Linked Questions

2
votes
5answers
283 views

Can you avoid ever sending a password over the wire?

Let's say I want to secure authentication on a web app or a mobile app or even a machine to machine app. My first approach to secure the password is to enable HTTPS and some sort of client-side ...
0
votes
1answer
218 views

Does SSLSTRIP in MITMF only works when the victim visits for the first time?

I just started learning MITM attacks and I use MITMF to perfom these attacks. I have one question regarding to sslstrip. I notice that sslstrip only works when we first clear the cache and history in ...
0
votes
2answers
225 views

What are some examples of known scenarios of network attacks?

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
1
vote
0answers
31 views

Can man in the middle on spoofed wifi decrypt ssl data? [duplicate]

I've been searching on google and I found other topics like this one (Does https prevent man in the middle attacks by proxy server?) that say man in the middle on public wifi will not be able to ...
1
vote
3answers
4k views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
0
votes
1answer
101 views

WHY redirecting HTTP version of a site to HTTPS version is dangerous? [duplicate]

I can't understand why its dangerous, someone told me that an attacker can hijack before it loads the HTTPS version, but hows that possible.
7
votes
3answers
7k views

Does sslstrip work only on websites which use both HTTP and HTTPS?

Does sslstrip attack only work on websites which uses both HTTP and HTTPS? On Quora a commenter says that: One thing to note is that, SSL Strip only works on websites which uses both HTTP & ...
1
vote
1answer
3k views

It's there a way to bypass https nowadays?

It's there a way to bypass https (using mitm attacks) on browsers like chrome, firefox, etc? I know it could be done in some way, exploiting the NTP port, but we need the interaction of the victim. ...
2
votes
2answers
377 views

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests. What if our web server does not support HSTS? IIS has a setting ...
7
votes
2answers
632 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
1
vote
1answer
1k views

Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

My scenario: I connected to an open WiFi at Kuala Lumpur Airport to read a news site from home (I know I was being absolutely careless). I forgot to turn off sync on my Android phone, so all my apps "...
0
votes
0answers
30 views

Why doesn't Google login enforce ssl redirect at the server end? [duplicate]

I was playing about with ssl strip against an ie8 target, just for learning more about it. To my surprise I was able to capture the credentials of the ie8 victim when signing into Google accounts. I ...
0
votes
0answers
476 views

Why do we redirecting port 80 traffic for SSLstrip and not 443? [duplicate]

I watched a video on youtube about using SSLstrip after conducing a MITM using arpspoof. The video, unfortunately, didn't provide any information about how it works. During the video, the guy typed ...
3
votes
1answer
1k views

Are Facebook chat messages encrypted?

I was wondering if chat messages on Facebook are sent plain text, or whether they are encrypted in some way. The address bar in browser looks like this https://www.facebook.com (notice the https)...
3
votes
1answer
362 views

Does HSTS make using a public WiFi safe?

What attacks, if any, are possible if I connect to a public WiFi network and only use my computer to access a previously-visited site that uses HSTS. I believe that attacks such as SSLstrip are not ...

15 30 50 per page