Linked Questions

0
votes
0answers
420 views

Why do we redirecting port 80 traffic for SSLstrip and not 443? [duplicate]

I watched a video on youtube about using SSLstrip after conducing a MITM using arpspoof. The video, unfortunately, didn't provide any information about how it works. During the video, the guy typed ...
-1
votes
1answer
267 views

Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip? [duplicate]

Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip?
0
votes
0answers
30 views

Why doesn't Google login enforce ssl redirect at the server end? [duplicate]

I was playing about with ssl strip against an ie8 target, just for learning more about it. To my surprise I was able to capture the credentials of the ie8 victim when signing into Google accounts. I ...
1
vote
0answers
27 views

Can man in the middle on spoofed wifi decrypt ssl data? [duplicate]

I've been searching on google and I found other topics like this one (Does https prevent man in the middle attacks by proxy server?) that say man in the middle on public wifi will not be able to ...
7
votes
3answers
7k views

Does sslstrip work only on websites which use both HTTP and HTTPS?

Does sslstrip attack only work on websites which uses both HTTP and HTTPS? On Quora a commenter says that: One thing to note is that, SSL Strip only works on websites which uses both HTTP & ...
7
votes
4answers
6k views

Can someone steal cookie contents via a phishing attack?

If someone successfully set up a phishing website on a fake wireless network for say, bankofamerica.com, and lets pretend that SSL was not used, would they be able to run a script on the server that ...
1
vote
3answers
3k views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
3
votes
3answers
399 views

How to prevent browser from rendering malicious content if request or response is hacked?

We are currently working on OWASP security fixes and we identified one attack scenario for which we are trying to figure out a possible solution: User hits a valid HTTPRequest to our application. The ...
0
votes
2answers
726 views

If I browse a website over HTTPS using a VPN, can the data be sniffed somehow?

I bought yesterday a flight from an American website. In my country, tickets are too expensive. Therefore, I used a IPVanish VPN to browse the airline website. It appears as if I visited it from New ...
1
vote
1answer
2k views

It's there a way to bypass https nowadays?

It's there a way to bypass https (using mitm attacks) on browsers like chrome, firefox, etc? I know it could be done in some way, exploiting the NTP port, but we need the interaction of the victim. ...
3
votes
1answer
353 views

Does HSTS make using a public WiFi safe?

What attacks, if any, are possible if I connect to a public WiFi network and only use my computer to access a previously-visited site that uses HSTS. I believe that attacks such as SSLstrip are not ...
1
vote
1answer
1k views

Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

My scenario: I connected to an open WiFi at Kuala Lumpur Airport to read a news site from home (I know I was being absolutely careless). I forgot to turn off sync on my Android phone, so all my apps "...
2
votes
2answers
366 views

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests. What if our web server does not support HSTS? IIS has a setting ...
7
votes
2answers
589 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
3
votes
1answer
977 views

Are Facebook chat messages encrypted?

I was wondering if chat messages on Facebook are sent plain text, or whether they are encrypted in some way. The address bar in browser looks like this https://www.facebook.com (notice the https)...

15 30 50 per page