Ideas to Work Around Avast Secure DNS

hi.
So I used the birthday card trick to get someone WPA wifi key.

My goal was to know a little more about the site my target visits.

So I do arpspoofing on the router and the pc victim, and perfomed only DNS request sniffing. nothing else is interesting anyway because it's encrypted.

only to discover that most DNS request are "encrypted". 'appearring as malformed packet'.

My guess is that he/she uses Avast Premium with Secure DNS on. I can see some request to avast server and other non relevant stuff.

But I am more interested by what I can't see right now.

I am looking for other tools to use. I wanted to use mitmproxy but that require to install a certificate and need some social engineering to do that but I think it will raise too much concerns/bells. Also i don't see the site visited right now so I can't fake one I do'nt know about.

Even the time I have done the arpspoofing, it slowed the network I guess, because he/she perfomed a scan of the network and router with avast. (I can see that with the dns request made).

I just tried trape but it did not load image on my test site (google.com) from within firefox. Any ideas why ?

Even though I have a step in the LAN, I can't see what I can do. I need some kind of social engineereing in that like a simple link for trape.

I don't know metasploit. This seems like a beast to master to me. And I don't see how I could find a hole in a fully patched windows 10 machine.

I saw the other tutorial about fake website with fake video link but I don't think that could work. Also I don't have a good idea of his/her interest.

I guess I should have gone far above that the WPA wifi key trick the first time. I should have embend a metasploit trojan in the images. Too late now