Apple portal弹窗报文分析


1. Portal弹窗是个啥?

简单的说就是当ios或是MacOS连接上需要认证的WiFi的时候系统会弹出一个窗口来进行wifi认证。

TheApple Captive Network Assistant (CNA) feature is an overlay thatappears and prompts users automatically to login to the detectedcaptive portal network without the need to explicitly open a webbrowser. This type of login is useful on mobile devices where many ofthe common applications are not browser-based and these applicationswould otherwise fail to connect without the successful browser-basedauthentication. Examples of these nonbrowser-based applications areemail, social networking applications, corporate VPNs, and mediastreaming.


2. portal弹窗原理是啥?

TheApple operating systems detect the presence of a network that hascaptive portal enabled by attempting to request a web page from theApple public website. This HTTP GET process retrieves a simplesuccess.html file from the Apple web servers and the operating systemuses the successful receipt of this file to assume that it isconnected to an open network without the requirement for captiveportal authentication.


If thesuccess.html file is not received, the operating system converselyassumes that a captive portal is in place and presents the CNAautomatically to prompt the user to perform a web authenticationtask. When the web authentication has completed successfully, the CNAwindow is closed automatically, which prevents the display of anysubsequent welcome pages or redirecting of the user to theirconfigured home page. If the user chooses to cancel the CNA, theWi-Fi connection to the open network is dropped automatically, whichprevents any further interaction via the full browser or otherapplications.

这里提到的webpage就是http://captive.apple.com/hotspot-detect.html

当这个page返回success的时候就不会弹窗。


3. 抓包

抓包环境:MAC-PROwireshakeK2路由器

3.1 没有portal弹窗

配置K2为可以访问http://captive.apple.com/hotspot-detect.html

1.连接上K2无线后系统会自动启动captivenetwork assistant


2.captive networkassistant会发出一个http请求,访问http://captive.apple.com/hotspot-detect.html


3.http://captive.apple.com/hotspot-detect.html返回一个titleSuccess的网页。Ps,这里Success大小写敏感

当收到这个返回后,系统会认为不需要portal弹窗


3.2 portal弹窗

K2恢复出厂设置,然后连接K2wifi

1.连接上K2无线后系统会自动启动captivenetwork assistant(同上)

2. captive networkassistant会发出一个http请求,访问http://captive.apple.com/hotspot-detect.html(同上)

3.路由器将DNS请求劫持到192.168.2.1

4.路由器的web服务器对http请求进行重定向

5. captive networkassistant会显示重定向后p.to返回的信息

效果如下图:

阅读更多
想对作者说点什么?

博主推荐

换一批

没有更多推荐了,返回首页