How Stalker portals authenticate by MAC

Why STBemu needs no password, what the handshake looks like, and why a portal URL alone is worthless.

The device is the credential

Stalker middleware — the platform behind MAG boxes and, by imitation, STB Emulator — does not use a credential pair. The portal holds a list of registered MAC addresses and maps each to a subscriber profile. Presenting a registered MAC is the whole of the authentication.

This is why a portal URL on its own gets you nothing, and why the MAC is the field worth protecting. It is also why there is no password to reset: access is granted or revoked by editing the portal's device list.

The handshake

A client requests a handshake from the portal and receives a token, then sends a profile request carrying that token along with the MAC, a serial number and a device identifier. The portal answers with the profile, and subsequent calls for the channel list and stream links carry the token.

Because the MAC is presented in a header rather than a query string, the exchange is slightly less exposed than Xtream's — but it is equally unencrypted on a plain HTTP portal.

Why 00:1A:79

That prefix is the OUI assigned to the original MAG hardware. Portals frequently validate it, because a MAC outside that range is unlikely to be a real set-top box. Generated MACs therefore keep the prefix and vary only the last three octets.

Distinguishing the failure modes

A portal that returns an error immediately is reachable but rejecting the MAC — it is not registered, or it has been cleared. A client that sits on a loading screen indefinitely usually means the portal accepted the handshake and then failed to return a profile, which is a portal-side fault. A connection that never establishes at all means the portal is down or the URL is wrong.

These three look similar in the app and have completely different causes, which is why reading the behaviour rather than the error text is worth the effort.