I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and one as the attacker, running ettercap. One attempt (pretending to be steamcommunity.com) yielded information; the target accepted the attacker's fake CA self-signed certificate presented via the MitM attack. The other attempt (pretending to be facebook.com) didn't even allow me to add an exception for the self-signed certificate on the target machine. So the question is, why did one website allow me to add an exception while the other one didn't?
2
-
1$\begingroup$ I added an answer for this question but it really belongs on the Information Security stack exchange. $\endgroup$– tangrsCommented Mar 11, 2017 at 8:37
-
$\begingroup$ thanks for the answer, i'll ask there too. i need answers as many as possible. $\endgroup$– PierrotCommented Mar 11, 2017 at 10:38
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
The short answer is HTTP Strict Transport Security .
When a web application issues HSTS Policy to user agents, conformant user agents behave as follows:
- Automatically turn any insecure links referencing the web application into secure links. (For instance, http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server.)
- If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), show an error message and do not allow the user to access the web application.
(emphasis mine)
On websites that have it configured, many browsers will not let you add an exception for untrusted certificates.
