Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
I did all the configuration right. IPtables, port forwarding, ARPspoof, everything.
However, in the browser websites like Facebook and Twitter are still HTTPS.
What am I doing wrong?
Pick a softer target.
Facebook is on the Chromium HSTS preload list
Twitter is on the Chromium HSTS preload list
Pick a target that doesn't use HSTS and/or pick a browser that doesn't care about HSTS.
I'm pretty sure it's worked for me in the past. If I recall correctly; you may need to de-authenticate your victim and wait for them to re-connect. On account of EAP/EAPOL, I do believe.
Required, but never shown