4 ms·

I feel like this was always the case with hacking someone's wifi router. Just try a few IPs until you got the router admin page, and then the admin/password com

I feel like this was always the case with hacking someone's wifi router. Just try a few IPs until you got the router admin page, and then the admin/password combo.

gerdesj 9y ago
My home AP's admin interfaces are on another VLAN. You'll generally get the PUBLIC VLAN which can only see most of the internet, via a transparent Squid proxy. I also have a THINGS VLAN for well, general IoT stuff and a SEWER VLAN for things that scare me. Those last two have SSL bump enabled. I'm sure everyone has at least 10 802.1Q VLANs defined on their home network.
- jsjohnst 9y ago
  > I'm sure everyone has at least 10 802.1Q VLANs defined on their home network. Please tell me that's sarcastic. :) (that said, I've got 6-7 at least)
- gumby 9y ago
  > I'm sure everyone has at least 10 802.1Q VLANs defined on their home network. I don't know about everyone but I can safely say if they don't then they're certainly no friend of mine. (This could be because other people don't like what happens when my laptop connects to their network and so won't become my friend.)
- deathanatos 9y ago
  Out of curiosity, what hardware/software do you use for an AP? I had a Belkin AP for a while, which was okay, but couldn't do anything fancy, like DD-WRT, and the microwave would knock it offline — even after the microwave was done. (It had to be power cycled.) Today I have the big black Comcast all-in-one AP/router/modem, and it resets the WiFi password (and only the password, not the SSID!) any time it soft or hard resets. > a SEWER VLAN for things that scare me This is an awesome name. > SSL bump This is a MitM of SSL traffic, or something else? (And if the former, requires installation of a CA cert on devices on that VLAN?) (I found the Squid page for it, but wasn't really clear on it even with the docs.)
  - gerdesj 9y ago
    I use Ubiquiti APs - at home I have a UAP-AC-PRO in the house and a UAP-AC-MESH in the garden (reasonably weather proof). SEWER: I came up with the name at work after reading a Register article (probably scraped from HN) about yet another crappy IoT problem. I immediately renamed one of the VLANS there 8) SSL bump is a Squid thing that does MitM for SSL as you found out and yes, you need to get the CA trusted to make it really transparent. Some devices don't bother testing the CA ...
memco 9y ago
On OSX all you have to do is go to the network preferences and it will tell you the router's IP address. I'm sure it's trivially easy to figure this out via the CLI and probably not too hard in Windows either.
- philsnow 9y ago
  It will tell you the IP address of the default route, and most routers have their web interface on the same IP, but there's no magic requirement that says that the two have to be the same.

I feel like this was always the case with hacking someone's wifi router. Just try a few IPs until you got the router admin page, and then the admin/password combo.

gerdesj 9y ago

My home AP's admin interfaces are on another VLAN. You'll generally get the PUBLIC VLAN which can only see most of the internet, via a transparent Squid proxy. I also have a THINGS VLAN for well, general IoT stuff and a SEWER VLAN for things that scare me. Those last two have SSL bump enabled. I'm sure everyone has at least 10 802.1Q VLANs defined on their home network.

jsjohnst 9y ago
> I'm sure everyone has at least 10 802.1Q VLANs defined on their home network. Please tell me that's sarcastic. :) (that said, I've got 6-7 at least)
gumby 9y ago
> I'm sure everyone has at least 10 802.1Q VLANs defined on their home network. I don't know about everyone but I can safely say if they don't then they're certainly no friend of mine. (This could be because other people don't like what happens when my laptop connects to their network and so won't become my friend.)
deathanatos 9y ago
Out of curiosity, what hardware/software do you use for an AP? I had a Belkin AP for a while, which was okay, but couldn't do anything fancy, like DD-WRT, and the microwave would knock it offline — even after the microwave was done. (It had to be power cycled.) Today I have the big black Comcast all-in-one AP/router/modem, and it resets the WiFi password (and only the password, not the SSID!) any time it soft or hard resets. > a SEWER VLAN for things that scare me This is an awesome name. > SSL bump This is a MitM of SSL traffic, or something else? (And if the former, requires installation of a CA cert on devices on that VLAN?) (I found the Squid page for it, but wasn't really clear on it even with the docs.)
- gerdesj 9y ago
  I use Ubiquiti APs - at home I have a UAP-AC-PRO in the house and a UAP-AC-MESH in the garden (reasonably weather proof). SEWER: I came up with the name at work after reading a Register article (probably scraped from HN) about yet another crappy IoT problem. I immediately renamed one of the VLANS there 8) SSL bump is a Squid thing that does MitM for SSL as you found out and yes, you need to get the CA trusted to make it really transparent. Some devices don't bother testing the CA ...

memco 9y ago

On OSX all you have to do is go to the network preferences and it will tell you the router's IP address. I'm sure it's trivially easy to figure this out via the CLI and probably not too hard in Windows either.

philsnow 9y ago
It will tell you the IP address of the default route, and most routers have their web interface on the same IP, but there's no magic requirement that says that the two have to be the same.