SSL Stripping Explained: SSL/TLS Downgrade Attacks for CompTIA Security+ (SY0-701)
SSL stripping is one of those attacks that shows up on the CompTIA Security+ (SY0-701) exam without ever being named outright. Objective 2.4, "Given a scenario, analyze indicators of malicious activity," lists on-path attacks under its network attacks category and downgrade attacks under its cryptographic attacks category — SSL stripping is the real-world attack that sits at the intersection of both. If a scenario question describes a user who typed a bank's HTTPS address but the logs show plain HTTP traffic on port 80 instead of port 443, you are looking at SSL stripping. This guide expands on that core idea: what SSL stripping actually is, how an attacker positions themselves to pull it off, the specific indicators CompTIA wants you to recognize, and the defenses that actually stop it. What Is SSL Stripping? SSL stripping (also called an SSL/TLS downgrade attack) is a technique where an attacker sitting between a victim and a legitimate website quietly downgrade...