SSL Stripping Attack & Prevention

 SSL Stripping - SSL/TLS Downgrade

This type of attack can be called either of the above names. Pay attention to the question. The question may have stated that the user went to his financial organization's website, https://www.bank.com, but when you look at the logs, the user actually went to http://www.bank.com. 

HTTPS would have used port 443, whereas HTTP will use port 80. That could be another hint that the attack was SSL Stripping or an SSL/TLS downgrade attack.

The ways of preventing these attacks (has to be configured on the server):

• HSTS (HTTP Strict Transport Security)
• HTTP security header

Percent Encoding and the Attacks they are Associated

 PERCENT ENCODING

Character            Percent Encoding        Attack

space                   %20                              SQLi

'                            %27                              SQLi

Examples: 

%27%20or%20%27

'%20or%20"

.                            %2E                            Directory Traversal

/                            %2F                            Directory Traversal

Examples:

%2E%2E%2F%2E%2E%2F

..%2E..%2E

..2F..2F

<                           %3C                           XSS (Cross-site Scripting)

>                           %3E                           XSS (Cross-site Scripting)

<script>

Also, look for .js at the end of a URL