If there were an easy to use (gold standard == nmap) and robust tool capable of bypassing all commonly used captive portals, that would make for a great 'mischief enabler'.
Some googled links for the lazy lurkers... http://en.wikipedia.org/wiki/Captive_portal http://www.eusecwest.com/esw06/esw06-blancher.pdf http://www.semicomplete.com/blog/2007/Aug/11 Which in turn mentions Kaminksy's (yay Kaminsky!) OzyManDNS via http://taint.org/wk/RunningOzyManDNS http://www.doxpara.com/ozymandns_src_0.1.tgz ...and a ton of other searching resulting in alot of reading regarding the usual software flaws, poor implementations (did I repeat myself there?), etc. I do not see anything that prevents the rolling-up of all applicable bypass techniques into a single tool. Preferably one written to be as portable as possible. Is anyone actively working on this that would care to share? Anyone want to point out flaws in the idea or make suggestions? Might make for a good 'con paper & presentation if anyone out there was looking for something to do. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
