Skip to main content
38 votes

What can be intercepted more easily, WiFi or Ethernet on a fully compromised router?

The medium doesn't matter. To the router's operating system, IP packets are IP packets are IP packets.
vidarlo's user avatar
  • 16.6k
37 votes
Accepted

Is there any point in having the HSTS header enabled when using HTTP/2?

Yes, HSTS is still needed, including HSTS preload. The way a browser connects to HTTP/2 is through a URL that looks exactly the same as the URL for HTTP/1, so it doesn't know that it must be HTTP/2 ...
Z.T.'s user avatar
  • 8,524
28 votes

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

Secure cookies can be set over insecure channels (e.g. HTTP) as per section 4.1.2.5 of RFC 6265. It explicitly mentions that the Secure flag only provides confidentiality and not integrity, as a ...
Polynomial's user avatar
  • 135k
23 votes

Does sslstrip work only on websites which use both HTTP and HTTPS?

SSL Strip only works on websites which uses both HTTP & HTTPS. That's not accurate because it implies turning off HTTP support secures against the attack. The point is that sslstrip steps in ...
Arminius's user avatar
  • 44.9k
8 votes
Accepted

Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

SSL-strip is not an issue when you are using an app, it is only an issue when you are browsing the web through a browser. It works by replacing HTTPS links with HTTP links in an HTTP page. Since the ...
Anders's user avatar
  • 65.6k
7 votes

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

TL;DR At least in Chromium-based browsers and in Firefox, it's no longer possible for a non-secure origin to set cookies with a Secure flag, or to overwrite cookies whose Secure flag is true. More ...
jub0bs's user avatar
  • 413
5 votes

Is an HTTP 301 redirect to HTTPS, insecure?

From this question it may look like the 301 redirect per se is posing a threat, but it is not. It doesn't pose a security threat. It only bears the same risks of serving a normal HTTP page.
fiatjaf's user avatar
  • 149
5 votes
Accepted

Why does SSLStrip fail when user types HTTPS?

SSLstrip works by replacing HTTPS links in web pages returned by the server with HTTP links. This happens during a standard HTTP request, response exchange. While the initial HTTPS call isn't ...
Neil Smithline's user avatar
5 votes

Can the network administrator of my university see what I have searched on Google?

Yes, given 1-3 you can be sure the connection is encrypted end-to-end between the browser and the server, and that a 3rd party cannot intercept the unencrypted message (without obtaining encryption ...
techraf's user avatar
  • 9,139
5 votes

Does sslstrip work only on websites which use both HTTP and HTTPS?

Sslstrip requires that the connection between the client and the sslstrip instance is done over plain HTTP. The connection from sslstrip to the server can be either HTTP and HTTPS. This means that if ...
Steffen Ullrich's user avatar
4 votes

Why do SSL enabled sites don't reply back according to "hosts" file record?

The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i....
Steffen Ullrich's user avatar
4 votes

How to include HSTS policy in dns replies packet

Not with the current standards and norms, to the best of my knowledge. The most obvious DNS Query is the A record and I don't see a direct way to incorporate HSTS there - unless it is included in the ...
Sas3's user avatar
  • 2,656
4 votes

Is this possible with SSLsplit?

You question of Does this mean I can copy a certificate from a client(Firefox's built in store, Android's, etc.) is answered by: SSLsplit can also use existing certificates of which the ...
Steffen Ullrich's user avatar
4 votes
Accepted

Why does bettercap and sslstrip work sometimes on Google and Facebook?

According to the documentation, this works by rewriting HTTPS links to HTTP links with a different subdomain. Since none of these sites use the includeSubDomains directive, the browser won't use HSTS ...
AndrolGenhald's user avatar
4 votes
Accepted

Is SSL-strip still viable as a method of attack?

Your base assumption, that all browsers use HTTPS by default, is incorrect. If you click a link, it uses the protocol specified in the link. The internet is full of HTTP links. If you enter a URL in ...
Anders's user avatar
  • 65.6k
4 votes

Redirect client to no SSL as MITM

You can't, unless the service doesn't do certificate validation. To redirect, you'd have to send it a HTTP redirect, which you can't because it won't accept, as you probably can't present a ...
vidarlo's user avatar
  • 16.6k
4 votes

What can be intercepted more easily, WiFi or Ethernet on a fully compromised router?

