Skip to main content

SSLstrip is an attack against mixed HTTP/HTTPS connection where a man-in-the-middle downgrades HTTPS links to HTTP.

SSLstrip is a man-in-the-middle attack that consists of changing https links to http and thus changing a connection from being partly HTTP, partly HTTPS to being fully HTTP.

A remedy against SSLstrip is to not connect to a server using HTTP at all in the first place. This can be done by the user by typing an https URL (if the website retains HTTPS throughout). The website can use HSTS to request that the browser connect directly using HTTPS for subsequent connections.

External links