WebTCP 80 Cleartext by default
Port 80: HTTP
Hypertext Transfer Protocol
Unencrypted web traffic. Today it should only redirect to HTTPS.
Secure alternative: HTTPS (443)
How attackers abuse it
- Session cookies and form data intercepted on the network.
- SSL stripping: an attacker keeps the victim on HTTP.
- Content injected into pages in transit.
How to defend it
- Redirect all traffic to HTTPS.
- Enable HSTS (and preload) so browsers never use HTTP.
- Set the Secure flag on cookies.
Exam tip
HSTS is the control that defeats SSL stripping.