I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack using evil twin method against big websites like FB, GMail.
There are plenty of tools that automate fake AP creation and include additionally tools like SSLStrip and SSLSplit in order to try to bypass TLS/SSL and HSTS.
As long as I know HSTS to work, the client must have visited the same website at least once. But, this is not a big deal now, cause there is HSTS Preloading from browsers, and all the famous websites are already included there, so even if the client is entered to the website for the first time it still will run HSTS. On the other hand, I believe these websites also use certificate pinning (a concept that I'm not very familiar), which as long as I know means that instead of using the certificate trust chain, they directly specify for which certificate to look, and if the certificate is different just terminate the connection.
On the other hand, I believe the tools that try to bypass these technologies, use the idea that people don't type www.facebook.com, but instead type just facebook.com, so that the tools can redirect the request to let's say wwww.facebook.com, for which it is possible to forge a certificate. But, I believe this is no longer true. But what's preventing the attack from being able to forge the certificate for some nonsense subdomain of the official website, the certificate pinning or HSTS, or both? Also how does HSTS and certificate pinning work together?