Captive portal

Captive portal is a network service that requires a user connecting to the Web to perform some actions to gain access to the Internet . Usually used for charging, subscriber authentication , or advertising . For the first time ^[1] described by experts at Stanford University in 1999 ^[2] .

When you try to access any site from a device whose captive portal does not know the MAC address , the http request is redirected to the portal start page. Technically, a redirect is done either with the help of a distorted response to the DNS request, or by means of a router . As a rule, in response to the initial request, an HTTP response is received with the code 302 , but in 2012 it was suggested to enter code 511 specifically for such cases ^[3] .

Since the captive portal script works correctly only in the browser when accessing a non-https site, most modern client operating systems, after connecting to the network, check for its presence:

• Android , starting with version 4, a few seconds after connecting, it requests from one of Google’s servers a file called generate_204 and, without receiving code 204 in the http response, creates a corresponding notification that, when clicked, opens a captive portal in the browser.
• Windows and Windows Phone use the Network Connectivity Status Indicator service , which requests a file from a Microsoft-owned site, expecting to receive predefined content. In some cases, the site’s IP address returned by the DNS server is checked against the benchmark. When a captive portal is detected in the same way as in Android, a notification is generated for the user ^[4] .
• iOS devices, like Windows, request a file (from one of several hundred ^[5] Apple-owned sites) and compare its contents. If a captive portal is found in a pop-up window, the Captive Network Assistant opens, which is a browser without HTTP cookies .

Many Captive portal systems are vulnerable to mediator attacks ^[6] . There may be problems with redirection of users who connect from devices that do not recognize the captive portal and open sites that force the use of https (for example, with HSTS enabled ). According to Chrome developers, about 5% of SSL / TLS error messages are caused by Captive portals ^[7] .