It all depends on how the TLS connection is handled by the client. If you take into account that TLS was made exactly to bring security to a connection even if the router is malicious and intercepting ...
ThoriumBR's user avatar
  • 54.5k
3 votes
Accepted

Can HTTPS-Everywhere Prevent An SSL-Stripping Attack?

Yes. If HTTPS-Everywhere is set to block all unencrypted requests, your browser will never establish a plain HTTP connection without TLS, no matter what. How the rest of the networks looks, and where ...
Anders's user avatar
  • 65.6k
3 votes

Can the network administrator of my university see what I have searched on Google?

First note that on most cases the network administrators will not watch your traffic, even if they could. So the following only outlines the ways administrators could in theory watch your traffic if ...
Steffen Ullrich's user avatar
3 votes
Accepted

Is it possible to modify SSLStrip such that the client has an HTTPS connection?

No, to be able to perform that the attacker must have the private key associated with the certificate of the website (private key used to generate the public key in the certificate). The client will ...
grochmal's user avatar
  • 5,877
3 votes

MITM without spoofing (Decrypt sites with SSL + HSTS)

No, if you are trying to decrypt websites like facebook, google+, twitter, etc... for login credentials, it will not work. HTTP-SSL/TLS (HTTPS) will encrypt the traffic. All sslstrip does is redirect ...
Creg's user avatar
  • 71
3 votes
Accepted

Which HTTPS certificate is the content verified by if the content comes from multiple servers?

If it gets resources from a site like a CDN the certificate will be verified against the URL of this resource, in this case the CDN. The URL of the HTML file embedding these resources does not matter ...
Steffen Ullrich's user avatar
3 votes

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

Will that be sufficient enough to prevent the attacker from using SSLstrip to downgrade HTTPS to HTTP? No. I would assume the webserver will fail to serve non HTTPS traffic, correct? No. The ...
Tom's user avatar
  • 2,105
3 votes

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

Going HTTPS-only doesn't help protect you in this case. This other question should help illustrate why. In short, if an attacker can force a client to communicate over HTTP then the attacker can get ...
Taul's user avatar
  • 599
3 votes
Accepted

After performing a SSL strip, can you upgrade back to HTTPS with your own encryption from the proxy?

Unless the attacker is able to install a new certificate authority (CA) at the users system he can not make the client visit the original site by https through the attacker proxy without the client ...
Steffen Ullrich's user avatar
3 votes
Accepted

Clarification of details regarding an SSL Stripping Attack

Your understanding is correct. This is because the attacker established the HTTPS communication, so when the response from the web server comes to them it is decrypted and then forwarded to the ...
Joe's user avatar
  • 2,764
3 votes

Unable to downgrade https to http through sslstrip, arpspoof

First of all: What sslstrip does is it replaces https-links with non-https-links on hijacked non-https- websites. E.g. when the victim visits a http-only search engine via an insecure public wifi, the ...
Martin Fürholz's user avatar
2 votes

Is there an HSTS equivalent for DNSSec?

No, there is not a direct HSTS equivalent for DNSSEC. Most clients unfortunately don't support DNSSEC, and therefore couldn't care less about your server's RRSIG record. However, clients that do ...
ConnorJC's user avatar
  • 336
2 votes

NET::ERR_CERT_AUTHORITY_INVALID with HSTS

ERR_CERT_AUTHORITY_INVALID This sounds like there is a man in the middle intercepting the SSL connection. This might occur if: There is an actual attack against you which tries to intercept and ...
Steffen Ullrich's user avatar
2 votes

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

Currently on the web we have to accept that many browsers and their users will usually attempt to access web resources over unsecured (HTTP) connections. As such there is some slack in the RFC with ...
deed02392's user avatar
  • 4,148

Only top scored, non community-wiki answers of a minimum length are eligible