TLDR: Send spoofed TCP package with HTTP redirect to malicious site right after victim does a GET request.
This attack, while impressive and nifty, would seem to be easily subverted by SSL right?* Yet another example that shows that non-SSL HTTP should be phased out.
* In the ideal situation where users check URL's and the CA system is good enough to keep the NSA out.
This attack, while impressive and nifty, would seem to be easily subverted by SSL right?* Yet another example that shows that non-SSL HTTP should be phased out.
* In the ideal situation where users check URL's and the CA system is good enough to keep the NSA out.