KEMBAR78
HTTP by Default | PDF
Scribd
Upload
10 views1 page

HTTP by Default

The website lacks a proper SSL certificate, making it vulnerable to Man-in-the-Middle attacks that can expose users' usernames and passwords. This risk is particularly high for users on public or shared networks. To mitigate this vulnerability, it is recommended to implement an SSL certificate to ensure secure HTTPS connections.

Uploaded by

piyushcyber9
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
10 views1 page

HTTP by Default

The website lacks a proper SSL certificate, making it vulnerable to Man-in-the-Middle attacks that can expose users' usernames and passwords. This risk is particularly high for users on public or shared networks. To mitigate this vulnerability, it is recommended to implement an SSL certificate to ensure secure HTTPS connections.

Uploaded by

piyushcyber9
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

Vulnerability - HTTP by default

-----------------------------------------------------------------------------------
-----------------------------------------------------------

Description -

The website is not fully protected by an SSL certificate. This could allow an
attacker in a Man-in-the-Middle position to obtain usernames and passwords of users
visiting the site.
-----------------------------------------------------------------------------------
-----------------------------------------------------------

Steps to Reproduce -

1 - Open the domain - http://abc.com


2 - Copy the URL and open a new tab
3 - Paste the URL and add a "S" in the domain and check if it redirects it to https
4 - If it does not open on https, it is vulnerable.
-----------------------------------------------------------------------------------
-----------------------------------------------------------

Impact -

If a user were to visit this page from a public or shared network (eg, office,
airport, library, etc) and login into an account, a malicious user on the same
network would be able to obtain that user's username and password by conducting a
Man-in-the-Middle attack using Wireshark.

This would allow the malicious user complete access to the user's account.
-----------------------------------------------------------------------------------
-----------------------------------------------------------

Remediation -

Add an SSL certificate so that the website becomes secure and opens on HTTPS.
-----------------------------------------------------------------------------------
-----------------------------------------------------------

You might also like