I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible version of WindowsXP with the default IE and Chrome installed. I will first start by going over what I think I know and troubleshooting I have done. Bettercap appears to be functioning in the sense that it can grab passwords from normal HTTP websites but not HTTPS websites.
What I THINK I know.
-SSLStrip converts HTTPS to HTTP
-SSLStrip will not work on anything that has HSTS preloaded
-SSLStrip will only work on non-preloaded HSTS websites if and only if the user is visiting it for the "first" time.
-SSLStrip will work against TLS and SSL if HSTS is not used
-If HSTS is not implemented, A victim doesn't need to do anything specific or be tricked into installing any certs.
-SSLStrip will attempt to redirect ALL HTTPS websites the victim visits to their HTTP counterpart.
What I Want To Do -Monitor the victim's computer's traffic
-Get the victim user to go to my personal LAMP server, click the login page I wrote myself and receive an HTTP version of my domain. (more accurately http://accounts.shopify.com)
What I have done
I used a typical install method
apt-get install bettercap
I have been following this website
I have used these commands once I activate bettercap
» set http.proxy.sslstrip true
» set net.sniff.verbose false
» set arp.spoof.targets 192.168.1.6
» arp.spoof on
» http.proxy on
» net.sniff on
What is working
-Can successfully redirect victim traffic to the attacking device
-Can successfully grab headers
-Can successfully display the password when I enter it in non-HTTP websites
What is NOT
-The part where HTTPS is supposed to automatically be converted into HTTP
So guys, I feel like I'm missing something essential. This sounds too straightforward of a process to fail. So what is it? What am I missing?