Hack Captive Portals (Hotel & Airport Networks)

This lecture shows how to gain access to captive portals, these are networks similar airport and hotel networks where you connect to an open network, but you won't be able to access the internet without a username and password.
This video is part of my full course on advanced network hacking, checkout the following link for more info and to get a nice discount on the course:
zsecurity.org/...
---------------------------------------------------------------
✳️ Subscribe and use this link to opt-in to the course giveaway 👇
forms.gle/987V...
---------------------------------------------------------------
🧠 My hacking courses 👇
zsecurity.org/...
---------------------------------------------------------------
Website - zsecurity.org/
Facebook - / zsecurity-145325078145...
Twitter - / _zsecurity_
Instagram - / zsecurity_org
Linkedin - / zsecurity-org
---------------------------------------------------------------
⚠️ This video is made for educational purposes only, we only test devices and systems that we own or have permission to test, you should not test the security of devices that you do not own or do not have permission to test. ⚠️

[@fyodor8008]

----VIDEO ANALYSIS---- Hello zSecurity! I'm a longtime watcher, first time commenter, and amateur pen-tester. I feel I've got some contributions to make: So I've got a few key takeaways from your video. 1. First of all, the password intercept method using wireshark only works if the login is sent over HTTP (non-encrypted plaintext) which is an obsolete protocol though still widely used. In fact, your windows (victim machine) even gave you a message at about 7:08 that a password sent over that could be compromised. 2. Deauth attacks work great, but in order to perform a deauth you need a few things. I really wish you took the time to show them in your video because repetition is key to learning. First of all you need a NIC which can go into monitor mode. This is where a phone will not be able to do this unless it is rooted. Also, you need to ensure that the network you're deauthing has a client to deauth. This is where often times you're stopped because the network doesn't disclose the clients that are on it. I don't know how that works and would like some explanation: sometimes my scripts have no problem finding clients, especially once I'm already authenticated into the captive portal, but other times the only client i can find besides myself is the gateway. All this is to ask, is there some kind of defense tactic against this deauth attack which prevents you from seeing clients? How would such a thing be bypassed in theory? Oh, also I use the WiFite script you've discussed in your other videos to perform deauths, so I should probably look up how to do this manually. I would suppose that would be my next step. 3. You only cover the more basic ways to exploit a captive portal. I'm sure these types of attacks work in MOST cases, but a more in-depth guide on how to take advantage of captive portals can be found here: kzbin.info/www/bejne/fZm4hq19d8-bjrM but do be advised the techniques shown in that video rely on you setting up a server PREVIOUSLY to performing the attack. It does fancy stuff like hijacking ad traffic ports/connections and getting your internet through those, as well as other fun techniques. 4. The most trivial way as far as I know to trick a captive portal is to MAC spoof. It should be mentioned that an unrooted Android and an IPhone simply cannot do this, and this is by design. You briefly mentioned this. It's easy, you can use a large amount of various utilities to spoof the mac, my personal favorite being the GNU macchanger which I actually wrote a script for, but it can be done with other commands like ip as well. However, I still have not figured out how to effectively MAC spoof without keeping the first half (the vendor bits) intact. Any help here would be appreciated, because if i try to spoof my MAC to something that isn't the same equipment manufacturer as my NIC, I cannot connect to anything at all. Is there some reason this is happening, or some option in macchanger to stop this? If you could, please make a video covering MAC spoofing in depth; there's a lack of them on KZbin. I loved your video, and your other videos. Please read my comments as an attempt to constructively contribute. If I am wrong, let me know where. I am learning just like everyone here.

[@AkbarBashashaik2762]

Awesome zaid bhai. U r best instructor ever I seen on Udemy. Nice presentation of classes and direct to the point of subject. U helped me alot. God bless you. Keep it up.

[@djohnson4465]

dude im surprise this video only got 9k views and 189 thumbs up... you actually explain everything very well good job... great vid

[@plzzz]

A quick look at the log-in page source code, to check what is the value of the form label will minimize the guess work when going through the airport as well.

[@aniketsrivastav4953]

Am currently enrolled in ur Udemy class u r A great teacher. Thanks for having KZbin channel.

