PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Guide to Bypassing Hotel Wi-Fi Captive Portals (With Permission)

projectblack.io | blog | #pentesting | #captive-portal | #network-security | #wi-fi-security | #red-team | #wifi-security | #dns-tunneling | #mac-spoofing | #icmp-tunneling
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A hands-on guide to bypassing hotel Wi-Fi captive portals in authorized testing: MAC spoofing and rotation, cloning another device's MAC, and DNS/ICMP tunneling via an external server.
Published
Collected

Related coverage

blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · netspi.com
The value of multi-layer / comprehensive pen testing
A NetSPI consultant argues application security focus has overshadowed broader risks: in 90-95% of their pen tests, weak network and system configurations still enable full environment compromise.
blog · portswigger.net
Burp Suite is on a feature roll!
A month of Burp Suite Pro updates brings a new cross-domain XHR CSRF technique, DNS tunnelling over SOCKS proxy, request body decompression, finer SSL controls, and new Extender APIs.
blog · blog.quarkslab.com
Overview of Passive Optical Networks (PONs) Security
Passive Optical Networks (PONs) connect end-users to infrastructure using optical fibre in the last kilometre (Fibre-to-the-x). This article provides a technical overview of the security features in ITU-T specifications: Gigabit-capable PON (GPON), 10-Gigabit-capable PON (XG-PON), 10-Gigabit-capable Symmetric PON (XGS-PON), Next-generation PON 2 (NG-PON2), and 50-Gigabit-capable PON (50G-PON). The analysis covers authentication schemes, key derivation, encryption methods, and associated security implications.
blog · bishopfox.com
WPA3 Is a Major Missed Opportunity: Here's Why
Dan Petro argues WPA3's Enhanced Open is a missed opportunity: OWE encryption stops passive sniffing but falls to active attacks that impersonate access points.
blog · bishopfox.com
The Rickmote Controller: Hacking One Chromecast at a Time
The Rickmote Controller rickrolls nearby TVs: it briefly knocks Chromecasts off Wi-Fi so they accept commands from anyone nearby, then loops Rick Astley on the hijacked screen.
Back