Idea Of Cracking The Network

Greeting Citizens Of The BlackHat
Here is the most popular question about the wireless public network.
Now a day we can access the wireless everywhere out of your office and home business, but most complicated is wireless password and most of the login access page for the users.

In case one, we also know the wireless with WPA/WPA2 password also we need the word list to crack the wireless with the correct channel. This is too much tools and method to make it work we don’t make this discussions here.

So we are going to case two :)
We can get the Wireless Access with NO-PASSWORD but also need to login account.
Now, in case we are already hacker we know that we sure have the IP from the Access Port. As like “Y5Zone”, “ISP” Public Wireless AP, we also can get the first IP from the AP
#CASE2#
===============================================
1 st connection :
<Y5Zone(AP)> 		  IP: 10.230.0.1    subnet mask: 255.255.254.0
<Attacker Devices(Android)> IP: 10.230.0.42  subnet mask: 255.255.255.254.0

2 nd after the 1 st connection and the login page :
That the following step is the login page….. In case is
10.230.0.42 <==Captive Portal(login page:80)==> 10.230.0.1
Step 2:
After the login step the ip and the subnet mask may change to 192.168.1.x netmask back to 255.255.255.0 (for example)
===============================================
OK now I make the discussions about 3 questions:
1. How can we bypass the connections without the login, as we already get the AP released IP address.
2. fake #mac address# & #ip address#. Should it can pass the NAT rules for make the connection work.
3. In case the router OS or Firewall it may have different rules to let the client(Devices) to connect to network, but we know also are under the rules TCP/IP’s :) The idea is, any http/https to make the fake handshake(RSA/CA[certificate]) to pass the block, and maybe any idea to crack the CA to pass the connection