[@hemaw5933]

same same

[@d0ne91]

Very clear and well explained. I already used this technique . I spoofed the mac address and once I have reloaded the connection page, I was connected as the user I spoofed. #magical :)

[@mikemar3751]

hi please how did you do it because if I run airodump-ng their is no notting showing that someone is connected

[@JNET_Reloaded]

I want to learn how to make a captive portal in linux, can you cover how you did yours?

[@naeem8434]

Amazing video sir

[@henrysawyerr2889]

Awsome this is awstruck brilliance i believe this come not but by burning the midnight lamp.

[@markbriones8567]

best teacher ive'd saw

[@muhammadnajamulislam2823]

Brother keep it up plz need more videos god bless you...

[@gokufpv3545]

Nicely explained thanks bro now i can enjoy with my free hotel wifi 😉

[@jeanhyblanchet294]

Best teacher,please I Want to know how to solve mac address issues

[@anwarahmed5342]

can you tell us where are you from Ziad and where can we find and apply to your valuable lessons please?

[@prasannashetty8873]

He is also Available in Hackthetech.org

[@prasannashetty8873]

Hackthetech.org

[@Omarilzz]

That's sweet Learned much

[@muhammadnajamulislam2823]

MashaAllah zaid brother u r great .......

[@krisdouglas6536]

Would you run the deauth before scanning or while for say a couple of minutes ?

[@marcel_25]

where is the video that explains the MAC address method?

[@ahabwestephen900]

Brilliant , thanks

[@Code-Matters]

dear sir please explain about Meltdown and Spectre Vulnerability

[@apdayn]

Really really so nice thanks you so much bro

[@user-eq1er5lh3d]

U r a real PRO!!!

[@everythingfootballpro3017]

does anyone see" hidden network" on their network range ?

[@robinsaifullah6692]

Awesome content! Thank you!

[@krisdouglas6536]

Hi great stuff thanks. I’m not too familiar with wireshark, is there a way to set 2 filters? As in http & post ? One other thing, would it be easier to use tshark? Not that I’ve used that either I’m just meaning in terms of filtering written data. Thanks again

[@projectx1766]

Nice tutorial man

[@innocentokon5884]

Hello Z Security, is it possible to bypass a Captive portal that only has Ports 80 HTTP and 443 HTTPS(SSL) OPEN?

[@ordinaryraw542]

NO WAY U ARE SO GREAT!!!!

[@liam1732]

Question Zaid, if you’re sniffing the packets of an unprotected network that has a captive portal, can say a cyber security manager see you’re sniffing the packets of their network?

[@PyPylia]

no he cant

[@samyu9791]

What portable wireless card u using? Is it ok to use the built in wireless card with the kali

[@shibin7761]

no u need wireless adapter for it

[@itzdcx7991]

So basically run a command program that monitors data coming in and out of the access-point Then disconnect the target wait for target to input the password again And that’s how you’ll get the password 😑man this is gonna take awhile 😂

[@sharukahmed5894]

I am not getting wlan0 . Am getting only eth0 and lo... wen i run ifconfig on my terminal

[@fokkedeboer2342]

you need another network adapter

[@sin3556]

In many of yours videos that I have watched U use different command prompt. Are those things possible with normal command prompt or we need to install kali linux for those these actions?

[@zSecurity]

You just need to install the applications I use.

[@innocentokon5884]

@@zSecurity Hello Z Security, is it possible to bypass a Captive portal that only has Ports 80 HTTP and 443 HTTPS(SSL) OPEN?

[@ralphjhunteves7935]

Sir is root@kali downloadable in windows 10?

[@urdustoriespoetrycollectio976]

Hello. I want to learn Ethical hacking. Zaid demo inspired me. But i don't know from where to begin. can help me the way what should learn the first and what after it. Please

[@jpakash1999]

Muhammad Irfan see his course in udemy he takes u from beginning in d best wat

[@jimikalby3109]

Thank's

[@Abhishek-gt7xt]

Sir can u teach me how to trace the person from the mobile number...

