20.3.17. What are SSL Stripping Attacks

20.3. Application Attacks

SSL Stripping

[[SSL]] Secure Sockets Layer Stripping

Downgrades HTTPS to HTTP to steal login data.

- Type of MITM (Man-in-the-Middle) attack

⚙ How SSL Stripping Works

- User tries to access a secure site (HTTPS)

- Attacker intercepts and forces user to connect to the HTTP version

- Attacker connects to HTTPS version with the real server

- Attacker can now:

- Read everything the user sends

- Modify the response from the server

🛡 Protection Against SSL Stripping

1. [[HSTS]] (HTTP Strict Transport Security)

- Forces browsers to use HTTPS only

2. Sitewide HTTPS (SSL enabled on all pages)

- Prevents initial HTTP connection

3. Secure Cookies

- Cookies only sent over HTTPS

4. User Education

- Don’t use public Wi-Fi without VPN

- Check for HTTPS & padlock symbol

HSTS

HTTP Strict Transport Security.

a web security policy that tells your web browser to only connect to a specific website using HTTPS (secure connection), even if you try to go there using plain HTTP.

- Stops SSL stripping attacks.