All language subtitles for 1. Sniffing Captive Portal Login Information In Monitor Mode

Now in this lecture and the next few lectures I like to spend some time talking about captive portals

and how to bypass them captive portals are becoming very popular these days and they're they're being

used everywhere.

You can see them in colleges offices companies airports hotels and so on.

Usually the way a captive portal works is that it's an open network so you can see it and you can connect

to it without encryption.

And once you connect you'll automatically see a logon page that you have to log in.

So you can access the Internet.

So in hotels sometimes it asks you for the room number.

Sometimes you have to pay to get a certain password.

Sometimes you have to log in with Facebook and so on.

So let me just show you an example of a captive portal real quick right here.

I have one set up here in the office so if I go here I just call that airport hotspot just for an example.

But it's actually not an airport network.

So I'm going to connect to it right now and you'll see automatically I see a logon page that will ask

me to enter a password to access the Internet.

Now if you're connecting through a phone you'll see this as well if you're connecting through OSX or

Linux you'll see it you'll still see this and you can see at the top of the bar is telling me that I

need to log in to access the Internet.

So if I try to go to anything if I try to go to blink for example you'll see I'll still be redirected

to the hotspot loggin as you can see the Logan is done through a Web site through a web interface and

even on phones on Mac OS X. you'll see a pop up window shows up but this popup window is just a web

browser without a navigation bar.

So the data is being sent through a web interface through TTP or TTP as.

So looking at that because the network is open we can think of so many ways to steal the password or

gain access to this network and bypass the logon.

Now a very simple method would be to try and change your MAC address to one of a connected client.

So all you have to do in this case is just open a dump and just look for connected clients in the second

section of the program and then change your MAC address to the MAC address of a connected client using

Mike changer.

Now this process is identical to the process that you follow to bypass whitelist filtering.

And I covered that in the previous lecture.

Therefore I'm not going to cover the first method in here because it's literally going to be exactly

the same method as the one I covered in the Whiteley's filtering what I'm going to show you though I'm

going to show you the three other methods that I think are very very useful.

The first method is going to be sniffing logons in monitor mode now because by definition captive portals

have to be open networks because like I said they're usually used in offices in hotels and so on.

They're usually open and then once you log in they ask you for a username and password.

So this means that we don't even need to connect and we'll be able to capture the data and read it in

plain text unless the data is being sent over TTP as so we can just start with her mode sniff the data

use an air dump and be saved in a file and then read the file and look for a username and password in

Wireshark.

Once someone logs in now you can force someone to log in by running the authentication attack and wait

for them to get disconnected.

Then when they connect again they usually get asked to enter the password again.

So let's see how to do that.

I'm going to go to Cali.

And first of all I already have my wireless adapter connected so if I do ifconfig you can see my wireless

adapter.

Now I'm going to enable monitor mode on it real quick.

We've covered this we've covered how to do that in a number of ways so that's why I'm just going to

do it really quickly.

So I'm going to do if config line zero down then I'm going to do either a blue config line zero mode

monitor and then I'm going to do if config Landseer are up to bring the card up.

Sorry I forgot to put up.

And now it's in monitor mode so if we do w config we can see that the card is in weiter mode so that's

perfect.

Now the next step I'm going to just run down G against all the networks around me.

So I'm just going to do aero dump ngi Lazaro

OK.

Now we have our target.

We can see it right here it's called Airport hotspot.

We can see that it's an open network.

It's on channel 12 and we can see its MAC address.

So as usual we want to run against this specific network.

Again we've done this a lot before so I'm going to do it a bit quickly.

I'm going to copy the MAC address and I'm going to run on punggye.

I'm going to give it the VSS ID.

And the channel which is 12.

And then I'm going to write everything to a file and that's called that file.

Airport because the network is called Airport hotspot.

And finally we'll give the name of our wireless card in monitor mode which is non-zero zero so very

simple commands that we run multiple times.

The first thing we do is we do aero dump and we were given the VSS idea which is the MAC address of

the target network where we give given the channel that the target network is working on and we can

see it working on channel 12 we're saying right because we want to store all the captured data in a

file and we're calling that file airport.

And finally we have to give the name of the wireless interface in monitor mode.

And in my case it's land zero.

I'm going to hit enter and as you can see now aero dump Angie is working.

And we can see that we have connected the client already.

Now like I said if the client is connected then is using the Internet.

You can just do the authentication attack and get it disconnected for a while.

I'm not going to do that because I don't want to make the lecture too long we've already covered that.

So we're just going to assume that we did authenticate our target and now our target is going to go

ahead and try to connect again.

So I have my Windows machine here.

I'm going to close this

and I'm actually going to disconnect from the network.

And then I'm going to connect to it again.

Now as you can see we automatically get the log in page again.

We're assuming that the user this specific user already have a password whether they are staying in

this hotel or this airport or whether they actually bought a membership to access the internet to access

this Wi-Fi network.

We don't care.

Now the user is going to enter their password and we're going to assume that it's one two three four

five six.

This is actually a valid password.

We're going to log in and we'll be redirected to Google.

So this user got their Internet access and they're happy they can go and do whatever they want.

Now let's go to the candy machine and see if we capture the password.

I'm going to Control-C out of this and then I'm going to run wireshark so we can just do wireshark in

here.

I'm going to go to file open and open the file that we just captured.

So we called the file airport and we're looking for the cap extension.

So as you can see we have a file here called Airport 0 1 that cab.

I'm going to open it like I said before and you automatically appends minus 0 1 to the name that you

pick.

When you create the file and right here we have all the packets that we captured that were sent to the

target network to the airport network.

Now what we're interested in is the TTP traffic because as we see in the username and password they

are being sent over here TTP so and the filter here I'm just going to type in haste TTP here enter and

wireshark right here is only showing me here TTP packets.

Now log in forums and such forums are usually sent over posts.

So we want to look for a post request here instead of guess.

So I'm going to scroll down until I find a post through question so you can see we have one here.

I'm going to go down and look for the Hastey I'm all for your L encoded and we can see that in here

we actually don't have anything interesting so I'm just going to keep going looking for more posts requests.

I have another one here and this one looks interesting because we can see that there is an operation

called log in and here we can see that the username is set to nothing and we can see the password they

said two one two three four five six.

So that's it.

We have the password now.

We can't just go to the network manager here in Cali connect to the network put the password the same

way that the user put it.

One two three four five six and we'll be able to connect the network and we'll have a proper legitimate

access and a set of change in the MAC address where you might get caught because they'll be two MAC

addresses connected to the same network.