I am doing research on bypassing HSTS. I read this guide on bypassing HSTS using SSLSTRIP+, but there are a few things that I don't understand.
First thing to do is to fire up MITMf in SSLstrip+ mode, I'll also be using classic ARP spoofing to become man-in-the-middle:
So now when 192.168.10.23 browses to www.google.com he will be redirected to wwww.google.com!
How exactly is the victim being redirected. Does the DNS packet contain some sort of redirect? Or is it something else that redirects the user to wwww.google.com?
And another thing. Is this figure is still applicable to SSLSTRIP+?
The documentation of the DNS2Proxy tool from LeonardoNve states the following:
Automatically the dns server detects and correct the changes thats my sslstrip+ do to the hostnames to avoid HSTS, so will response properly.
What exactly is being corrected here?