HOTSPOT PAP LOGIN Encrypted

RouterOS General
1

Hello Everyone,

I’ve been working on a method to hide ( from curious eyes ) the information from hotspot in pap method.

So I’d a very simple way to encrypt the username and password.
It looks like this on packet sniffer:




This script goes into the login.html. You just need to call getURL() function after login form:

<script src="aes.js"></script>
<script>
function getURL(){
	function readTextFile(file,encrypted)
	{
		var rawFile = new XMLHttpRequest();
		rawFile.open("GET", file, false);
		rawFile.onreadystatechange = function ()
		{
			if(rawFile.readyState === 4)
			{
				if(rawFile.status === 200 || rawFile.status == 0)
				{
					var decrypted = CryptoJS.AES.decrypt(encrypted, rawFile.responseText).toString(CryptoJS.enc.Utf8).replace("username=", "").split("&password=");
					if(decrypted.length>1){
						document.login.username.value= decrypted[0];
						document.login.password.value= decrypted[1];
						document.login.submit();
					}else if(encrypted.toString(CryptoJS.enc.Utf8).substr(0,3)!="dst" && encrypted.toString(CryptoJS.enc.Utf8).substr(0,3)!=""){
						alert("Invalid Access Token!");
					}
				}
			}
		}
		rawFile.send(null);	
	}
	readTextFile("yoursecretkey.txt",window.location.href.split("?")[1])
	//the key is stored in a file.
}
</script>

I’m trying to find some way to keep the secret key hidden. Co-devs are welcome, just paste code in topic!
Note: Do some debug in mikrotik’s webserver before, there are some special needs.


Here is the code for encrypt page:

<script src="aes.js"></script>
<script>
	location.href = "http://10.0.0.1/login.html?"+CryptoJS.AES.encrypt("username=******&password=*******", "yoursecretkey");
</script>

The code use CryptoJS v3.1.2 library from https://cdnjs.com/libraries/crypto-js and https://stackoverflow.com/questions/14446447/how-to-read-a-local-text-file.


This is a work-in-progress method, if you have a better idea, feel free to share here your dev.