Hackszine.com: Free airport WiFi

Free airport WiFi

Most solutions for getting around the captive portals used in $7 airport wireless services involve sniffing the network and spoofing authenticated MAC addresses. I stumbled across an old post from 2006 by Felix Geisendörfer who discovered that some of these proxy systems are set up to allow pictures through before payment.

Presumably this is to allow external custom imagery and analytics tracking bugs to be accessed during the sign-in process. The funny thing is that the proxy allows files through based on a string comparison on the requested URL, and it's easily fooled.

Without any hope of success I typed http://www.google.com/.jpg into my browser's adress bar, and to my big surprise I saw the page you see when you follow the link right now. The next thing I typed in was: http://www.google.com/?.jpg but that didn't work. But I went on, and found that url's like http://www.google.com/search?.jpg worked like a charm. I found that I could easily visit sites like slashdot, google, or even this weblog, when adding a ?.jpg at the end of the url. The next logical step was to automate that. I downloaded greasemonkey.xpi?.jpg (*g*) and wrote a 4 line js script that would add ?.jpg to every link in a document. That way I was able to browse most sites without a hassle.

I wonder how prolific this loophole is. Next time you're in an airport (or a hotel), give it a shot and let us know how it works for you.

Hacking a commercial airport WLAN

Posted by Jason Striegel | Aug 16, 2008 09:29 PM
Travel, Wireless | Permalink | Comments (4)

Comments

Newest comments listed first.

Posted by: William Cox on August 19, 2008 at 9:55 AM

For the greasemoneky noobs out there, a version of that JS script would be helpful. Thanks.

Posted by: John Kolbert on August 21, 2008 at 8:12 PM

Try This

Try this script I just made quick:

http://simply-basic.com/posts/1941387

Posted by: Frequent Flier on August 29, 2008 at 9:46 PM

Didn't work

I flew through a few airports today, most notably Detroit and this didn't work.

Posted by: aloishis on November 24, 2008 at 9:27 PM

alternetive

The other good way to do this is to fire up Cain and sniff for computers on the network. Then find one that is moving a lot of packets and spoof his MAC address. This usually works. A lot of airports add your MAC address to the allow list once you have paid, so simply pretending to be someone who has paid will let you on. It only requires 2 programs and both are free.