Re: [Full-disclosure] Captive Portal bypassing

2007-12-11 Thread gmaggro
if they've got a whitelist for UDP 53 you can openvpn out nicely. i get hit or miss success with this; most national hotspot services use a DNS proxy for UDP 53 traffic, so you can try OzyManDNS and bask in the gratuitous inefficiency of your side channel transport... :) sadly, ICMP tunnel

Re: [Full-disclosure] Captive Portal bypassing

2007-12-11 Thread coderman
On Dec 11, 2007 6:36 PM, coderman [EMAIL PROTECTED] wrote: [screwed] the IBSS DIFS timeouts like crazy and network == shit er, s/IBSS/802.11 MAC distributed point coordination function/ (i've got ad-hoc on the brain, and the lucent demo mode / no-ack variation works much better for long shot

Re: [Full-disclosure] Captive Portal bypassing

2007-12-11 Thread coderman
On Dec 11, 2007 9:27 AM, gmaggro [EMAIL PROTECTED] wrote: ... what I dislike about some of these techniques... they lack a certain potency. If they reliably achieve their goal they are slow; if they have better throughput then reliability becomes an issue. order of preference: a. UDP 53

[Full-disclosure] Captive Portal bypassing

2007-12-10 Thread gmaggro
If there were an easy to use (gold standard == nmap) and robust tool capable of bypassing all commonly used captive portals, that would make for a great 'mischief enabler'. Some googled links for the lazy lurkers... http://en.wikipedia.org/wiki/Captive_portal

Re: [Full-disclosure] Captive Portal bypassing

2007-12-10 Thread T Biehn
There was a tool that would do exactly that, on a long-defunct TOR hidden service, and it was mentioned in this paper for bypassing captive portals at airports. The technique, and naturally the tool, was applicable in most situations involving payment portals. Unfortunately I don't remember

Re: [Full-disclosure] Captive Portal bypassing

2007-12-10 Thread Steven Adair
Hi, I didn't read all of the documents in detail, but I noticed the first bunch mentioned spoofing/changing your MAC address to that of someone that is validated/authorized. This is of course assuming this is feasible and someone has authenticated already. Many of the hotspots will just simply

Re: [Full-disclosure] Captive Portal bypassing

2007-12-10 Thread gmaggro
Even easier than running a special tool is to just setup SSHD or a proxy to listen on TCP 53. You can then tunnel out and do as you please without authenticating to the captive portal. Not everyone has access to something listening on 53 that is ready to be tunneled to. Nor is everyone

Re: [Full-disclosure] Captive Portal bypassing

2007-12-10 Thread Peter Besenbruch
Of course you might want to keep the legal aspects in mind before doing any of that. On Monday 10 December 2007 12:04:05 gmaggro wrote: Bah. Who cares about that. Our governments have proven they do not respect the rule of law; why should we? Because what you espouse would result in

Re: [Full-disclosure] Captive Portal bypassing

2007-12-10 Thread gmaggro
Because what you espouse would result in general lawlessness, a situation that is worse for the common good than what we have now. That is both an arguable and accurate description of one of my goals. More specifically, the impact on captive portals would be an escalating arms race

Re: [Full-disclosure] Captive Portal bypassing

2007-12-10 Thread coderman
On Dec 10, 2007 2:04 PM, gmaggro [EMAIL PROTECTED] wrote: ... Not everyone has access to something listening on 53 that is ready to be tunneled to. Nor is everyone clever enough to go about doing that sort of thing. if they've got a whitelist for UDP 53 you can openvpn out nicely. i get hit