Defeating SSL using SSLStrip (Marlinspike Blackhat)

<a href="http://securitytube.net/Defeating-SSL-using-SSLStrip-(Marlinspike-Blackhat)-video.aspx">http://securitytube.net/Defeating-SSL-using-SSLStrip-(Marlinspike-Blackhat)-video.aspx</a>

The way the SSLStrip tool works by:

 Does an MITM on the HTTP connection

Replaces all the HTTPS links with HTTP ones but remembers the links which were changed 

Communicates with the victim client on an HTTP connection for any secure link

Communicates with the legitimate server over HTTPS for the same secure link

Communication is transparently proxied between the victim client and the legitimate server

Images such as the favicon are replaced by images of the familiar "secure lock" icon, to build trust

As the MITM is taking places all passwords, credentials etc are stolen without the Client knowing