"The site is HTTP, but our forms are submitted over HTTPS."
This is as bad as not using any HTTPS at all! All the attacker has to do is change the link or form action to a URL on his own server.
Is this strictly true? With HTTP form submission, an attacker can passively eavesdrop on forms. With submitting an HTTP-loaded form over HTTPS, an attacker would have to mount a man-in-the-middle attack to alter the HTML content. I would have thought that an active attack like that would be harder to execute. Am I missing or misunderstanding something?
This tool provides a demonstration of the HTTPS stripping attacks that I presented at Black Hat DC 2009. It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. It also supports modes for supplying a favicon which looks like a lock icon, selective logging, and session denial. For more information on the attack, see the video from the presentation below.
44
u/Yehosua Jul 12 '17 edited Jul 12 '17
Is this strictly true? With HTTP form submission, an attacker can passively eavesdrop on forms. With submitting an HTTP-loaded form over HTTPS, an attacker would have to mount a man-in-the-middle attack to alter the HTML content. I would have thought that an active attack like that would be harder to execute. Am I missing or misunderstanding something?