0

We are trying to host a static webpage (just one index.php) on a local wifi network without internet access. Essentially every user (mobile devices) should land on some landing page where he can upload some files to our server.

We have tried two approaches:

1.) We have set up a captive portal by responding to /generate_204 with http code 302. On Android this triggers the "Sign into wifi" popup and opens up a kind of dummy browser (the usual one for captive portals), unfortunately this browser does not support file upload (<input type="file">). Is there the possibility to escape (for example via a link) from the dummy browser to the default browser? Is it possible to upload files in the dummy browser?

2.) Responding all client dns requets with the server's ip. In this case any url should be redirected to our webserver. This is configured with dnsmasq via address=/#/192.168.1.1. When entering a website via http the user is correctly redirected. In the case of https this does not work, maybe because of HSTS (?). In most browsers url's entered without www are queried as search results and therefore automatically transmitted as a https request. Here the question would be how to successfully redirect https requests to our webserver?

In general we just want an easy method, so that every user ends up on our webpage to upload there files without having to type anything explicitly.

Setup:
DNS and DHCP sever is dnsmasq
WebServer is apache2 listening on 80 and 443

  • You said https doesn't work but you didn't say what is happening. I assume the problem here is the end user is getting an error for the SSL certificate. No, you can't work around this, you cannot intercept a query for www.google.com and redirect it elsewhere without a big warning showing up for the user. That's kind of the entire point of HTTPS. This is a classic man-in-the-middle attack. – yoonix May 3 '18 at 19:51
  • @yoonix We are already intercepting the dns request and so no certificates are exchanged at this time. We get the following error if we open a https website: ` Error code: SSL_ERROR_RX_RECORD_TOO_LONG`. If it would be a man-in-the-middle attack then the user usually has the option to make an exception (something along the lines "I know the risk"), but we are not even there yet. – rex123 May 3 '18 at 20:10
  • That sounds like Apache misconfiguration. You should be looking in the logs (error and otherwise) to try and pinpoint where the issue is. I'd look at your SSL configuration. – yoonix May 3 '18 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.