Re: Wireless hotspot login pages

["Edd Burgess" <edd.burgess () cantab net>]

It's entirely possible that I'm under simplifying this, but why not
configure the browser to exclude proxy for local subnet ips?

On Fri, May 28, 2010 19:54, Rafael Correia wrote:
> Hi Paul,
>
>
> I don't know that's possible or not, but if the mobile browser have a
> auto-discovery proxy tool, you can verify if the login page comes from the
> IP discovered and unlock it.
>
>
> Just a suggestion. :)
>
>
> -- Rafael Correia
>
>
>
> 2010/5/28 Paul Johnston <paul.johnston () pentest co uk>
>
> > Hi,
> >
> >
> > I have a client who restricts their mobile workers' browsers so they
> > can only access a single site - the client's citrix access gateway. They
> >  don't want users directly browsing the Internet out of the office -
> > because of both malware and AUP concerns. They enforce this by setting
> > the proxy to the corporate proxy (only accessible in the office),
> > having a proxy exclusion for the CAG, and preventing users editing the
> > settings.
> >
> > This all works fine for use on home broadband (wired/wireless) and 3G.
> >
> >
> > However, it falls down for Wireless Hotspots. Many of these have a
> > browser-based login page. The proxy configuration prevents access to the
> >  login page, stopping the hot spot being used at all.
> >
> > This must be a problem a lot of people have hit. How do you allow
> > access to Hot spot login pages, but not web pages in general?
> >
> > Any suggestions much appreciated,
> >
> >
> > Paul
> >
> >
> > --
> > Pentest - When a tick in the box is not enough
> >
> >
> > Paul Johnston - IT Security Consultant / Tiger SST
> > Pentest Limited - ISO 9001 (cert 16055) / ISO 27001 (cert 558982)
> >
> >
> > Office: +44 (0) 161 233 0100
> > Mobile: +44 (0) 7817 219 072
> >
> >
> > Email policy: http://www.pentest.co.uk/legal.shtml#emailpolicy
> > Registered Number: 4217114 England & Wales
> > Registered Office: 26a The Downs, Altrincham, Cheshire, WA14 2PU, UK
> >
> >
> > -----------------------------------------------------------------------
> > -
> > Securing Apache Web Server with thawte Digital Certificate
> > In this guide we examine the importance of Apache-SSL and who needs an
> > SSL certificate.  We look at how SSL works, how it benefits your
> > company and how your customers can tell if a site is secure. You will
> > find out how to test, purchase, install and use a thawte Digital
> > Certificate on your Apache web server. Throughout, best practices for
> > set-up are highlighted to help you ensure efficient ongoing management
> > of your encryption keys and digital certificates.
> >
> > http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be44
> > 2f727d1
> > ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL
> certificate.  We look at how SSL works, how it benefits your company and
> how your customers can tell if a site is secure. You will find out how to
> test, purchase, install and use a thawte Digital Certificate on your
> Apache web server. Throughout, best practices for set-up are highlighted
> to help you ensure efficient ongoing management of your encryption keys
> and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f
> 727d1
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------