SSL Stripping Attacks

You're at a coffee shop. You type your bank's URL into the browser. Everything looks normal — the page loads, you log in. But someone on the same network just read your password in plain text. That's SSL stripping.

How SSL Stripping Actually Works

The core idea is deceptively simple. When you type "bank.com" into your browser, the first request goes out over plain HTTP — not HTTPS. Normally, the bank's server responds with a redirect: "Hey, come back over HTTPS instead." Your browser follows the redirect and everything is encrypted from that point on.

An SSL stripping attacker sits between you and the server (a man-in-the-middle position). They intercept that initial HTTP request, follow the HTTPS redirect themselves, and then serve you the page over plain HTTP. You get the real content from your bank — but none of it is encrypted on your side of the connection.

The attacker sees everything. Every keystroke, every password, every session cookie.

The attack flow looks like this:

The key detail: the connection between the attacker and the real server is fully encrypted over HTTPS. The server has no idea anything is wrong. It's only your side — the link between your browser and the attacker — that's been stripped down to unencrypted HTTP.

Why You Won't Notice It Happening

Most people don't actively check for the padlock icon in their browser's address bar. And even if they did, some SSL stripping tools go further:

• Favicon spoofing — The attacker inserts a padlock favicon to mimic the browser's HTTPS indicator
• URL similarity — The URL still shows your bank's real domain, just with http:// instead of https://
• Normal page behavior — Everything works exactly as expected because the attacker is proxying real content from the legitimate server

Marlinspike's original tool, sslstrip, even replaced HTTPS links within the page content so that subsequent navigation stayed on HTTP. Every link you clicked kept you in the unencrypted channel.

Where SSL Stripping Happens

This attack requires the attacker to be in a man-in-the-middle position. Practically, that means:

• Public WiFi — Coffee shops, airports, hotels. ARP spoofing or a rogue access point puts the attacker between you and the router.
• Compromised routers — Home routers with default credentials or unpatched firmware. More common than you'd think.
• Corporate networks — An insider or compromised machine on the same network segment.
• Tor exit nodes — Malicious exit node operators can intercept unencrypted traffic.

Can HSTS Prevent SSL Stripping?

HTTP Strict Transport Security (HSTS) is the primary defense against SSL stripping. When a server sends an HSTS header, it tells the browser: "For the next X seconds, only connect to me over HTTPS. Don't even try HTTP."

This works well — after the first visit. And that's the problem.

Gaps in HSTS protection

Even with HSTS deployed, there are edge cases:

• First visit vulnerability — Until your browser has seen the HSTS header at least once, it doesn't know the site requires HTTPS. The HSTS preload list covers major sites (Google, Facebook, Twitter), but most websites aren't on it.
• Expired HSTS policies — HSTS has a max-age. If you haven't visited a site in a while and the policy expires, you're back to square one.
• Subdomain gaps — Unless the includeSubDomains directive is set, HSTS only applies to the exact domain. An attacker could redirect you to http://m.bank.com or http://secure.bank.com instead.
• Browser data clearing — Clearing browser data or using incognito mode wipes stored HSTS policies. Every session starts fresh.

Honestly, HSTS alone isn't enough. It's a critical piece of the puzzle, but it leaves real gaps that attackers actively exploit.

How PhishClean Detects HTTPS Downgrades

PhishClean's HTTPS Downgrade Alert is one of its 15 detection signals. It works differently from HSTS because it monitors the actual behavior of your browser session rather than relying on server-side headers.

Here's what it checks:

• Detects when a page that should be served over HTTPS is loaded over HTTP
• Flags mixed content — HTTPS pages loading resources (scripts, forms, iframes) over plain HTTP
• Monitors for hidden iframes that load over HTTP within an HTTPS page
• Alerts when form actions point to HTTP endpoints on pages that appear to be login or payment forms

All of this runs locally in your browser. No data is sent anywhere. PhishClean doesn't need to know which sites you visit — it just watches for the patterns that indicate something has gone wrong with the encryption.

Protecting Yourself Beyond HSTS

• Use a VPN on public WiFi. A VPN encrypts all traffic between your device and the VPN server, preventing local network attackers from intercepting your HTTP requests. It's not perfect, but it eliminates the most common attack scenario.
• Type https:// explicitly. If you type the full https:// prefix, your browser connects directly over HTTPS without the initial HTTP request that attackers exploit.
• Enable HTTPS-Only Mode. Firefox and Chrome both offer settings that block or warn about HTTP connections. Firefox: Settings → Privacy & Security → HTTPS-Only Mode. Chrome: chrome://flags/#https-only-mode.
• Install a browser security extension. Tools like PhishClean detect HTTPS downgrades in real time — catching the attack even when HSTS and browser settings fall short.

Related Threats