Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I read an article about some hotel injection ads to every webpage using some router: http://justinsomnia.org/2012/04/hotel-wifi-javascript-injection/
Would it be possible to do this with any existing software? (like in a Man-In-The-Middle scenario?) Injecting the scripts in every browser connecting to the Man-In-The-Middle?
Like other mentioned, you can use squid transparent proxy and configure it to rewrite some requests/responses. I've done it in the past with a PHP/Apache backend, the project was called squid-imposter.
The other option is to use sslstrip project, it already modifies HTTP traffic so it's a good start. Take a look at my fork of sslstrip that has response tampering built in.
The hotel owns and operates the routers and proxies on its own network, so it is not technically a MITM, but the normal part of the chain. It is a trivial matter to re-write HTML on the fly to replace elements of a page with something else.
The de facto standard in this area is squid. You can set it up as a transparent proxy and add a script to change out what you would like. The famous prank using this method is the kittenwar and upside down net (link).
I hope this helps.
I'm not quite sure what you ask "[w]ould it be possible to do this with any existing software?" Are you asking whether there are existing software solutions that can inject scripts into a web session?
I'll assume you're asking the "why" and "how" it's done and the implications from a risk standpoint. First, when you're on a public network (hotel wifi is pretty public), the connection traverses the hotel's (usually outsourced to some vendor) network. With unencrypted HTTP traffic, an appliance (usually a linux-based device) can be deployed in line (logically or physically) to intercept, monitor, and modify traffic according to some defined ruleset/policy. Forward proxies are a fairly common implementation of devices that intercept outbound web traffic. Forward proxies can be deployed in such a way that all HTTP and HTTPS traffic is terminated at the proxy before continuing on to its intended destination.
Forward proxies (and other technologies to intercept, modify, monitor) are commonly deployed in corporate settings. They're also usually deployed in libraries, on Amtrak, gogo wireless inflight internet, and many other public areas). They're usually deployed to make sure people aren't doing things they shouldn't be doing and to protect the network provider from legal liability (i.e. kiddie porn). However, the technology can be deployed to enable more ... questionable objectives. In the case of the revenue extraction gateways (RXG's), they're implemented by network providers to make money off its users.
HTTPS sites pose a unique challenge. Because of the architecture and validation steps, the forward proxy has to be able to "fake" a "valid" cert that your browser trusts. Usually https interception is only implemented in corporate settings and on corporate networks (where the users don't really have much in the way of privacy). So, if you browser HTTPS sites at locations where RXG's are deployed, you probably won't be subject to 3rd-party script injection, malicious or otherwise. There has been verified reports where a public CA has cut a subCA for certain deployments, so there's no guarantees that an HTTPS site is legit unless you really know about PKI.
