Questions tagged [captive-portal]
A captive portal is a web page served to users of a network, often asking for credentials, before they can use the internet.
33
questions
0
votes
0
answers
77
views
cannot connect to wifi in the captive portal stage in fluxion?
so while using fluxion, something strange (maybe not) happened,i've captured the handshake and try to penetrate the same wifi with a captive portal attack, fluxion created a duplicate wifi ,that's ...
- 1
0
votes
1
answer
146
views
Unregister your device from a WiFi network [closed]
Recently, I connected my Android device to an open wi-fi network. Then a web page opened up asking me to choose username and password to log in with. Now when I connect the same device to that network,...
- 101
1
vote
1
answer
609
views
How to protect against MAC spoofing in WiFi network?
I have this scenario:
I want to create a WiFi network for a hotel that the customers should pay to gain access to the internet.
I tried Captive portal, but captive portal is very vulnerable against ...
- 11
1
vote
1
answer
314
views
What is the best form of authorization for captive portal WiFi
I've been looking into captive portal WiFi implementations and on a few I'be been able to easily bypass their login with the following steps:
1) Open Wireshark and run a report getting the most used ...
- 2,266
1
vote
2
answers
1k
views
Why do evil twin attacks against WiFi use a captive portal?
I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
- 113
79
votes
8
answers
28k
views
How is no password more secure than username+password?
Context: I have a laptop supplied by my organisation. I am trying to connect to eduroam, but I cannot do it using my organisation's laptop. When I use a personal computer, it asks me for a username ...
- 1,341
1
vote
1
answer
869
views
Building a malicious captive portal
So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff.
Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
- 1,421
8
votes
2
answers
5k
views
How should captive portals redirect?
I recently read this question, which makes me wonder a follow up question: how is this captive portal likely trying to redirect the user? A highly voted comment does say that it's doing it wrong, ...
- 411
4
votes
1
answer
3k
views
Can Captive Portal links open browser/apps?
I'm aware the risks of connecting to a public AP poses as well as how MITMish is the hotspot approach.
I wonder if there is anything in the OS layer (iOS, Android) that prohibit the execution of ...
0
votes
1
answer
245
views
Captive Portal Security Measures
I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
6
votes
2
answers
14k
views
Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?
I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
- 61
2
votes
1
answer
1k
views
Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?
As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
- 429
2
votes
3
answers
508
views
Need a leniant browser for captive portals (WiFi and LAN)
I'm currently working from a customer LAN which is "protected" through authentication through captive-portal-like technology.
In theory, first thing you do in the morning is click on some URL, get ...
- 277
1
vote
1
answer
826
views
Captive portal (Wifi) remembers me even if I change my MAC address
On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my ...
- 11
3
votes
1
answer
3k
views
WPA2-EAP and Captive Portal
Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time?
Is there any EAP supporting Captive Portal?
For example - user connects to WiFi, goes to Captive Portal over unsecure ...
- 73
2
votes
2
answers
1k
views
Change device MAC address to router's MAC address
This is in respect to bypassing Captive Portals. I haven't tried it yet on a captive portal yet. But I was wondering, what will happen if :
I connect to a wireless network
Get the router's MAC ...
- 191
3
votes
3
answers
2k
views
Enterprise HTTPS redirection without certificate error
I have a captive portal setup for my organization that forces users to authentication prior to being allowed access to the network. Challenge is that when a user opens their browser and their homepage ...
- 31
4
votes
2
answers
691
views
Httpclient redirect in coffee shops
In some coffee shops that offer free WiFi (for instance Starbucks), I have noticed that attempting to use HTTP or HTTPS fails unless you accept a notification (on Windows at least) which looks ...
- 503
20
votes
4
answers
5k
views
Is HTTPS secure over public Wi-Fi with an expired certificate?
I am staying at a hotel with free public Wi-Fi. To get Internet access I had to visit a web page and agree to the terms and conditions. This website has a security certificate, but it expired over a ...
- 393
4
votes
1
answer
2k
views
How does Karma's open WiFi network successfully protect its users?
Foreword
This question has a lot of build-up, so please scroll down to the bottom if you just want to see the question. Please at least skim the background info, though.
Background
I ordered a ...
- 618
5
votes
2
answers
546
views
How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?
I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
- 50k
2
votes
1
answer
1k
views
Using dnscrypt on a public hotspot with a captive portal
What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal?
Such hotspots require DNS settings to point to their servers (via DHCP) so ...
- 9,131
4
votes
2
answers
1k
views
Public AP: How to reduce vulnerability window between Captive Portal and starting VPN?
I always use a VPN on my Mac when I access over public APs (such as coffee shop free WiFi)
How much should I worry about the window of time where I am in the captive portal (the agreement screen) and ...
- 43
5
votes
2
answers
933
views
If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?
There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e....
- 2,051
5
votes
2
answers
3k
views
HTTPS in captive portals and the Apple Captive Network Assistant
Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
- 1,170
11
votes
1
answer
4k
views
Distinguish between Wi-Fi Captive portal and MitM attack
Not sure whether this should be asked in Super User or here.
How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS?
Are ...
- 2,208
-1
votes
2
answers
1k
views
Is there any reason that captive portal server can't block the ICMP echo request/reply packet
We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an ...
- 11
3
votes
1
answer
3k
views
How are Captive Wifi Portals secured?
I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC)
Is there a reliable ...
- 50k
4
votes
1
answer
891
views
Can a captive portal be secured [closed]
I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
5
votes
2
answers
6k
views
How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
I visit the airport, I pull out my laptop and connect to a network (no password needed).
I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
- 51
3
votes
1
answer
687
views
captive portal wikipedia article
Something on the wikipedia page regarding captive portals have confused me:
http://en.wikipedia.org/wiki/Captive_portal
When a client requests a website, DNS is queried by the browser. The
...
- 161
1
vote
1
answer
1k
views
Designing and managing a captive portal
I'd like to learn more about how a captive portal works, especially the management system regarding usage, security monitoring, billing, security architecture etc.
Does anybody know any good ...
- 161
8
votes
1
answer
18k
views
Bypassing a captive portal with tor
I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules.
What I have found recently is that simply by using Tor, I can also bypass a ...
- 3,476