Bypassing HTTP Strict Transport Security

Explore the vulnerabilities of HTTP Strict Transport Security (HSTS) in this 46-minute Black Hat conference talk by Jose Selvi. Delve into the evolution of SSL/TLS attacks, from cryptographic weaknesses like BEAST and CRIME to protocol-based attacks such as SSLStrip. Learn how HSTS was developed to counter these threats, particularly SSLStrip attacks. Examine the strengths and weaknesses of HSTS, with a focus on an inter-operation vulnerability that could potentially bypass this security measure. Gain insights into how this vulnerability could be exploited, allowing attackers to employ techniques like SSLStrip despite HSTS protection. Enhance your understanding of web security and stay informed about potential risks in HTTPS implementations.