I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS which collects the url of the sites which uses ssl and prevents the user from accessing the insecure http version of that site.
But in sslstrip+ (sslstrip2) a new method the attacker use a different domain name like http://wwww.facebook.com/ instead of http://www.facebook.com/ so that the browser will not find the domain in the hsts list and allows an insecure http connection with facebook (the attacking proxy of course).
But I just cant use sslstrip+ successfully in certain websites like mail.google.com, www.facebook.com etc...
It is said in Man-in-The-Middle Framework (MiTMF) - The tool that is available for linux (I installed it in kali linux) that it can evade HSTS also when we use --hsts handler (It uses sslstrip + when we use --hsts handler).
But this is not working well with the sites such as facebook and google. Anyway the tool mitmf redirects me to http://social.facebook.com/ (non-existing website and of course this may not be there in HSTS list of browser) when I visit http://www.facebook.com/ from victim's computer. But soon leads to a could not find www.facebook.com error. I think the url http://social.facebook.com may not be present in the hsts list of browser still I am unable to access the fake url of facebook from a victim machine.
Why does sslstrip + (I am not talking about the old sslstrip by Moxie Marlinspike) fail in these cases? Can someone explain the method which is used by these sites to evade sslstrip+ ? I googled a lot but didn't end up with an exact answer.