Public WiFi networks really should use client isolation. Sadly, many don't.
Even if client isolation is used, do you trust your local cafe’s WiFi AP?
You can just go to a public place and run your own hotspot.
And use a name and SSID of some well-known public WiFi network. Then make a captive portal to force the user open an attacker-controlled page in a browser.
it should be mentioned that even with WPA2-PSK wifi you are vulnerable to arp spoofing
I was thinking in enterprise contexts, but, yes, that's fair. Still, anybody doing anything important on public WiFi should be using a VPN.
How will a vpn protect the user if the target laptop is listening on a public wifi connection?
Actually maybe it wouldn't... I guess underneath the VPN it still has to be listening.
The author details the options. If can find an XSS on dells website it’s possible.
It looks to me like you could register any domain starting with "localhost" (eg. localhostevil.com) and it would work.