Question

HSTS spoils most of our fun on real websites. Research HSTS and explain how HSTS prevents the SSLstrip vulnerability.

Answer 1

HSTS

• HTTP Strict Transport Security
• Web security policy
• Protect the sites against session hijacking
• only interact with it using secure HTTPS connections

HOW IT PREVENTS SSL Strip

client creates a cleartext connect can to server *server responds and it will redirect to HTTPS address *HSTS header is set * communication of client & server over SSL * end of session * Attacker perform SSL stmp and serves clear text to client * client recognize that HSTS policy as allows thus, it altes the user

HOPE THIS HELPS
FEEL FREE TO COMMENT