While running the following command in Kali mitmf -i eth0 --arp --spoof --gateway --target --filepwn i have noticed that in latest chrome, when i typed google.gr the result was an http version of google. (Although that did not work in Facebook or Linked in websites opened by victim). How does filepwn implement the above feature?

1 Answer 1


Google.com (and all other country versions like google.gr) do opportunistic HSTS (see this answer for more details). It is an interesting question though, why they would stop enforcing https from their chrome browsers (as it used to be like that in the past).

Facebook does strict HSTS, which is why you will 'never' be able to force the client into http mode for Facebook. AFAIK, Linkedin does not use HSTS, so something else must have gone wrong there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .