As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [captive-portal]

A captive portal is a web page served to users of a network, often asking for credentials, before they can use the internet.

Filter by
Sorted by
Tagged with
0 votes
1 answer
196 views

Unregister your device from a WiFi network [closed]

Recently, I connected my Android device to an open wi-fi network. Then a web page opened up asking me to choose username and password to log in with. Now when I connect the same device to that network,...
framago's user avatar
  • 101
1 vote
1 answer
1k views

How to protect against MAC spoofing in WiFi network?

I have this scenario: I want to create a WiFi network for a hotel that the customers should pay to gain access to the internet. I tried Captive portal, but captive portal is very vulnerable against ...
Amir Sabeghi's user avatar
1 vote
1 answer
373 views

What is the best form of authorization for captive portal WiFi

I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps: 1) Open Wireshark and run a report getting the most used ...
MikeSchem's user avatar
  • 2,321
1 vote
2 answers
2k views

Why do evil twin attacks against WiFi use a captive portal?

I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
Hugo's user avatar
  • 123
78 votes
8 answers
28k views

How is no password more secure than username+password?

Context: I have a laptop supplied by my organisation. I am trying to connect to eduroam, but I cannot do it using my organisation's laptop. When I use a personal computer, it asks me for a username ...
luchonacho's user avatar
  • 1,351
1 vote
1 answer
1k views

Building a malicious captive portal

So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff. Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
DotNetRussell's user avatar
8 votes
2 answers
5k views

How should captive portals redirect?

I recently read this question, which makes me wonder a follow up question: how is this captive portal likely trying to redirect the user? A highly voted comment does say that it's doing it wrong, ...
Kat's user avatar
  • 411
4 votes
1 answer
4k views

Can Captive Portal links open browser/apps?

I'm aware the risks of connecting to a public AP poses as well as how MITMish is the hotspot approach. I wonder if there is anything in the OS layer (iOS, Android) that prohibit the execution of ...
Francisco Zanatta's user avatar
0 votes
1 answer
264 views

Captive Portal Security Measures

I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
Dániel Emőd Kovács's user avatar
6 votes
2 answers
14k views

Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?

I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
John Doe's user avatar
2 votes
1 answer
1k views

Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?

As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
Lew Wei Hao's user avatar
2 votes
3 answers
572 views

Need a leniant browser for captive portals (WiFi and LAN)

I'm currently working from a customer LAN which is "protected" through authentication through captive-portal-like technology. In theory, first thing you do in the morning is click on some URL, get ...
Alain Pannetier's user avatar
1 vote
1 answer
875 views

Captive portal (Wifi) remembers me even if I change my MAC address

On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my ...
Muxe's user avatar
  • 11
3 votes
1 answer
3k views

WPA2-EAP and Captive Portal

Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time? Is there any EAP supporting Captive Portal? For example - user connects to WiFi, goes to Captive Portal over unsecure ...
user128766's user avatar
2 votes
2 answers
1k views

Change device MAC address to router's MAC address

This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if : I connect to a wireless network Get the router's MAC ...
Sanidhay's user avatar
  • 191
3 votes
3 answers
2k views

Enterprise HTTPS redirection without certificate error

I have a captive portal setup for my organization that forces users to authentication prior to being allowed access to the network. Challenge is that when a user opens their browser and their homepage ...
nitrobass24's user avatar
4 votes
2 answers
694 views

Httpclient redirect in coffee shops

In some coffee shops that offer free WiFi (for instance Starbucks), I have noticed that attempting to use HTTP or HTTPS fails unless you accept a notification (on Windows at least) which looks ...
Stumbler's user avatar
  • 503
19 votes
4 answers
6k views

Is HTTPS secure over public Wi-Fi with an expired certificate?

I am staying at a hotel with free public Wi-Fi. To get Internet access I had to visit a web page and agree to the terms and conditions. This website has a security certificate, but it expired over a ...
Alex's user avatar
  • 383
4 votes
1 answer
2k views

How does Karma's open WiFi network successfully protect its users?

Foreword This question has a lot of build-up, so please scroll down to the bottom if you just want to see the question. Please at least skim the background info, though. Background I ordered a ...
allquixotic's user avatar
5 votes
2 answers
560 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
makerofthings7's user avatar
2 votes
2 answers
2k views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
techraf's user avatar
  • 9,149
4 votes
2 answers
1k views

Public AP: How to reduce vulnerability window between Captive Portal and starting VPN?

I always use a VPN on my Mac when I access over public APs (such as coffee shop free WiFi) How much should I worry about the window of time where I am in the captive portal (the agreement screen) and ...
Bucky's user avatar
  • 43
5 votes
2 answers
1k views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
user2813274's user avatar
  • 2,061
5 votes
2 answers
3k views

HTTPS in captive portals and the Apple Captive Network Assistant

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
RomanSt's user avatar
  • 1,190
11 votes
1 answer
4k views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
rink.attendant.6's user avatar
-1 votes
2 answers
1k views

Is there any reason that captive portal server can't block the ICMP echo request/reply packet

We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an ...
chenglong fu's user avatar
3 votes
1 answer
3k views

How are Captive Wifi Portals secured?

I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC) Is there a reliable ...
makerofthings7's user avatar
4 votes
1 answer
914 views

Can a captive portal be secured [closed]

I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
just.another.programmer's user avatar
5 votes
2 answers
6k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
Nigel's user avatar
  • 51
3 votes
1 answer
696 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
Paul's user avatar
  • 161
1 vote
1 answer
1k views

Designing and managing a captive portal

I'd like to learn more about how a captive portal works, especially the management system regarding usage, security monitoring, billing, security architecture etc. Does anybody know any good ...
Ian's user avatar
  • 171
8 votes
1 answer
18k views

Bypassing a captive portal with tor

I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules. What I have found recently is that simply by using Tor, I can also bypass a ...
Sonny Ordell's user avatar
  • 3,516