Idle Hands are the Devil's Tools

In all my years of travel, other than dealing with TSA, nothing has inexplicably bothered me more than airports that charge for wireless access. Due to ever growing unpredictability of security lines, ticket counter hassles, less frequent parking lot shuttle buses, and the like, I've have to continually adjust my schedule to arrive at the airport earlier and earlier. Because of this, I often find myself sitting at the airport waiting. To compensate for this, it seems like the least they could do is provide me with some complimentary wireless access so that I can entertain myself or even catch up on some work. (Without me having to squat outside the Red Carpet lounge and "borrow" some wireless access!)

The old saying goes, "Idle hands are the devil's tools".. And its no different for me. With copious amounts of "wait" time, I often found myself honing my wireless sniffing and attack skills. ;)

Well, briefly passing through BWI Airport last week, I decided to check for free wireless. Upon connecting and trying to reach cnn.com, I was instantly presented with a captive portal page.










(Click for full size view)

Of course, the first thing I check were obvious combinations (guest/guest, admin/ admin, etc). These all led to an Access Denied page. But, what if there was someway that I didn't have to supply a password. Surely in this day and age there was no way that the login page would be vulnerable to basic kindergarten-grade SQL Injection attacks. This is a very large wireless provider with presence in airports across the world. Surely they have seen other people try this before and have fixed this. But, curiosity got the best of me, and I tried the ol' admin' --






(Click for full size view)

I guess I was wrong.