Quantcast
Channel: hackvault
Viewing all 45 articles
Browse latest View live

The Onion Network (good reads)

$
0
0

Want Tor to really work?

You need to change some of your habits, as some things won't work exactly as you are used to.
  1. Use the Tor Browser
    Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser. It is pre-configured to protect your privacy and anonymity on the web as long as you're browsing with the Tor Browser itself. Almost any other web browser configuration is likely to be unsafe to use with Tor.
  2. Don't torrent over Tor
    Torrent file-sharing applications have been observed to ignore proxy settings and make direct connections even when they are told to use Tor. Even if your torrent application connects only through Tor, you will often send out your real IP address in the tracker GET request, because that's how torrents work. Not only do you deanonymize your torrent traffic and your other simultaneous Tor web traffic this way, you also slow down the entire Tor network for everyone else.
  3. Don't enable or install browser plugins
    The Tor Browser will block browser plugins such as Flash, RealPlayer, Quicktime, and others: they can be manipulated into revealing your IP address. Similarly, we do not recommend installing additional addons or plugins into the Tor Browser, as these may bypass Tor or otherwise harm your anonymity and privacy. The lack of plugins means that Youtube videos are blocked by default, but Youtube does provide an experimental opt-in feature (enable it here) that works for some videos.
  4. Use HTTPS versions of websites
    Tor will encrypt your traffic to and within the Tor network, but the encryption of your traffic to the final destination website depends upon on that website. To help ensure private encryption to websites, the Tor Browser includes HTTPS Everywhere to force the use of HTTPS encryption with major websites that support it. However, you should still watch the browser URL bar to ensure that websites you provide sensitive information to display a blue or green URL bar button, include https:// in the URL, and display the proper expected name for the website. Also see EFF's interactive page explaining how Tor and HTTPS relate.
  5. Don't open documents downloaded through Tor while online
    The Tor Browser will warn you before automatically opening documents that are handled by external applications. DO NOT IGNORE THIS WARNING. You should be very careful when downloading documents via Tor (especially DOC and PDF files) as these documents can contain Internet resources that will be downloaded outside of Tor by the application that opens them. This will reveal your non-Tor IP address. If you must work with DOC and/or PDF files, we strongly recommend either using a disconnected computer, downloading the free VirtualBox and using it with a virtual machine image with networking disabled, or using Tails. Under no circumstances is it safe to use BitTorrent and Tor together, however.
  6. Use bridges and/or find company
    Tor tries to prevent attackers from learning what destination websites you connect to. However, by default, it does not prevent somebody watching your Internet traffic from learning that you're using Tor. If this matters to you, you can reduce this risk by configuring Tor to use a Tor bridge relay rather than connecting directly to the public Tor network. Ultimately the best protection is a social approach: the more Tor users there are near you and the more diverse their interests, the less dangerous it will be that you are one of them. Convince other people to use Tor, too!

Be smart and learn more. Understand what Tor does and does not offer. This list of pitfalls isn't complete, and we need your help identifying and documenting all the issues.

Rooted Nexus 7 - Kali Pwn Pad (IN PROGRESS)

$
0
0
after keeping the nexus 7 stock and slave to google, on a hot California summer, I finally decided to void it's warranty by attempting to root, multi boot rom and run Kali Linux on it.  These are my notes and google search results. 

IMPORTANT: Read each Phase (more than once if necessary) completely before you take any action.  Take note of the GREEN updates, they are the ones that actually worked. Each Phase is a work in progress, and are my notes to remind me where I left off.  So please pardon the mess. 

Google Search: "root nexus 7" - Root your Nexus 7
Google Search: "kali nexus 7" - forum.xda-developers.com post by droidshadow

My number 1 advice on following the instructions:Read each step a few times, every letter and every word - including the pop-up windows from the tools when running the actual steps.

Note: be thankful to the guys who already did the leg work to deliver you the step-by-step instructions. the very least you can do is read everything they wrote down, plus you'll be doing yourself a favor by doing so.

