4 ms·
> and nobody is MITMing https, full stop. Not true: https://tools.kali.org/information-gathering/sslstrip https://tools.kali.org/information-gathering/sslstrip
by laputan_machine 7y ago
> and nobody is MITMing https, full stop.
Not true: https://tools.kali.org/information-gathering/sslstrip https://tools.kali.org/information-gathering/sslstrip
Most free access points have a http endpoint that requires you to 'sign in' first, that is MITM'd and then sslstrip any outbound https requests from there.
- bsamuels 7y agoSSLStrip does not work for iphone or android apps since HTTPS is explicit. SSLStrip also does not work for major social networks or financial institutions that implement HTTPS Strict Transfer Policy, which is basically all of them. The only way you can use SSLStrip nowadays is if you have BofA/whatever phishing links on your wifi portal's home page, which is a pretty hard sell phishing wise.