Try using voip hopper it allows you to hope between VLANs. I saw a video from
this years shmoocon.
Sent from my Verizon Wireless BlackBerry
-----Original Message-----
From: "Sergio Castro" <sergio.castro@unicin.net>
Date: Mon, 14 Jul 2008 14:13:58
To: 'Roman Medina-Heigl Hernandez'<roman@rs-labs.com>;
<pen-test@securityfocus.com>
Subject: RE: Wired captive portal pen-test
Hi Roman,
I've done similar voipsec audits at hotels. The hotel is very likely using a
switch-router (and very likely VLANs) so you will not be able to see any
other IPs on the network. What is your sniffer showing?
Another possible attack vector you may use is their IP phones. If the room
has an IP phone, try connecting your laptop to the phone's RJ45 and do a
packet sniff. I've been able to access entire corporate LANs doing this.
- Sergio
-----Mensaje original-----
De: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] En
nombre de Roman Medina-Heigl Hernandez
Enviado el: Lunes, 14 de Julio de 2008 10:42 a.m.
Para: pen-test@securityfocus.com
Asunto: Wired captive portal pen-test
Hello,
I'm looking for information about pen-testing a captive portal commonly used
in hotels. At least here in Spain I've seen that Quadriga
(quadriga.com) commercial solution is commonly used. If I attach a laptop to
the RJ45 of the room (with Quadriga), I receive an IP by DHCP. I can also
ping the gateway. But I cannot see other IPs. I suspect they're using some
kind of L2 filtering (to disable ARP-requests except to the gateway),
perhaps I'm wrong, though. If I start a browser I'm redirected to a captive
portal where I can see my room number in one of the parameters, so (I
think) they are identifying my room by the switch port (I cannot figure
other alternative since my laptop/MAC is not pre-registered so it's unknown
to them).
Any information about these systems and how to pen-test them? Do you know
which kind of security meassures does Quadriga apply in particular or more
technical specs about this kind of systems? Do they use some special network
hardware (hardened switch, etc)? Or are they deployed using common hardware
(Cisco, etc)? Any manuals, tech specs, etc?
Thanks in advance for your responses and have a nice day.
-r
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Top 5 Common Mistakes in
Securing Web Applications
Get 45 Min Video and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------
__________ NOD32 3265 (20080714) Information __________
This message was checked by NOD32 antivirus system.
http://www.eset.com
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Top 5 Common Mistakes in
Securing Web Applications
Get 45 Min Video and PPT Slides
www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------
