SSLStrip

How SSLStrip Works

SSLStrip is a man-in-the-middle downgrade attack against web traffic. The attacker sits between the user and the destination site, intercepts redirects and hyperlinks, and rewrites them so the browser continues over HTTP instead of HTTPS. That changes only the transport security, but it removes confidentiality and integrity from the session.

The attack depends on a trust gap in the first hop of the session. If a browser reaches a site over plain HTTP before it has learned to insist on HTTPS, the attacker can keep the connection in cleartext long enough to observe requests, alter responses, or harvest session data. Once strict transport enforcement is in place, the downgrade path becomes much harder to sustain.

Why Downgrade Attacks Matter

SSLStrip is dangerous because it does not need to break encryption, it sidesteps it. The user may still believe they are visiting a legitimate site, while the browser is quietly carried over an unprotected channel. That makes credential theft, session hijacking, content injection, and cookie interception far easier than in a properly protected HTTPS session.

The impact is broader than passive eavesdropping. A man-in-the-middle that can rewrite links can also tamper with login flows, inject malicious content, or redirect the user to lookalike pages. This is why transport security has to be enforced consistently, not treated as an optional preference once a site starts in HTTP.

How Organisations Reduce Exposure

Exposure is highest when applications still accept HTTP, advertise insecure redirects, or rely on users to navigate to HTTPS manually. Organisations should verify that public-facing services redirect cleanly to HTTPS, that sensitive paths never fall back to HTTP, and that all subdomains are covered by a consistent transport policy.

Browser-side enforcement matters too. HSTS tells the browser to remember that a site must only be contacted over HTTPS, which blocks the attacker’s ability to force a downgrade on repeat visits. Public services that are intended to be HTTPS-only should treat HSTS as a baseline control, alongside secure cookies, modern TLS configuration, and removal of mixed-content dependencies. NIST Cybersecurity Framework 2.0 is a useful governance reference for treating transport hardening as part of protect and detect discipline, and CIS Benchmarks help anchor the underlying server and platform hardening that supports it.

Detection And Response After Suspected Interception

SSLStrip activity is often visible as unexpected HTTP access to resources that should only be reached over HTTPS, repeated redirects from secure pages back to cleartext, or user reports that a trusted site appears to have inconsistent security indicators. Network defenders may also see anomalous proxying, certificate warnings, or traffic patterns that do not match the normal site-to-browser path.

When compromise is suspected, organisations should review whether session cookies, credentials, or sensitive form submissions traversed cleartext while the attack was active. If that happened, the safest assumption is that the session was exposed and any affected credentials or tokens may need to be reset. For threat mapping and control validation, MITRE ATT&CK Enterprise Matrix is useful for understanding the adversary’s interception and manipulation techniques, while OWASP API Security Top 10 helps teams remember that authentication and object access controls still matter even when the transport layer is compromised.

Risk and Threat Considerations

SSLStrip is a practical example of why “HTTPS available” is not the same as “HTTPS enforced”. The attacker does not need to defeat TLS directly, only to keep the user on HTTP long enough to observe or manipulate the session. That makes the technique especially effective against sites with weak redirect handling, missing HSTS, or mixed transport dependencies.

Failure mechanism: The attack works when the browser can be steered into a cleartext path before HTTPS enforcement is established, allowing the attacker to read or alter traffic in transit.

Impact: Credentials, sessions, cookies, and page content can be exposed or modified, which can lead to account compromise, phishing follow-on activity, or integrity loss in the user’s transaction flow.

Practitioner Guidance

Why practitioners should care: Treat SSLStrip as a signal that transport security must be designed as a default property of the service, not as a user choice. The key judgement is whether every user-facing path, including redirects and subdomains, consistently lands on HTTPS without opportunity for downgrade.

Common misunderstanding: Teams sometimes assume a site is safe because the login page uses HTTPS. In reality, any earlier HTTP hop can still expose traffic or enable rewrite attacks, so the control has to cover the whole navigation path, not just the final form submission.

Practitioner takeaway: Validate strict HTTPS enforcement end to end, then verify that the browser is never given a cleartext fallback path that an active intermediary could exploit.