title: HSTS bypass with sslstrip+ & dns2proxy
body: <p>I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( <a href="https://github.com/LeonardoNve/sslstrip2" rel="noreferrer">https://github.com/LeonardoNve/sslstrip2</a> and <a href="https://github.com/LeonardoNve/dns2proxy" rel="noreferrer">https://github.com/LeonardoNve/dns2proxy</a> ). But I quite don't get it.</p>
  
  <ul>
  <li><p>If the client is requesting for the first time the server, it will work anytime, because sslstrip will simply strip the Strict-Transport-Security: header field. So we're back in the old case with the original sslstrip.</p></li>
  <li><p>If not ... ? What happens ? The client know it should only interact with the server using HTTPS, so it will automatically try to connect to the server with HTTPS, no ? In that case, MitM is useless ... >&lt;</p></li>
  </ul>
  
  <p>Looking at the code, I kinda get that sslstrip2 will change the domain name of the ressources needed by the client, so the client will not have to use HSTS since these ressources are not on the same domain (is that true?). The client will send a DNS request that the dns2proxy tool will intercept and sends back the IP address for the real domain name.At the end, the client will just HTTP the ressources it should have done in a HTTPS manner.</p>
  
  <p>Example : From the server response, the client will have to download mail.google.com. The attacker change that to gmail.google.com, so it's not the same (sub) domain. Then client will DNS request for this domain, the dns2proxy will answer with the real IP of mail.google.com. The client will then simply ask this ressource over HTTP.</p>
  
  <p>What I don't get is before that... How the attacker can html-strip while the connection should be HTTPS from the client to server ... ?</p>
  
  <p>A piece is missing ... :s</p>
  
  <p>Thank you</p>