Abstract
In today's world, browsing the web is one of the everyday activities of our lives. This increasing use of the web by the large number of people puts a heavy burden on the security community to ensure web users are safe and secure. Web traffic today is protected by encryption, and the current technology being used is Transport Layer Security (TLS), which is the upgraded and newer version of previously used Secure Socket Layer (SSL). Additionally, mapping of web domain names to actual addresses on the internet (IP Addresses) is done using Domain Name Service (DNS) protocol. In this paper, we highlight the vulnerabilities of two fundamental protocols of the modern web and internet by developing a Proof of Concept (PoC) tool that exploits these weaknesses when the protocols are misconfigured, potentially compromising a user's web activity. Then, we explain how to avoid these vulnerabilities from the users' perspective, as well as steps web administrators should take to eliminate these flaws. Finally, we perform an empirical study on the top 1k, 10k, and 100k websites and show a large number of them don't make use of HSTS (HTTPS Strict Transport Security) security mechanism, which can secure their users against the same kind of attacks we showcase in this paper. Our goal is to improve the security posture of web users and servers by bringing awareness.