0

I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www.messenger.com. Using the setoolkit, I'm hosting on 10.0.10.1:80 a page identical to that of www.messenger.com. When I connect with a smartphone to the access point and browse to www.messenger.com:

If I use Opera or the built-in Xiaomi browser, the attack scenario works out and the browser returns the page hosted on 10.0.10.1:80, and seems like you are on www.messenger.com (except the http).

If I use Chrome or Firefox, it says I should check my Internet access and it's unable to connect. I suppose this is a security feature against DNS spoofing of these two browsers.

Has anyone any info on how it works? Is it because the response is for a local IP address?

Improve this question
1

1 Answer 1

Reset to default
4

Messenger.com is on the HSTS preload list. This means that it requires a https connection, for all browsers that use the HSTS preload list.

In addition, any browser which supports HSTS, but does not use the preload list will fail to load messenger.com over http if they have visited the site previously.

The standards mandate that untrusted certificates or redirection to plain http should be treated as hard failures, not something the user can bypass.

HSTS is meant to kill the kind of attack you are attempting, and thus working exactly as intended.

If you present a self signed certificate, it will generally fail, unless this cert is trusted by the local certificate storage.

Here's a list of browsers supportings HSTS.

Improve this answer
3
  • i browsed messenger.com from my personal PC, and the DNS query for the server that i created iş being spoofed with ssl protocol which handshakes with the SSL certificate i retrieved from my personal machine visiting Messenger.com would that be applicable ?
    – Ahmed Can Unbay
    Aug 8, 2020 at 0:36
  • So not Real ip Via dns but a Real certificate and all the keys retrieved from the original server itself on the handshake
    – Ahmed Can Unbay
    Aug 8, 2020 at 0:37
  • @turmuka If you have a new question, please ask a new question. As it stands, I don't really understand what you're asking either.
    – vidarlo
    Aug 8, 2020 at 8:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .