HTTPS

Question 1

HTTPS (HTTP Secure or HTTP over SSL/TLS)

Answer 1

method to run HTTP over SSL/TLS - a cryptographic protocol

Question 2

What does HTTPS provide?

Answer 2

confidentiality, integrity protection, authentication

Question 3

What does HTTPS prevent?

Answer 3

• attacker cannot sniff application layer comms
• attacker on path cannot alter app layer data
• client can tell real identity of server and vice-versa

Question 4

Can a network adjacent user sniff HTTPS traffic?

Answer 4

yes, but they will not know the HTTP request headers/body/target domain or the HTTP response headers/body

but might recognize:

• target ip address
• target port
• dns or similar protocols may disclose which domain user tries to resolve

Question 5

Does HTTPS protect against web app flaws?

Answer 5

no. all attacks on web apps happen regardless of SSL/TLS

the extra encryption layer just protects exchanged data between client/server

Question 6

How to connect to HTTPS in linux terminal?

Answer 6

openssl s_client -connect host:443

Question 7

How to connect to HTTP in linux terminal

Answer 7

nc -v www.ferrari.com 80