Detection of Intrusions and Malware, and Vulnerability Assessment

Volume 6201 of the series Lecture Notes in Computer Science pp 200-218

HProxy: Client-Side Detection of SSL Stripping Attacks

  • Nick NikiforakisAffiliated withIBBT-DistriNet, Katholieke Universiteit Leuven
  • , Yves YounanAffiliated withIBBT-DistriNet, Katholieke Universiteit Leuven
  • , Wouter JoosenAffiliated withIBBT-DistriNet, Katholieke Universiteit Leuven

* Final gross prices may vary according to local VAT.

Get Access


In today’s world wide web hundreds of thousands of companies use SSL to protect their customers’ transactions from potential eavesdroppers. Recently, a new attack against the common usage of SSL surfaced, SSL stripping. The attack is based on the fact that users almost never request secure pages explicitly but rather rely on the servers, to redirect them to the appropriate secure version of a particular website. An attacker, after becoming man-in-the-middle can suppress such messages and provide the user with “stripped” versions of the requested website forcing him to communicate over an insecure channel. In this paper, we analyze the ways that SSL stripping can be used by attackers and present a countermeasure against such attacks. We leverage the browser’s history to create a security profile for each visited website. Each profile contains information about the exact use of SSL at each website and all future connections to that site are validated against it. We show that SSL stripping attacks can be prevented with acceptable overhead and without support from web servers or trusted third parties.


MITM Detection SSL Stripping Browser Security