I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www.messenger.com. Using the setoolkit, I'm hosting on 10.0.10.1:80 a page identical to that of www.messenger.com. When I connect with a smartphone to the access point and browse to www.messenger.com:
If I use Opera or the built-in Xiaomi browser, the attack scenario works out and the browser returns the page hosted on 10.0.10.1:80, and seems like you are on www.messenger.com (except the http).
If I use Chrome or Firefox, it says I should check my Internet access and it's unable to connect. I suppose this is a security feature against DNS spoofing of these two browsers.
Has anyone any info on how it works? Is it because the response is for a local IP address?