesterday a flight from an American website. In my country, tickets are too expensive. Therefore, I used a IPVanish VPN to browse the airline website. It appears as if I visited it from New ...
1
vote
1answer
3k views

It's there a way to bypass https nowadays?

It's there a way to bypass https (using mitm attacks) on browsers like chrome, firefox, etc? I know it could be done in some way, exploiting the NTP port, but we need the interaction of the victim. ...
3
votes
1answer
380 views

Does HSTS make using a public WiFi safe?

What attacks, if any, are possible if I connect to a public WiFi network and only use my computer to access a previously-visited site that uses HSTS. I believe that attacks such as SSLstrip are not ...
8
votes
2answers
791 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...

15 30 50 per page