Thread: How to bypass captive Portals to get Free Wifi almost everywhere!

Hey guys,

i guess everyone of you knows the situation: youre in your hotel roam abroad, at an airport, at an internet cafe etc.
You log into the local Wifi and open your Browser - After youve entered your favorite Website and press Enter, you are suddenly redirected to a nice screen asking you to pay before you can browse the net.



In this tutorial, I will explain how most of these systems can be bypassed. I can confirm, that this does work as I am using it myself sometimes when I'm travelling. For Example, it worked on all T-Mobile Hotspots Ive been on so far.

Please Note: This is an tutorial for expert users. To make use of this tut, you have to be familiar with Linux and you should have atleast basic Knowledge if the IP address system, DNS name resolution and how the internet works in general.

Now, to get what we want - free Internet of course - we're going to use a protocol tunnel. ( Check Tunneling protocol - Wikipedia, the free encyclopedia if youre not familiar with that ).
This is going to be about tunneling your TCP packets in DNS request, but there are many more possible ways. ( Pingtunnel, RDP tunnel, HTTP, etc ) - The tool to be used is called DNS2TCP.


So what do we need before we can get started?

• a public server, reachable from anywhere with PORT 53 (DNS ) open to the internet - Must run UNIX / Your prefered LINUX distribution
• a domain name or subdomain where have the right to create A & NS records , so practically you must be able to set a NS record for your own zone ( Check Wikipedia for explanation on different DNS record types ). I use FreeDNS.net atm.

For Example: You are running a DNS server on my.home.com, you are then delegating the resolution of names on another subdomain say, dns.home.com to my.home.com.
That means, if someone requested the url test.dns.home.com it will be delegated to your dns server my.home.com which will then encapsulate the packets.


So lets begin!

1. Fire up your shell and install dns2tcp. On my debian server this is done by - "sudo apt-get install dns2tcp"
On other distributions you might have to download the tarball and compile it yourself.

2. Go to ./etc and the edit the /etc/dns2tcpd.conf file:

listen = 0.0.0.0 <- Leave this as it as, the server will listen on all available addresses
port = 53 <- dont change
# If you change this value, also change the USER variable in /etc/default/dns2tcpd
user = nobody
key = 123 <- Enter a password so that not anybody can use your server
chroot = /tmp
domain = my.home.com <- The address of your NS record.
resources = ssh:127.0.0.1:22 , smtp:127.0.0.1:25 <- Specify the resources you want to use inside the dunnel, I suggest staying with SSH and tunneling everything else through it.

3. Start your server.
for Example: dns2tcpd -F -d 5 -f /etc/dns2tcpd.conf
Play around with the command line options to run it in a way that fits for you.

4. Check if its working!
Note: A windows Client for DNS2TCP can be downloaded here : http://azertyfab.free.fr/dns2tcp/
To check what resources are avalaible enter:
dns2tcpc -z my.home.com -k 123 ( Your NS Sever and the key you specified in the conf file )

If youve done everything correctly you should something like this:



5. Now that we have seen that are two resources available, connect to your tunnel:

dns2tcpc -z my.home.com -k 123 -l 8000 -r ssh

It should say listening on Port 8000 now. Now fire up putty and SSH to 127.0.0.1 port 8000 and you should be able to login into the shell of your linux server.

Now you can Tunnel every port or protocol you like through this DNS tunnel.
For example I use it as a socks proxy
You can do so by opening putty, Clicking on [Connections->SSH->Tunnels] , then add a port of your choice and dont forget it to dynamic.

Now you can enter 127.0.0.1 and the specified port from your putty tunnel as a proxy in your Browser and surf the web.

6. Congratulations, you have successfully encapsulated your traffic and are now able to do anything you want on the web without paying for the hotspot. But theres one downside to this: You wont get more than 30kb/s by using this, as the packet size of DNS request is rather limited.

7. So now when you are on a hotspot, how do you find out if it might be vulnerable:
Open your CMD and do a nslookup of any website you know. If it returns the correct ip address then dns tunneling will probably work. But if it returns an ip address inside the local network youre in, youre out of luck. Try Pingtunnel then ;-)

Have fun and if you have any questions, feel free to ask or check this website for another tut: dns2tcp: How to bypass firewalls or captive portals? | /dev/random