HTTP vs HTTPS Security Demo

An interactive educational project demonstrating the security differences between HTTP and HTTPS, including live attack simulations and payment interception.

---

Quick Start

Prerequisites

• Node.js v14 or higher
• A terminal / VS Code integrated terminal

1. Install dependencies

npm install

2. Generate SSL certificate (already included — only if you need to regenerate)

openssl req -x509 -newkey rsa:2048 \
  -keyout certs/server.key \
  -out certs/server.cert \
  -days 365 -nodes \
  -subj "/C=IN/ST=Maharashtra/L=Pune/O=Demo/CN=localhost"

3. Start the server

node server.js

4. Open in browser

URL	Mode
http://localhost:3000	⚠️ Insecure HTTP demo
https://localhost:3443	🔒 Secure HTTPS demo

Note: For HTTPS, your browser will show a "certificate not trusted" warning — this is expected for a self-signed cert. Click "Advanced → Proceed to localhost".

---

Project Structure

http-https-demo/
├── server.js          ← Main Node.js server (HTTP + HTTPS)
├── package.json
├── certs/
│   ├── server.key     ← SSL private key
│   └── server.cert    ← Self-signed SSL certificate
├── views/
│   ├── http.html      ← Insecure HTTP demo page
│   └── https.html     ← Secure HTTPS demo page
└── public/
    ├── css/style.css  ← Shared stylesheet
    └── js/
        ├── http.js    ← HTTP page logic
        └── https.js   ← HTTPS page logic

---

What's Demonstrated

HTTP (Insecure) — http://localhost:3000

• Submit a payment → watch it get intercepted in plaintext in the terminal AND on screen
• The server simulates a MitM attacker:
  • Reads full card number, CVV, email from the packet
  • Tampers with the payment amount
  • Redirects the payment to the "hacker's" account
• Attack buttons simulate:
  • Packet sniffing — credentials harvested from raw network traffic
  • Session hijacking — cookie stolen, account taken over without password
  • DNS spoofing — DNS cache poisoned to redirect users to a fake site
  • SSL stripping — HTTPS downgraded to HTTP transparently

HTTPS (Secure) — https://localhost:3443

• TLS Handshake animation — step through all 5 phases of the SSL/TLS negotiation
• Submit a payment → see simulated AES-256-GCM ciphertext (what an attacker intercepts — unreadable)
• Same attacks attempted → each one blocked with explanation
• SSL certificate details displayed
• Active security headers listed (HSTS, CSP, X-Frame-Options, etc.)

---

API Endpoints

Method	Path	Description
GET	/	Serves HTTP or HTTPS page based on connection
POST	/pay	Payment endpoint — simulates attack (HTTP) or secure (HTTPS)
GET	/api/intercepted	Returns log of intercepted HTTP packets
GET	/api/secure-log	Returns log of secure HTTPS transactions
GET	/api/attack/:type	Simulates sniff, session, dns, sslstrip attacks
GET	/api/cert-info	Returns TLS/cipher details (HTTPS only)

---

For VS Code Users

1. Open the folder: File → Open Folder → http-https-demo
2. Open the integrated terminal: Ctrl + `` (backtick)
3. Run npm install then node server.js
4. Click the URLs in the terminal output (Ctrl+Click)

Install the nodemon package for auto-restart on file changes:

npm run dev