I've spent the day using some different tools (MITMf, Ettercap and dnsspoof) to DNS Spoof websites such as Facebook, Gmail, etc. Grabbing the entered credentials on a duplicate website works totally fine when I just make up my own random website domain, but when I try to redirect the official facebook to my unofficial domain, I always get the error "Your connection is not private", and the webpage never loads. I hoped that this could be fixed by using an SSL Strip (--hsts using MITMf), but that didn't change anything.
(python mitmf.py -i eth0 --spoof --arp --dns --target 192.xxx.xx.xxx --gateway 192.xxx.xx.x --hsts)
Are newer browsers totally protected from any kind of SSL Strip that would work for DNS Spoofing?
Is there any way that I can spoof a official domain such as Facebook or Gmail? If not, are there any other methods you can recommend I look into for stealing data on a local network?
P.S. I'm doing this just for fun, to give my brother a scare, because it's cool, and to maybe become a White Hat Hacker in the future.
(python mitmf.py -i eth0 --spoof --arp --dns --target 192.xxx.xx.xxx --gateway 192.xxx.xx.x --hsts)
Are newer browsers totally protected from any kind of SSL Strip that would work for DNS Spoofing?
Is there any way that I can spoof a official domain such as Facebook or Gmail? If not, are there any other methods you can recommend I look into for stealing data on a local network?
P.S. I'm doing this just for fun, to give my brother a scare, because it's cool, and to maybe become a White Hat Hacker in the future.
