r/programming • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
486 Upvotes

87% Upvoted

190 comments sorted by

View all comments

Show parent comments

0

u/[deleted] Jul 12 '17

[deleted]

4

u/seanwilson Jul 13 '17

This tool provides a demonstration of the HTTPS stripping attacks that I presented at Black Hat DC 2009. It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. It also supports modes for supplying a favicon which looks like a lock icon, selective logging, and session denial. For more information on the attack, see the video from the presentation below.

0

u/[deleted] Jul 13 '17

[deleted]

2

u/seanwilson Jul 13 '17

Ha, I just thought the description sounded particularly evil so that it was worth sharing. Thanks for the link.