2

I'm currently working from a customer LAN which is "protected" through authentication through captive-portal-like technology.

In theory, first thing you do in the morning is click on some URL, get the loging form spoofed by the captive portal and authenticate to the network (and then get on with work and other non-transparent-proxy frustrations).

Of course all these 'clever' captive portal techniques (read MITM attack) are easily detected by today's browsers and most of the time, the login form never shows up and all you get is a timeout.

Browsers occasionaly report self-signed certificates or bad SSL packet (TLS 1.0 I guess). But it also looks like my company AV (Symantec) is not even giving browsers a chance.

I wonder if I could pass this hurdle with some kind of older version of some browser I'd use only for the purpose of login in. Surely I'm not the only one stumbling on this issue. Any suggestion?

Edit 1

Thanks all for all suggestions (+1'd). Here is the progress so far.

  • The VPN is Cisco AnyConnect. There is no difficulty accessing the VPN from its public (Internet) leg. I'm using OpenConnect on Mint. All OK but slooow.

  • When on the faster company LAN, however, several hurdles come into play. Access to the LAN is guarded by a Cisco Product named ISE (Identity Services Engine) version 1.0. From a user's perspective, this ISE works like a captive portal, spoofs DNS requests, redirects to a portal that authenticates (radius) and apparently also uses TLSv1. Browsers are unimpressed. OpenConnect also complains (can I tell OC to be more leniant?). Also OCSP times out because servers can't be reached.

I'm planning to script all that stuff with python and requests to go through all steps in a controlled sequence and check each step's execution. I initially thought capturing 'curled' requests in Google Chrome developer tools would suffice, but the infra seems very shaky and python+requests looks more promissing than curl+bash. To spice things up a bit, there is non transparent proxy.

  • 2
    Unless there is a CSRF token in the Form you could setup a cURL alias that does the login. You'd have to set a dont-verify-certs sort of flag which is horribly insecure but thats not a concern here, is it? – marstato Mar 5 '17 at 11:54
1

I'd bookmark the captive portal's login URL. Most implementations of captive portal redirects you to a login address, which you should be able to bookmark.

If the portal is such poorly implemented that it doesn't actually have its own login URL, then you might want to have a bookmark for a non-https websites, which can be intercepted by the captive portal.

  • You are right, @Lie, I bookmarked the login URL and I know how to log in automatically. That's part of the solution. – Alain Pannetier Mar 6 '17 at 8:16
2

Use a throw-away domain you don't mind the captive portal knowing (I use redirect.me.away) and when you get the certificate error for it just accept the certificate. The browser will pin that domain with the (untrusted) certificate so you won't get errors about it next time.

Finally, consider using mobile broadband instead of this nonsense, and make sure to let whoever is responsible for it how much their network sucks (most of the time they buy into off-the-shelf overpriced crap from scammy service providers because they don't know better, so if enough people complain it may encourage deployment of actually good solutions, like WPA2-Enterprise or Hotspot 2.0)

  • Thanks @André, I've added some new findings. I suspect mys customer is using an obsolete version of their VLAN provisioning platform. – Alain Pannetier Mar 6 '17 at 8:15
1
  • In that specific case (like Lie said): Bookmark redirect URL: bookmark that specific redirect URL.
  • In the general case: Use a site hand made for that purpose that never uses SSL and therefore will not give you an SSL warning. Bookmark NeverSSL.com (HN discussion here.)
  • @StackOfZtuff. Thanks for the link. Fascinating! I guess my pb is a bit different though. I've updated the question. – Alain Pannetier Mar 6 '17 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.