Original subtitles

So far we've seen a number of methods to gain access to captive photos.

Now let's say your target network was use in encryption or for any other reason you just couldn't gain

your access to the network using the methods I showed you.

Then the last resort is to target the users and use social engineering to gain your access to the network.

Now this is usually the case when we failed to hack into the system using the software and the hardware

installed.

Then the last resort will be to try to target the users because the users are are always considered

to be the weakest link.

So you can always social engineer them and gain your access by targeting the users that use the target

system.

So the idea that I'm going to talk about can be used to gain access to captive portals but it can also

be used to gain access to all types of other networks like networks that use WEP WPA or WPA too.

So the idea is very simple.

First of all we're going to clone the logon page that people are used to use with the normal captive

portal with the normal network that they use.

We're going to make a web site that look exactly like the website that they use when they first connect

to that network.

Then we're going to create a fake network an access point that has the same name or a similar name to

the target.

Now because our target is a captive foretold then this won't be suspicious at all because people captive

portals are usually used in airports and hotels and places that have a large area.

So they actually use a number of routers to cover this area.

Therefore if the user sees a number of networks with the same name or with a similar name they won't

get suspicious at all because this is actually the way it is in real life.

Finally we're going to run a different location at Target and disconnect users from the network that

they're connected to.

So they'll think that there's something wrong with this specific network.

They're going to connect to the fake network that we created which has a very similar name or maybe

the same name.

And once they connect they'll automatically see a logon page.

Again this is exactly what happens when they connect to their network so they automatically see a logon

page and logon page is going to look very similar to the logon page that they usually use and log in

with.

Now obviously the slogan page that we're going to create will not have any type of security and we'll

be able to sniff the data once they put their username or password and then we'll be able to log in

to the actual network that we're targeting.

Now I'm going to spend a lecture or two on each of these steps and I'm going to try to keep these steps

as generic as possible so that you can use this idea to adapt it to any type of network that you have.

So the next lectures we're going to be doing the example on a captive portal but you can use the exact

same way to gain access to Web and WPA to networks.

And later on I'm going to show you how you can adapt this idea to heart into WPA WPA to networks without

having to use a wordlist and without even having to capture the handshake.

So I'm just going to go over the idea one more time just to make it just so that you get the idea.

So first of all we are going to download and clone the logon page that the captive portal usually use

then we're going to create a fake access point that has the same or a similar name to that network.

Then we're going to disconnect the authenticate all the people that connect to that network and wait

for them to connect to our network.

Once they do that they'll automatically see a log in page with the same logon page that the actual network

news.

So this won't be suspicious at all because like I said they're used to connect.

They're used to seeing a number of access points with the same name.

And when they connect this is the actual procedure that they see they'll automatically see a log in

page and log and Page is going to look exactly like the page that they expect.

So it's not going to be suspicious at all and it usually has a very good success rate.