Full Disclosure mailing list archives
Re: Captive Portal bypassing
From: "Steven Adair" <steven () securityzone org>
Date: Mon, 10 Dec 2007 13:27:38 -0500 (EST)
Hi, I didn't read all of the documents in detail, but I noticed the first bunch mentioned spoofing/changing your MAC address to that of someone that is validated/authorized. This is of course assuming this is feasible and someone has authenticated already. Many of the hotspots will just simply allow both TCP and UDP outbound on Port 53. I'm not overly familiar with RunningOzyManDNS - but I think this takes advantage of that to some degree. However, I've found that in airports at least, about half of the captive portals will allow TCP 53 out to anywhere. Even easier than running a special tool is to just setup SSHD or a proxy to listen on TCP 53. You can then tunnel out and do as you please without authenticating to the captive portal. Of course you might want to keep the legal aspects in mind before doing any of that. Steven http://www.securityzone.org
If there were an easy to use (gold standard == nmap) and robust tool capable of bypassing all commonly used captive portals, that would make for a great 'mischief enabler'. Some googled links for the lazy lurkers... http://en.wikipedia.org/wiki/Captive_portal http://www.eusecwest.com/esw06/esw06-blancher.pdf http://www.semicomplete.com/blog/2007/Aug/11 Which in turn mentions Kaminksy's (yay Kaminsky!) OzyManDNS via http://taint.org/wk/RunningOzyManDNS http://www.doxpara.com/ozymandns_src_0.1.tgz ...and a ton of other searching resulting in alot of reading regarding the usual software flaws, poor implementations (did I repeat myself there?), etc. I do not see anything that prevents the rolling-up of all applicable bypass techniques into a single tool. Preferably one written to be as portable as possible. Is anyone actively working on this that would care to share? Anyone want to point out flaws in the idea or make suggestions? Might make for a good 'con paper & presentation if anyone out there was looking for something to do. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Captive Portal bypassing gmaggro (Dec 10)
- Re: Captive Portal bypassing T Biehn (Dec 10)
- Re: Captive Portal bypassing Steven Adair (Dec 10)
- Re: Captive Portal bypassing gmaggro (Dec 10)
- Re: Captive Portal bypassing Peter Besenbruch (Dec 10)
- Re: Captive Portal bypassing gmaggro (Dec 10)
- Re: Captive Portal bypassing coderman (Dec 10)
- Re: Captive Portal bypassing gmaggro (Dec 11)
- Re: Captive Portal bypassing coderman (Dec 11)
- Re: Captive Portal bypassing coderman (Dec 11)
- Re: Captive Portal bypassing gmaggro (Dec 10)