Defeating Ssl Using Sslstrip (Marlinspike Blackhat)

TheSecurityTube · 61.3K views · 2012-03-13 · 1:09:16

Open on YouTube ↗

If playback is restricted in your region, try opening the original video. Use Mark watched to add it to your marked videos.

Overview

Moxie Marlinspike's Black Hat talk presenting sslstrip, which defeats SSL in practice by intercepting the http-to-https redirect.

On Hacker News

HN recommends it as an entertaining talk and the original source on the stripping attack that motivated HSTS.

Recommended by 3 HN people across 3 months · HN mentions 2014–2018

Topics

Security & hacking Networking & internet infrastructure Cryptography

What people said

ktta · 2017-09 · Strong recommendation
Relevant part starts here [VIDEO] Although for anyone interested in HTTPS, I'd recommend watching the whole thing. Very entertaining.
Read the original HN comment ↗

superuser2 · 2015-09 · Recommendation
We don't have humans in the loop for issuing certificate; this can and has been exploited for fun and profit, with fun attacks like getting a cert for "citibank.com\0.mydomain.com" which used to trick the C strcmp in most browser certificate checking routines. Moxie has an entertaining talk: [VIDEO] Your problem would be getting people to "thecitibank.com." Chrome, Firefox, and GMail would all eventually figure out it was a phishing site and warn users about clicking through to it.
Read the original HN comment ↗

fabulist · 2014-11 · Recommendation
This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make. This may be a decent place to begin one's inquiry, but don't let it end here too. Here are some talks I recommend: Tricks for Defeating SSL in Practice - Moxie Marlinspike [VIDEO] OPSEC: Because Jail is for wuftpd - thegrugq [LINK]
Read the original HN comment ↗

Sources

Video by TheSecurityTube, played through YouTube.

HN Library · Source license

Data and selection notes

HN summaries and labels may contain AI errors. HN dates refer to discussions, not video publication.

HN Library: HackerTube export (2026-10-31) and open-index/hacker-news. Upstream summaries and classifications may contain AI errors.

Views, duration and playback status refresh separately from the published catalog. When an update fails, existing data remains visible.

Selection checks

SaaS & AI candidates: Topic keywords do not match
Editor-approved picks: Editorial review is required

Rule matches identify candidates. They do not guarantee video quality or financial results.

About the library and its sources