bettercap work “sometimes” on Chrome browsers on sites such as Facebook, Google, AOL, and other sites that use preload HSTS. Why does it work sometimes when it shouldn’t work at all?
According to the documentation, this works by rewriting HTTPS links to HTTP links with a different subdomain. Since none of these sites use the
includeSubDomains directive, the browser won't use HSTS for these rewritten links. Using the
includeSubDomains directive prevents this attack by having browsers force the use of HTTPS for all subdomains of a site, instead of just certain subdomains.
Normally this shouldn't work for preloaded sites, given that the preload list requires that
includeSubDomains be specified, but it appears the list has made certain exceptions to that requirement, notably for Google and Facebook. Google has a long list of subdomains preloaded including accounts.google.com, docs.google.com, encrypted.gogole.com, etc, but google.com is not preloaded. Likewise Facebook has www.facebook.com, m.facebook.com, secure.facebook.com, and several others preloaded, but facebook.com is not. Thus if you're already on an HTTP site, sslstrip2 can rewrite a link from www.facebook.com to wwww.facebook.com to avoid HSTS.
While testing this I discovered that Firefox's preload list also differs from Chrome's more than one might expect. As noted here, Firefox's list is based on Chrome's, but Firefox does its own validation of the list. This results in cases like touch.facebook.com, where Chrome has
includeSubdomains set to true in its preload list, but Firefox has it set to false (indeed when I just tested it the header I got was
strict-transport-security max-age=15552000; preload).