Simple and Lightweight HTTPS Enforcement to Protect against SSL Striping Attack

摘要

SSL is a protocol for secured traffic connections. By using the SSL, HTTPS has been designed to prevent eavesdroppers and malicious users from web application services. However, man-in-the-middle attack techniques based on stripping and sniffing the HTTPS connections are still possible, causing security problems on web applications. Several scrip-kiddy tools to launch such attacks are easy to find and available on the Internet. In this paper, we therefore proposed a solution to protect against SSL striping attack. By enforcing a connection to HTTPS, our techniques determine the web URL and enforce the communication to HTTPS for protecting against the SSL striping attack. The experimental results on a test-bed have demonstrated an effectiveness and efficiency of our solution.