I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite don't get it.
- If the client is requesting for the first time the server, it will work anytime, because sslstrip will simply strip the
Strict-Transport-Security:header field. So that's OK.
- If not? What happens? Will the client automatically try to connect to the server wih HTTPS? In that case, MITM is useless, isn't it?
Looking at the code, I kinda get that SSLstrip2 will change the domain name of the resources needed by the client, so the client will not have to use HSTS since these resources are not on the same domain (is that true?). The client will send a DNS request that the DNS2proxy tool will intercept and sends back the IP addres for the real domain name. At the end, the client will just HTTP the resources it should have done in a HTTPS manner.
Example: From the server response, the client will have to download mail.google.com. The attacker change that to gmail.google.com, so it's not the same (sub) domain. Then client will DNS request for this domain, the DNS2proxy will answer with the real IP of mail.google.com. The client will then simply ask this resource over HTTP.
What I don't get is before that: How the attacker can HTML-strip while the connection should be HTTPS from the client to server?