PHASE 1: Root your Nexus

The text only instructions are below. The original post/link above has screenshots included. Remember to read the instructions carefully. 
Step 1: Enable USB Debugging
You need to allow the toolkit to make a connection to your Nexus, so you'll need to enable USB Debugging. Simply go into Settings -> Developer Options -> USB Debugging.
If you don't see Developer Options, don't worry. Go into Settings -> About Device and tap on Build Number about 7 times. You'll see a toast notification pop up letting you know that you're a developer. Then simply go back and you'll see "Developer options."
Step 2: Download & Install the WugFresh Nexus Toolkit
If you don't know, this kit is a Godsend—it literally does all of the heavy lifting for us. Head over to the WugFresh website and grab the latest version of the Nexus Root ToolKit, which has been updated with KitKat 4.4.2. compatibility.
You can also grab the direct download here. Whenever you run the app, make sure to right-click on the icon and select "Run as administrator".
Step 3: Back Up Your Nexus
The first step to rooting is unlocking the bootloader, which I'll get into a little later. Unfortunately, that process means that you'll need to wipe the data on your device. If you're not interested in starting fresh, the WugFresh toolkit has you covered.
Select "Backup" from the left-most panel, then select the items you want to back up. In general, I only backup SMS and call logs because apps and contacts are restored once you sign in with your Google account.
Unfortunately, app data is not restored automatically, so if you've got a great high score in Flappy Birds that you'd be sad to lose, you may want to back up your apps using the toolkit. Just select "Create Android Backup File," either under "Backup All Apps" or "Backup Single App."
Alternatively, you can back up your Nexus 7 without root or a custom recovery using various other backup tools.
Step 4: Set Up the Toolkit
When you initially launch the toolkit, you'll need to provide some basic information. Choose the specific Nexus device and build you have. If you're not sure what you input here, just select Auto Detect Device + Build.
Next, you'll need to install the proper drivers for your device, if you didn't already do so through the backup process. All you do is select Full Driver Installation Guide and follow the simple instructions.
After going through the driver installation, Unlock your device to make rooting possible.
Unlocking will wipe the device.
Step 5: Root Your Nexus 7
Finally, you're ready to root. Check the Custom Recovery option to also apply TWRP custom recovery to your device, then click Root to initiate the process.
With the custom recovery, you will have an extra step that includes tapping your screen a few times, but it's easy to follow with WugFresh. After the program runs its course, your device will be unlocked and rooted and will reboot.
Step 6: Make Sure You're Rooted

An easy way to make sure the WugFresh toolkit worked and your Nexus 7 is rooted is to download the free Root Checker app from Google Play. Just open the app, select Verify Root, and wait for the results.

PHASE 2: Install MultiRom Manager & Quickboot 

Now that your tablet is rooted you need to install MultiRom Manager. What this does is it allows you to put multiple roms on your tablet without ever harming your stock (internal) android rom. This is a great tool and all of us who use it really owe the developer a lot of credit...

There is a very easy way to install MultiRom Manager. The developer of this program has created an app that you can download from the Google Play Store to install it easily and successfully. 

Open up the Google Play store and do a search for "multirom manager". Download it, open it up, grant it root permission and run the app. The app will do all of the hard work for you and it will install MultiRom for you. Once it is done reboot your tablet. Since your stock rom won't have the reboot option i recommend downloading "quickboot" from the Google Play Store. This app requires root access but it will allow you to quickly reboot your tablet, boot into recovery, or boot into the bootloader. 

When you are booting up after installing multirom you need to click on your tablet as MultiRom is counting down. The only Rom that will be listed is "internal" (because you haven't installed any other roms) go ahead and boot into "internal" by clicking on the boot button. 

IMPORTANT NOTE: it is very important to boot your internal (stock rom) at least one time before you flash/add another ROM with multirom manager. MAKE SURE YOU DO THIS!


PHASE 3: Install a custom additional Roms  

Use the Quick Boot app that WugFresh loaded during the Phase 1 to boot into "Recovery Mode". Now in recovery manager which works hand in hand with MultiRom you are going to want follow these steps:

1. Hit the Advanced button
2. Hit the MultiRom button 
3. Add Rom
4. Select "Add Zip". Choose the cm-11-20131213-bruce2728-odexed-flo.zip file to flashed.
5. Once that is done flash the zip by sliding the bottom button from left to right. 

