sslstrip

Start SSL stripping on default port

$ sslstrip

$ sslstrip --listen=8080

$ sslstrip --ssl --listen=8080

$ sslstrip --listen=8080 --all

$ sslstrip --listen=8080 --write=output.log

$ sslstrip --help

sslstrip [options]

sslstrip is a security testing tool that performs SSL stripping attacks by acting as a proxy between the victim and the server. It converts HTTPS links to HTTP, allowing interception of traffic that would otherwise be encrypted. This tool is used for authorized penetration testing and security research.

-l, --listen PORT

Port to listen on (default: 10000)

Log all SSL and HTTP traffic

Log all SSL traffic to and from server

Specify log file path

Log only HTTP POST requests (default)

Substitute a lock favicon on secure requests

Kill sessions in progress

Display help information

This tool is intended for authorized security testing only. Unauthorized use against systems you do not own or have permission to test is illegal. Requires ARP spoofing or similar MITM setup to intercept traffic. Modern browsers with HSTS preloading may prevent this attack.

sslstrip was created by Moxie Marlinspike and demonstrated at Black Hat DC 2009 to illustrate vulnerabilities in SSL/TLS implementation in web applications.

arpspoof(8), ettercap(8), mitmproxy(1)