I did all the configuration right. IPtables, port forwarding, ARPspoof, everything.
However, in the browser websites like Facebook and Twitter are still HTTPS.
What am I doing wrong?
I'm pretty sure it's worked for me in the past. If I recall correctly; you may need to de-authenticate your victim and wait for them to re-connect. On account of EAP/EAPOL, I do believe.