PApabs3·May 6, 2022
The thing could just strip the upgrade to https anyway. Lots of those sort of tricks are implemented in sslstrip:
https://github.com/moxie0/sslstrip
In How to build an absurdly backwards-compatible websitemoxie0
sslstrip
Python2013–2022
moxie0 / sslstrip
sslstrip
A tool for exploiting Moxie Marlinspike's SSL "stripping" attack.
5Distinct people
5Mentions
0Explicit recommenders
2.1KGitHub stars
What to know before exploring
What it is
A tool for exploiting Moxie Marlinspike's SSL "stripping" attack.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year5 dated mentions
Observed mentions: 2013-11-09 13:23:54 UTC to 2022-05-06 03:56:27 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
5 sourcesYeah. And for anyone unaware, this technique, SSL stripping, was made well-known (and perhaps pioneered?) by Moxie Marlinspike of Signal with his tool sslstrip back in 2011: https://github.com/moxie0/sslstrip. I believe that's what he was most famous for before Signal.
It's unfortunate that this very simple attack remains extremely successful even a decade later. I'm surprised Tor Browser didn't enforce HTTPS Everywhere for all domains by default years ago. HTTPS Everywhere was released in 2010, before sslstrip, even. HSTS and HSTS preloading helps, but individual site owners still have to explicitly submit their site to be added to the preload list.
In Tracking One Year of Malicious Tor Exit Relay Activities (Part II)Did you watch the demo video[1]? Apparently some sites (Vanhoef’s example was Match.com) are suspectible to MITM by using Moxie Marlinspike’s sslstrip tool[2].
[1] https://youtu.be/Oh4WURZoR98
[2] https://github.com/moxie0/sslstrip
In Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce ReuseI think the point is if a cert is suddenly from an untrusted source it's a sign of malicious activity, hence the increased negative feedback to the user relative to an insecure connection.
Granted this opens up attacks like ssl stripping, https://github.com/moxie0/sslstrip, but certificate pinning is making that more difficult.
In Chrome is warning users about insecure pagesThere is a tool, SSL strip that removes SSL from the target machines https request dynamically. While not breaking SSL it is effective on a non observant user.
https://github.com/moxie0/sslstrip
In Lans.py: capture usernames, passwords, messages and inject arbitrary HTML