Skip to content
HackIndex.io

OSWP · Module 13

Attacking Captive Portals

Bypass captive portal restrictions via DNS/ICMP/MAC side channels, and harvest credentials with a cloned rogue portal.

~1.5 h 2 resources Last updated September 27, 2026

Captive portals gate access to a network (hotels, airports, guest Wi-Fi) behind a login or terms page enforced at the gateway. PEN-210 covers both sides of attacking them: bypassing the portal to get free network access, and running a fake portal to harvest the credentials users type into it. Both exploit weak enforcement, portals that filter by MAC/IP and leave side channels open, and users conditioned to enter credentials into any login page that looks official.

Bypassing Captive Portals

Portals often enforce only HTTP redirection while leaving other protocols open. Testing DNS tunneling, ICMP/UDP egress, MAC address spoofing (cloning an already-authenticated client), and allowed-domain/HTTPS gaps reveals a bypass that grants connectivity without authenticating. A methodical check of each channel documents exactly which control fails.

Captive Portal Credential Harvesting

On the offensive side, a rogue AP with a cloned captive portal harvests credentials: dnsmasq redirects DNS, Apache serves a convincing portal page, and nftables forces HTTP traffic to it. Making the portal look legitimate, monitoring captured credentials, and cleaning up the firewall rules afterward complete the attack.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.