full-disclosure - Re: Captive Portal bypassing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50594.64.235.44.172.1197311258.squirrel@slashmail.org>
Date: Mon, 10 Dec 2007 13:27:38 -0500 (EST)
From: "Steven Adair" <steven@...urityzone.org>
To: "gmaggro" <gmaggro@...ers.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Captive Portal bypassing

Hi,

I didn't read all of the documents in detail, but I noticed the first
bunch mentioned spoofing/changing your MAC address to that of someone that
is validated/authorized.  This is of course assuming this is feasible and
someone has authenticated already.  Many of the hotspots will just simply
allow both TCP and UDP outbound on Port 53.  I'm not overly familiar with
RunningOzyManDNS - but I think this takes advantage of that to some
degree.

However, I've found that in airports at least, about half of the captive
portals will allow TCP 53 out to anywhere.  Even easier than running a
special tool is to just setup SSHD or a proxy to listen on TCP 53.  You
can then tunnel out and do as you please without authenticating to the
captive portal.  Of course you might want to keep the legal aspects in
mind before doing any of that.

Steven
http://www.securityzone.org

> If there were an easy to use (gold standard == nmap) and robust tool
> capable of bypassing all commonly used captive portals, that would make
> for a great 'mischief enabler'.
>
> Some googled links for the lazy lurkers...
> http://en.wikipedia.org/wiki/Captive_portal
> http://www.eusecwest.com/esw06/esw06-blancher.pdf
> http://www.semicomplete.com/blog/2007/Aug/11
>
> Which in turn mentions Kaminksy's (yay Kaminsky!) OzyManDNS via
> http://taint.org/wk/RunningOzyManDNS
> http://www.doxpara.com/ozymandns_src_0.1.tgz
>
> ...and a ton of other searching resulting in alot of reading regarding
> the usual software flaws, poor implementations (did I repeat myself
> there?), etc. I do not see anything that prevents the rolling-up of all
> applicable bypass techniques into a single tool. Preferably one written
> to be as portable as possible.
>
> Is anyone actively working on this that would care to share? Anyone want
> to point out flaws in the idea or make suggestions? Might make for a
> good 'con paper & presentation if anyone out there was looking for
> something to do.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/