+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: man in the middle attack bypassing hsts new method? (/showthread.php?tid=5903954)
man in the middle attack bypassing hsts new method? - EIP - Nov 5, 2018
For many websites such as facebook,google man in the middle attack with arpspoof and sslstrip does not work. It is more hard, if users use modern browser like chrome or firefox.
Do you know any other methods?
RE: man in the middle attack bypassing hsts new method? - sh4moon - Nov 5, 2018
we literally had a thread about this less than a month ago. you could mitm the ssl cert too. you use one certificate pretending to be the server's certificate when communicating with the client. and use a separate one when pretending to be the client (communicating with the server.)
RE: man in the middle attack bypassing hsts new method? - odedor444 - Feb 9, 2019
(Nov 5, 2018 03:38 PM)sh4moon Wrote: we literally had a thread about this less than a month ago. you could mitm the ssl cert too. you use one certificate pretending to be the server's certificate when communicating with the client. and use a separate one when pretending to be the client (communicating with the server.)
can you please send a link to a tutorial or a more detailed explanation ?