Original subtitles

Now I have my fake access point already running like I showed you before.

And as you seen in the previous lecture the access point works.

People can connect to it and when they go to any Web site they'll be redirected to my logon page which

is great.

One thing that I wasn't very happy with is the fact that when people connect to this fake access point

they want to see the logon screen automatically.

They literally have to go open their browser and browse for something.

And this is not the exact behavior that you would get when you connect to a captive portal because usually

when you connect to it you see the logon page automatically display to you.

So that's what I'm going to try to achieve in this lecture.

And we basically have all the hard work done already we have our web server working.

We have our access point working.

We have our DNS server automatically redirect and all our requests to my fake logon page.

The only reason why it's not working right now is because some of the requests sent by Windows.

So by the by the system that the target is using are not being handled properly.

And what I mean by that is when when someone first connects to a captive foretold the system will send

requests to a certain server dependent on the system whether it runs on Windows whether it runs on Linux

Mac or else whether it's an iPhone or a smartphone they'll send a request to a certain server if they

get the response that they expect they'll think that this is a normal network and they'll just not do

anything if they don't get the request that they expect they'll think that this is a captive portal

and they'll show the captive portal logon page.

Now in my example I'm already redirecting requests to my Web site so there might be there has to be

something happening at the background that the request sent by the system by Windows.

In my case are not being handled properly and after investigation I discovered that the quests sent

to w w w dot web websites have to be redirected to just the domain name.

So whenever the windows for example requests requests w w w dot Microsoft dot com it should be handled

as Microsoft dot com instead.

Now to achieve this is very easy.

We just have to modify the configuration of our web server which is Apache.

So to do that we're going to use Lyford which is just a text editor and the configuration file for Apache

is stored in Iti see Apache sites enabled and 000 default dot com.

So we haven't done anything complicated so far we're doing leafnode which is a text editor and we're

trying to open this file which is the configuration file for Apache.

I'm going to hit enter and you should get something like this because this is the default file.

It's not modified a tall now in this file we need to add rules to redirect any request to w w w dot

something that whatever to just the domain name without the w w w.

So literally just delete the W W W from the request to do that we have to use.

Rewrite rules.

And first of all before we can actually put your right rules we have to put them inside a directory

tag.

So I'm going to open a tag and type directory and you're going to have to put the location where your

web site is stored and my website is stored inverted W W W D M L and I'm just going to close the directory

tag as well so I don't forget that.

So it's similar to write an HMO code and inside this directory we're going to add the rewrite rules

that would redirect any request for w w w dot something dot com to the same request without the w w

w dot at the start again like I said you were going to use rewrite rules and I already have them in

here and I'm going to include them in the resources of this lecture.

Now I'm not going to dive too deep about what these rules do.

Basically we have to first enable the rewrite engine which basically enables the rewrite rules then

we specify the rewrite base which is the route the webroot and then we have the condition.

So this condition works based on rejects so it uses rejects and if you have any programming experience

you probably have used projects before projects is a big topic so I'm not going to be covering it.

But basically what it does is it matches whenever it sees a w w w dot and it ignores whatever that comes

after the red dot and it's going to rewrite it as whatever that came after the WW dot without the WW.

Whenever a request comes to us with a W W W at the start it's going to match this condition right here.

And then it goes.

It's going to be replaced with the normal website so hasty T.P. followed by the website itself without

the w w w.

So I'm going to copy all of this

and I'm going to paste it in here.

Inside the directory field.

And just so that it looks nicer.

I'm just going to tab it

so that it just follows the syntax that's used in the file.

Now all we did is we added a directory we specified the location where we have our files stored in the

web server and we added the rewrite rules that redirect any requests for a w w w w website to the same

website without the w w w.

I'm going to save this.

Quit it and then I'm just going to restate I restart my web server so we're going to do service Apache

to restart.

And now let's go and try to connect to our website.

So I'm going to close this

I'm gonna go here.

Disconnect and now that I'm disconnected I'm going to connect again.

And as you can see now we made progress.

The browser got automatically opened for us it's automatically trying to go somewhere but the problem

is we're getting an not found message so this message is actually coming from my own web server so I'm

being redirected to my web server.

But if you look at the your L here closely.

You'll see that it's trying to go to some location on go that Microsoft dot com.

So we have a DNS server running and that's redirecting any request to our Web site.

So if you actually just go to Godas Microsoft dot com.

So I'm going to open this in a different tab.

You'll see that will get redirected to our page which is cool which is perfect.

The problem here is automatically Windows is Odan all of this after the domain name and that's why we

get an A not found error because on our web server we don't have such files or directories so we need

to configure our web server again so that the not found error gets redirected to the home page to the

end.

In here again now we're going to go to college.

We're going to open my web server configuration our sites enable 000 default dot com.

Same file and in here I'm going to configure on my web server so that if a file is not found it will

redirect the person to the home page where the fake logon page is installed.

To do that all we have to do is just say error document for all 4 so whenever you get a 4 or 4 which

is not found error go to the webroot.

Go to the base of the web server.

So we're adding just one.

Just literally one line and we're just saying error document and that's what Apache uses to handle errors

and we're saying if you get a forum for error then just go to the webroot Now this will actually work.

I've obviously tested it before and it will work with Windows OS X and all that but to get it to work

with smartphones and specifically iPhones we actually need to also add a rewrite rule that'll redirect

anything that is not found to the home directory.

So this is the rewrite rule that will do that.

Again I'm just going to copy it and place it in here inside the directory.

And I'm just going to tab it again just so that it follows the syntax.

And this rewrite rule as you can see first we have the conditions in here.

So if the requested file name is not found it's going to redirect that request to the webroot in here.

So we added two lines.

Now we added the first line in here it works for pretty much everything.

And it just redirects any four or four not found error to the webroot.

And we also added a rewrite rule that will do the same just to make sure that this will also work against

smartphone's I'm going to save this.

Quit it.

Again restart my apache and let's go back to the Windows machine.

I'm going to close this

disconnect from the network

and connect again.

And let's see what happens.

And perfect as you can see now as soon as we connected the logon page got this play to us.

So as you can see even though there is stuff come in after the domain name we have a working logon page

where we can go and log into our service and then the hacker or US will be able to sniff the password.

You can also see here on top.

This was never displayed to us before.

So you can see Firefox is automatically detecting that this is a captive portal and stillness that we

must log into this network to access the Internet.

And again it's given it's given us a button here that we can click to Lagann which will again take us

to the log in page.

So now our fake access point looks and behaves exactly like a proper captive portal.

So when people connect to it whether they're on phones or computers they'll automatically see a log

in page they'll see the bar here on top which looks legit.

And it literally just asks people to log in so that they can get to the Internet.

Now we still have the hate as TSA issue.

So if I go to Facebook dot com you can see that the page won't be displayed saying that the secure connection

failed but you can see we still have the bar in here telling us that we need to log in to get the internet

connection so people won't get very suspicious because they can see that they need to log in to get

their Internet.

But I'm also going to address this issue and I'm going to show you in the next lecture how to fix this

and make it look 100 percent like a proper legitimate captive portal.