4

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the very first time a client associates and attempts to use the network, they are prompted for credentials. After the correct credentials are supplied, subsequent HTTP requests are serviced just fine.

I can successfully log in to this RFC2617 compliant WiFi access point from a small Raspberry Pi Linux computer with the following script:

#!/usr/bin/python

## Attempt to connect to the None access point
## and return success or failure
import sys
import requests

url = "http://www.google.com"
username = sys.argv[1]
password = sys.argv[2]

print "Trying URL: %s - Now!"%(url)
r = requests.get(url) ## Try without credentials
if int(r.status_code) == 401:
        print "Got HTTP %s - Re-Trying with Credentials now..."%(r.status_code)
        r = requests.get(url, auth=(username, password))
        print "Result after providing credentials was: %s"%(r.status_code)
        if int(r.status_code) == 200:
                sys.exit(0)
        else:
                sys.exit(-1)
else:
        print "Got HTTP %s..."%(r.status_code)
        if int(r.status_code) == 200:
                sys.exit(0)
        else:
                sys.exit(-1)

Once I am logged in, I am logged in until the Access Point changes its password. Subsequent HTTP requests are never prompted for credentials after the initial 401.

For the purposes of testing, I want to be able to log out so I hit the condition of getting an HTTP 401 on the subsequent attempt to log in again. I cannot seem to figure out how to unauthenticate. I have tried the following:

  • Randomly Assign Mac Address to wlan0 WiFi interface
  • Factory Reset and Reboot device

I tried to look for the requests ( HTTP stack ) module's cookies - but could not find any. It is entirely empty.

The ONLY time I am not authenticated is after the Access Point resets it weekly.

How does the RFC2617 access point know the device is the same device and allow web requests after I change the Mac Address and reboot? The access point must be fingerprinting me somehow but how? How can I successfully unauthenticate? Thanks!

  • Just a wild guess, but I would check to see if the system is sending back a cookie as part of the http request or a session key which are not cleared unless the AP pwd is changed. I'd dump out all the headers in the response and see if you can see something to give more of a clue – Tim X Aug 6 '15 at 23:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.