SSLStrip2 and HSTS

Question

I have a question concerning the usage of SSLstrip2 to bypass HSTS on websites.

I managed to successfully install and deploy SSLStrip2 (in combination with DNS2Proxy). This means that when using a browser and visiting a website, the website will communicatie via HTTP.

However, when a website was already visited once by using HTTPS, this header is maintained and the browser will always use HTTPS (HSTS header). The result of this is that the webpage is stuck on loading.

Question
Is it possible to force HTTP on websites which were never visited before, but still redirect users to the HTTPS version if they visited the website once before, so the page will load no matter what.

Any help would be appreciated very much, there are not very much forums on the internet concerning this topic so I rely on the knowledge of StackExchange again.

Answer 1

Yes, it's certainly possible

Is it possible to force HTTP on websites which were never visited before, but still redirect users to the HTTPS version if they visited the website once before, so the page will load no matter what.

There is nothing stopping you from doing that, if it's not currently happening it's probably your tools that refuse to forward the https request for some reason. I would recommend using the Man in the Middle Framework.

The framework automatically applies SSL strip, and https requests are forwarded normally, so if you can't apply SSL strip the page is loaded normally. It even does the ARP / DNS spoofing for you.

As a sidenote: HSTS preloading

I would like to add that in some cases you can't apply SSL strip to websites even if the user has never visited them before. This is due to HSTS preloading. Basically, when you install your browser it will also install a list of websites which your browser will only contact over https. Some examples would be facebook.com and google.com