[Backoff]

Subject: WIFI Captive Portal Vulnerability - 0-day bypass for common WIFIs

The Content:

"Found a logic flaw in the wifi captive portal implementation of very many wifi networks. It’s vulnerable to a MAC-Association bypass and unauthenticated ARP poisoning due to a lack of Client Isolation and DAI

Tactics, Techniques, and Procedures

• Discovery: Internal subnet scan via Nmap revealed persistent unauthenticated IoT devices
  

• Exploit: Performed MAC-spoofing to clone authorized headers.
  
• MITM: Successfully established a full Man-in-the-Middle state using Bettercap. Intercepted unencrypted traffic
  

Impact: Allows for full unauthenticated network egress and sniffing of other client sessions.