So back in 2015 there was a lot of talk about a method in which HSTS could be bypassed. Basically here is the method:
- Most people type a url without adding http:// or https:// or simply click a link which directs them to the site they want.
- SSLStrip2 intercepts the request and changes all https to http while also the dns adds an extra letter in the domain(e.g. www.gooogle.com, not the subdomain which is covered by HSTS)
An older method would change the url from www.example.com to wwww.example.com but HSTS is required to force all subdomains of example.com to require https if it is in its list of HTTPS sites. However changing the actual domain name thwarts this prevention because www.examples.com is not in the HSTS list of sites.
My question is, does this method of bypassing HSTS still work in 2017? If not what methods have been used to prevent it?