Building the Captive Portal
In this scenario, our target does not have an existing captive portal,
so our next step will be to create one that seems authentic.
We can help avoid suspicion, by using branding and images
that are recognizable and familiar to users.
We’ll also use PHP scripts to save user entered credentials,
and then redirect the user to a success or failure page.
For this scenario, Apache and PHP need to be installed.
Since we are targeting an encrypted network instead of an existing captive
portal, we will be creating the portal from scratch,
using the megacorpone website as a base for the design.
Let’s download the index page, along with all its resources, using wget.
We will be using recursive mode with -r,
and go two levels deep, as the background picture is referenced in a CSS file,
which is itself referenced in the index page.
Although wget downloads files in the current directory,
in this case, it created a directory named after the domain
we are recursively downloading resources from.
Now let’s make a directory under our web root for the portal,
and create our captive portal login page.
Our design will be relatively simple.
We will replicate the styling of MegaCorp One’s homepage,
along with a password field and a “Connect” button.
In addition to being a login page,
the PHP code will also indicate if the credentials are successful,
or incorrect.
In the latter case
a message will appear above the credentials text box to indicate failure.
This text box remains hidden if successful creditials are entered.
We will also need to copy the assets
and old-site directories to the portal sub-directory.
These directories contain the CSS and the background image.
The login page form goes to login_check.php,
which we will use to verify the credentials by cracking the handshake.
Although our login check script may look intimidating at first, it is rather simple
First it checks whether the supplied password has already been stored
as a valid password in passphrase.txt.
If so, we simply return a SUCCESS value to the login page.
If the password is not found in that file, we write it to a wordlist file,
which is then passed to the aircrack-ng command
along with our previously captured handshake file.
We then run the aircrack command and parse its output
to determine if the provided password is valid.
Now that we’ve built our captive portal, we’ll move on to networking.