# Attacking Captive Portals

> Bypass captive portal restrictions via DNS/ICMP/MAC side channels, and harvest credentials with a cloned rogue portal.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/attacking-captive-portals
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 1.5
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

Captive portals gate access to a network (hotels, airports, guest Wi-Fi) behind a login or terms page enforced at the gateway. PEN-210 covers both sides of attacking them: bypassing the portal to get free network access, and running a fake portal to harvest the credentials users type into it. Both exploit weak enforcement, portals that filter by MAC/IP and leave side channels open, and users conditioned to enter credentials into any login page that looks official.

## Bypassing Captive Portals

Portals often enforce only HTTP redirection while leaving other protocols open. Testing DNS tunneling, ICMP/UDP egress, MAC address spoofing (cloning an already-authenticated client), and allowed-domain/HTTPS gaps reveals a bypass that grants connectivity without authenticating. A methodical check of each channel documents exactly which control fails.

## Captive Portal Credential Harvesting

On the offensive side, a rogue AP with a cloned captive portal harvests credentials: dnsmasq redirects DNS, Apache serves a convincing portal page, and nftables forces HTTP traffic to it. Making the portal look legitimate, monitoring captured credentials, and cleaning up the firewall rules afterward complete the attack.

## Study material

- [Detecting Captive Portal Bypass Opportunities](https://hackindex.io/platforms/wireless/vulnerability-discovery/detecting-captive-portal-bypass-opportunities.md) (read, core)
- [Captive Portal Credential Harvesting](https://hackindex.io/platforms/wireless/exploitation/captive-portal-credential-harvesting.md) (read, core)