Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Trying to automate the login on a Captive Portal

Hi there,

So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless Raspberry Pito the network. (I am unable to Run X-Server in this host, neither w3mor elinksdid work on rendering such a portal) Since this is considered "ilegal" by many Network Admins I post it in here , but the purpose is legitimate and it would be nice that all of us share the knowledge.

So I have been learning the protocols behind it, and this Captive Portalmay be of the type Redirect by DNS

I have indexed the landing page of the application form which is https://captiveportal.com/guest/guest_register_3.php?_browser=1

Inspeting the HTML I can see:

1st) The form is of the type POST 2nd) The parameters to be filled are the following ones (according to the rendered HTML) : visitor_name and email Despite this the html form input elements doesn't exactly correspond to the ones that the HTTP request make afterwards. I Can find email But then I find a bunch of them unrelated

```
Unused field

Unused field

Unused field
```

Where in checkbox and submit I recognise their function as well , but the hidden one for example is a mistery to me its function.

Well so the second part of the analisis is to spoof (everything have to sound hackerish haha) my own 'http' traffic while authenticating to it.

With linux ngrepyou can do this like a charm so we can sudo ngrep -W byline -d 'wlp1s0' -t '^(GET|POST) ' 'tcp and port 80' So I go for it and this is what I capture

``` (OUTPUT SIMPLIFIED)

T 2021/09/08 18:16:12.901797 90.80.121.128:58788 -> 20.200.140.191:80 [AP] #54 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f...lO..$.. 6...py8..B4.

T 2021/09/08 18:16:43.733225 90.80.121.128:58824 -> 20.200.140.191:80 [AP] #184 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f....l?....P$........F.. ```

Pretty unintelligible , but been a bit smart and with the index of the page that I already downloaded by

wget \ --recursive \ --no-clobber \ --page-requisites \ --html-extension \ --max-redirect=0 \ --no-check-certificate \ --convert-links \ --restrict-file-names=unix \ -H \ --random-wait \ --limit-rate=200K \ --user-agent=Mozilla \ --level=3 \ https://www.captiveportal.com/guest/guest_register_3.php

An placing that on my own apache2hosted server , then I listen to my own communication by the loopbackdevice sudo ngrep -W byline -d 'lo' -t '^(GET|POST) ' 'tcp and port 80' I can see the POST's bodies of the HTTP communication like

visitor_name=Ferenc+Donest&email=ferensi45donest%40gmail.com&expire_after=168&role_id=2&create_time=2021-09-08+17%3A59%3A34&mac=&remote_addr=100.120.121.128&essid=&apgroup=&apname=&vcname=&auto_update_account=1&creator_accept_terms=1

(the next step cannot replicate it as the next page doesn't load locally , but is just a button to press OK

. I know later on I will be able to create a command with curl(or maybe 2 scripted them) in order to perform this process aut[...]

___________________________
@hacking_Attack
@Hacking_Video

Trying to automate the login on a Captive Portal

Hi there, So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my...

13 viewsedited 21:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice Trying to automate the login on a Captive Portal Hi there, So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless Raspberry Pito the network. (I…

omatically

My main question: It looks like the Real Captive Portal uses some sort of encription . But I believe that is available on the HTML code as the POST needs to be done client side. - Is this Encryption process perform by some of the javascript of this landing page? - Am I wrong about many of this assumptions?

Thanks for your help , I will keep you updated with my advatanges as I still need to inspect the JS code and maybe some more php files (although chances are that those have not been indexed)

submitted by /u/brohermano [link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

12 viewsedited 21:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How to get a reverse shell in my netcat from outside LAN

I am trying to get a reverse shell from outside my LAN on my netcat but I am unable to do so I am on my linux machine and using my laptop for sending a connection request but I am not getting a callback on my linux machine.

So what are the techniques to get shell from outside my network .

submitted by /u/CoolNCocky
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to get a reverse shell in my netcat from outside LAN

I am trying to get a reverse shell from outside my LAN on my netcat but I am unable to do so I am on my linux machine and using my laptop for...

13 viewsedited 21:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Sorry if I'm asking in the wrong subreddit. But if one wasn't using a VPN or anything that would have a proxy how off would an IP be location wise?

I'm really not smart when it comes to this stuff so I apologize if this is not the place to ask but would an IP address show several states away... Several hundred miles... if a VPN was not being used? I know that an IP is not an exact location, and that some apps like Gmail use a proxy but usually if those aren't being used it shows an IP within a close radius of the actual spot. In this case the person I'm looking at is hundreds of miles away. This is a domestic abuse situation so we're trying to determine if the person we're attempting to hide from is on vacation or something

submitted by /u/Drinking-Lightning
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Sorry if I'm asking in the wrong subreddit. But if one wasn't...

I'm really not smart when it comes to this stuff so I apologize if this is not the place to ask but would an IP address show several states...

10 viewsedited 21:08

Hacking Articles Tips Tricks Videos Tutorials

10 views21:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Bridging the gap for the newcomers - gamified experience

Hey Community!

Last week, World Wide Hack by Lotus Innovations has its Kickstarter launched. I had the opportunity to play the alpha versions and I find this game has a great potential, it is very stable and there is a lot more than just "another hacking MMO". I'm myself a propagator of learning cybersecurity on my blog and I have written the first impression here: https://blog.cyberethical.me/world-wide-hack-alpha-first-impression

Gamified experience can be sometimes enough to bridge the gap for people wanting to try offensive security for the first time.

I'm not associated or sponsored by the developers of the WWH, just want to game to get as much exposure as it is possible, without force-advertising.

submitted by /u/Asentinn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bridging the gap for the newcomers - gamified experience

Hey Community! Last week, World Wide Hack by Lotus Innovations has its Kickstarter launched. I had the opportunity to play the alpha versions and...

10 viewsedited 21:09

About

Blog

Apps

Platform