[@jokerr2230]

yeah bro keep it up

[@mediacoregroupph]

Does this work against AP Client Isolation?

[@sharukahmed5894]

What to do if i have wlan0 as well as well as wlan1 ...

[@jimikailby7902]

Nice

[@jeanhyblanchet294]

please I am asking about ifconfig i tried to use it with cmd and command prompt administrator its no working

[@Life-of-Geet]

In windows it's ipconfig nd not ifconfig also syntax is different

[@TechOutAdam]

God I loathe the “blackout period” public wifis use.

[@dustydee8342]

On Android I use psiphon VPN works as well

[@itzdcx7991]

Thanosbus69 yeah it works also X-VPN I’m trying to get these VPN to work on my PS4

[@himeshsingh9179]

I'm unable to deauth any network and getting message such as "No such BSSID available." Pls help !!

[@meh5812]

you have to set the channel of wlan0 to the routers example: channel of the router is 6 type: aitmon-ng start wlan0 6

[@earthwormjxm]

I still don't know how to get them transferred to the fake login page...

[@kidshappytime6431]

عاشت ايدك

[@chrisochuko]

Please how can i create a captive portal?

[@prasannashetty8873]

If WIFi is Enable with mac Filtering. Is there a way to connect ?

[@RakshithPrakash]

yeah firgure out the mac of any device in the white list and change your mac to that

[@Aladeen500]

you forgot about sql injection technique

[@techtupi]

What if the login page of the hotel's wifi is secured with SSL / HTTPS? Then can we see their login credentials too?

[@harblot]

1. mac spoofing

[@mikemar3751]

please how do you crack WPA2 without wordlist and get the right password

[@bapschannel5408]

Not working Monitor mod is not on please check

[@TechBuff]

Where is white list filtering video?

[@just_curi0us]

use KEEP SOLID VPN!

[@mohdmubashirahmed9817]

Munashir

[@rashie]

👍👍

[@padalavamsiujpnquxgri3475]

How to hack captive portals that asks mobile number and OTP to get connected? please send me the answer

[@AlkQubit]

Every single captive portal I've ever seen uses https

[@michaelkgrantj]

You lost me at mac address.

[@maroctaker2283]

who use today still http for login?

[@zSecurity]

Most captive portals!

[@maroctaker2283]

awsome

[@mohammedburhaan4572]

Zaid i desperately want your help... I just want to know which Alfa Adapter is better AWUS036NHA OR AWUS036NEH... PLEASE HELP ME OUT

[@udemyinstructor6057]

kzbin.info/www/bejne/Zp3Ug41pgryDjrs

[@swettyspaghtti]

Who the fuck goes to Bing!?

[@omegapsiphi1911]

Just for reference lol This shyt can land you in jail if you are not careful. I'd go for a less invasive technique if possible. To many FREE wifi spots out there to go and risk going to jail over for free wifi!

[@sinatraa1043]

WingChun Dallas nope you cant go to jail for changing your MAC address that’s not how the legal system works. What laws did u break?

[@omegapsiphi1911]

@@sinatraa1043 LoL 10Grand, You're right, You CAN'T go to jail for simply changing your MAC Address. The problem comes into hand when you start actively "attacking" or connecting to a network, 1: which you do NOT have explicit permission to connect to. And yes, even though it's an "Unsecure" Network the laws still apply, 2: you're performing, albeit small, still it's a low-level DoS attack. Because you will actively DoS that MAC Address that you're spoofing. So whenever you ACTIVELY interface with a Network, that's when problems can occur. Hey if you want to teeter totter with the law, be my guest! And probably the majority of people don't even know how to change their MAC Address....ifconfig wlan0 down macchanger -m wlan0, ifconfig wlan0 up, ain't enough.........

[@Wizardof]

Anyone know any new tricks to bypass these stupid things? I've tried adding .jpg etc at the end. Amazonws, Akami Technologies, and Google Analytics come right thru them in TCPView!! Blech!!!!

[@WilliamHenry-nt2ko]

I want you to teach me how to hack Facebook or Instagram

[@mrtinperico]

Awesome content! Thank you!