Later archive addition
New Tricks for Defeating SSL in Practice (sslstrip & null-prefix certificates)
Black Hat DC 2009 deck introducing sslstrip: rather than attacking TLS, a MITM rewrites https links and 302s in passing HTTP traffic, strips secure cookies and content encodings, and serves a padlock favicon. It reports 117 email accounts and 16 card numbers captured in 24 hours, then combines the trick with IDN look-alike slashes under a wildcard certificate.
Record
- Researcher
- Moxie Marlinspike
- Format
- Whitepaper
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Moxie Marlinspike, first published at the original source. Preserved copies are kept so the citation survives its host.