[Full-disclosure] Captive Portal bypassing

[T Biehn]

There was a tool that would do exactly that, on a long-defunct TOR
hidden service, and it was mentioned in this paper for bypassing
captive portals at airports. The technique, and naturally the tool,
was applicable in most situations involving payment portals.

Unfortunately I don't remember anything about it, except that there
was no win32 port, except a lot of complaining of that fact (replete
with suggestions to use winPCap) and that the tool itself started with
the letter 'p.' It was exactly what you want and worked on unixes /
macosx. Happy googling!


On Dec 10, 2007 12:21 PM, gmaggro <gmaggro at rogers.com> wrote:
> If there were an easy to use (gold standard == nmap) and robust tool
> capable of bypassing all commonly used captive portals, that would make
> for a great 'mischief enabler'.
>
> Some googled links for the lazy lurkers...
> http://en.wikipedia.org/wiki/Captive_portal
> http://www.eusecwest.com/esw06/esw06-blancher.pdf
> http://www.semicomplete.com/blog/2007/Aug/11
>
> Which in turn mentions Kaminksy's (yay Kaminsky!) OzyManDNS via
> http://taint.org/wk/RunningOzyManDNS
> http://www.doxpara.com/ozymandns_src_0.1.tgz
>
> ...and a ton of other searching resulting in alot of reading regarding
> the usual software flaws, poor implementations (did I repeat myself
> there?), etc. I do not see anything that prevents the rolling-up of all
> applicable bypass techniques into a single tool. Preferably one written
> to be as portable as possible.
>
> Is anyone actively working on this that would care to share? Anyone want
> to point out flaws in the idea or make suggestions? Might make for a
> good 'con paper & presentation if anyone out there was looking for
> something to do.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>