SSL stripping forces a victim’s browser to downgrade from HTTPS to HTTP, allowing attackers to intercept and read traffic that should be encrypted. During a MITM attack, SSL stripping removes the encryption layer by manipulating redirects and modifying unencrypted responses. This is effective when a website does not enforce HTTPS strictly or when HSTS is not enabled.

How SSL Stripping Works

When a user visits a site:

They request http://example.com
The server redirects them to https://example.com
Their browser loads the encrypted page

SSL stripping intercepts step 2 and modifies the redirect so the victim stays on unencrypted HTTP.
The attacker then communicates with the server over HTTPS while the victim unknowingly uses HTTP.

Requirements Before SSL Stripping

SSL stripping requires:

MITM position (ARP spoofing or similar)
Ability to intercept HTTP traffic
A tool to modify redirects
A target site that does not enforce HSTS

If the target site uses HSTS, SSL stripping becomes ineffective.

Identifying Redirect Opportunities

Monitor HTTP traffic for redirects pointing to HTTPS.

Viewing Redirect Traffic

sudo tcpdump -i eth0 port 80

Redirects appear as HTTP/1.1 301 or HTTP/1.1 302.

If the site relies on insecure redirects, SSL stripping is possible.

SSL Stripping with sslstrip

sslstrip is one of the original tools used for HTTPS downgrade attacks.

Enabling IP Forwarding

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

Redirecting Port 80 to sslstrip

sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

Running sslstrip

sudo sslstrip -l 8080

Victim requests are forced to HTTP, while attacker connects to HTTPS upstream.

SSL Stripping with Bettercap

Bettercap provides a modern and powerful SSL stripping module.

Launching Bettercap

sudo bettercap -iface eth0

Enabling ARP Spoofing

arp.spoof on

Starting the HTTPS Downgrade Module

https.strip on

Bettercap automatically intercepts HTTPS redirects and strips encryption.

SSL Stripping via mitmproxy

mitmproxy is more advanced and allows modification of HTTP flows.

Starting mitmproxy in Transparent Mode

sudo mitmproxy --mode transparent

Setting up iptables redirection

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

mitmproxy logs downgraded HTTP traffic for review.

Detecting HSTS

Some sites use HTTP Strict Transport Security.
If HSTS is enabled, SSL stripping cannot downgrade the connection.

Checking HSTS Header

curl -I https://example.com

Look for:

Strict-Transport-Security:

If present, SSL stripping will fail for that domain.

What SSL Stripping Allows

SSL stripping gives access to:

HTTP login forms
Session cookies (if not marked Secure)
Plaintext credentials
Browsing history
API requests
POST form data

Any non-HSTS site becomes vulnerable when combined with MITM.

Limitations of SSL Stripping

SSL stripping is blocked when:

HSTS is enabled
Browser preload lists include the domain
Certificate pinning is used
Application-level encryption is enforced

However, many internal apps and legacy web systems still lack HSTS.

Why SSL Stripping Matters

SSL stripping exposes weaknesses in HTTPS implementation.
It reveals whether:

Websites force HTTPS correctly
HSTS is configured
Internal apps rely on insecure redirects
Users can be downgraded to HTTP

SSL stripping is a critical MITM technique used to test the robustness of encrypted communication.

Intel Dump

SSL stripping removes HTTPS by modifying redirects
Tools: sslstrip, Bettercap, mitmproxy
Requires MITM and HTTP redirect interception
Ineffective against HSTS and preload lists
Enables theft of plaintext credentials and session data