I did all the configuration right. IPtables, port forwarding, ARPspoof, everything.
However, in the browser websites like Facebook and Twitter are still HTTPS.
What am I doing wrong?


Pick a softer target.

Update 1

So: Pick a target that doesn't use HSTS and/or pick a browser that doesn't care about HSTS.

  • I don't want to hack someone. i want to learn. how can i bypass this HSTS? – Antonio Oct 31 '15 at 13:22
  • 1
    @Antonio: HSTS is intended as protection against sslstrip etc, so no bypass of HSTS with sslstip, especially not HSTS preload. – Steffen Ullrich Oct 31 '15 at 13:25
  • @SteffenUllrichs Oh .. alright. so all the websites here chromium.googlesource.com/chromium/src/net/+/master/http/… will not be http ever ? And there is a way to bypass HSTS? not with SSLSTRIP. – Antonio Oct 31 '15 at 13:27
  • @SteffenUllrich what about mitmf? – Antonio Oct 31 '15 at 13:42
  • @Antonio: MITM works only if the CA is already trusted by the browser. If HSTS is used the certificate warnings does not allow override by the user. – Steffen Ullrich Oct 31 '15 at 13:53

I'm pretty sure it's worked for me in the past. If I recall correctly; you may need to de-authenticate your victim and wait for them to re-connect. On account of EAP/EAPOL, I do believe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.