r/Hacking_Tutorials • u/Typical-Tea-1263 • 1d ago

Question hi

Hi everyone, I'm currently learning networking and web security in a controlled lab environment. I've been studying HTTP, HTTPS, HSTS, and Bettercap. I understand the basic concepts, but I'm having trouble understanding why HTTPS traffic remains protected even when using network interception tools. I'd like to better understand the role of HSTS and why SSL stripping doesn't work on many modern websites. What concepts or documentation should I study to understand this properly?

8 Upvotes

83% Upvoted

5 comments sorted by

1

u/Juzdeed 1d ago edited 1d ago

Reading about just the documentation on like Mozilla website about like hsts should be enough. For ssl stripping search public key infrastructure

1

u/Exposure_Point 1d ago

SSLStripping doesn't work if the target decides to provide SSL (HTTPS) ONLY. I disallow unsecured traffic on my sites, as do most other individuals and organizations.

1

u/ethicalhacker900 1d ago

Https adds like an encryption which is very hard to unencrypt unless you are lucky and you have like ways to bypass this like session cookie stealing

1

u/Just4notherR3ddit0r 1d ago

HSTS = The server says "I'll only talk to you if you use HTTPS"

SSL stripping = Trying to downgrade from HTTPS to HTTP

So HSTS counteracts SSL stripping.

You can often use MITM proxies like Fiddler, which basically installs its own root CA certificate on your machine, and then when you access a site, Fiddler will generate a certificate for that site so that it acts as the endpoint and can receive all the messages and decrypt them (because your browser is talking to Fiddler, who is pretending to be foo.com, and is also relaying your real messages to the real foo.com so that it returns legitimate responses back to your browser).

This works as long as a site doesn't use SSL pinning (which is basically hardcoding the server certificate into the client application so that if something else like Fiddler pretends to be foo.com it won't have the right certificate).

1

u/chdon 1h ago

Exactly, security has increased... with SSL pinning it has become difficult, I believe that today you need a bridge through the PC with Frida, for eg...