Okay now after you flash the zip you should see "ZIP FLASHED SUCCESSFULLY". 
Now what you want to do is hit the back button till you get to the main recovery page.

08/24/2014 UPDATE: NOTE: I have not successfully installed a rom on my device - it keeps FAILING.  Research and testing is currently in progress. Stay tuned.

08/25/2014 Update: upon reading the FAIL message closely, it said that the CM11 version I was trying to load was for a FLO (Nexus 7 2013 - 2 cameras) device while my Nexus 7 was a GROUPER (Nexus 7 2013 - 1 camera). I'm going to try and load the latest GROUPER CM11 I can find and cross my finger. Here's the CyanogenMod 11 Grouper Link - 

https://download.cyanogenmod.org/?device=grouper&type=stable


09/06/2014 Update: Sorry for the long delay on updates. The Grouper ROM works for my Nexus 7 (with 1 camera). I've since also flashed the ROM with the PA-Google Apps.  You will need this to be able to get to Google Play.


PA-GOOGLE APPS

https://www.androidfilehost.com/?w=files&flid=15800
http://forum.xda-developers.com/showthread.php?t=2397942

Next step adding Google Apps from TWRP recovery manager:

1. advanced
2. multirom
3. list rom
4. now that you have flashed CM11 you should see a ROM under "internal". Remember "internal" is your stock rooted nexus 7 rom.  click on the new rom you just installed.
5. click flash zip.
6. navigate to where you downloaded the pa-gapps.zip file, and pick it.
7. slide the button to flash the zip.

HIT THE BUTTON TO REBOOT YOUR SYSTEM. 

Okay so now that your Nexus 7 is rebooting you need to tap on your device to stop the countdown from MultiRom. There will be 2 choices on the list 'internal' and the ROM you just added. You want to select your newly added rom and tap it again to boot it.  


NOTE: The 'internal' rom is your clean stock factory rooted rom.  To go back to it, you'll need to reboot again and choose it at the multiboot screen.

SET UP YOUR DEVICE and make sure GOOGLE PLAY STORE IS RUNNING CORRECTLY:

IMPORTANT TIP: if the google play store stops working try rebooting your system. If that does not work and your google play store is giving you an error 920 code then you need to close the google play store. go to settings -> apps -> all apps. Click on Google Play and wipe data and cache. After that you need to click on GMAIL and wipe data and cache.

WIPING THE CACHE and DATA on GMAIL will fix problems with the GOOGLE PLAY STORE especially error code 920.



PHASE 4: Install Kali Linux

As always: MAKE SURE YOUR TABLET IS PLUGGED IN TO POWER ESPECIALLY FOR THIS STEP!

1. Download the KaliPwnPad: Go to http://w11.zetaboards.com/Pwnie_Express/topic/8951376/1/ and spend some time to search for the latest and greatest version available.  The actual version I used is from this download link - https://mega.co.nz/#!aZ5THSxL!PFuyV1Z7Vb-QgmhYF5a7CgMukI1JAGIUkEo972KEgiE

2. After you get the file, boot back up into recovery. Pick the your new rom and basically perform the same "flashing" steps you did as installing the PA-Google Apps.

In Recovery go to -> ADVANCED -> MULTIROM -> LIST ROMS -> SELECT your ROM -> ADD ZIP.

Navigate and select the kali pwn pad file that you downloaded earlier.

WARNING: this file will take about 30 minutes to flash. you are going to want to keep and eye on this file. if at all possible do not let TWRP time out and turn off the screen. You can avoid TWRP turning off your screen from an idle timeout by clicking on your tablet's screen once a minute. I know it may seem like a lot but it is best and easier to avoid the screen from turning off from an idle timeout. If your tablet does turn off from an idle time out if you are on POWER you should be able to turn the screen back on by just clicking on the power button and swiping the bottom of your tablet from left to right to unlock it. 

Okay now that KaliPwnPadv0.5 is flashing you will just have to wait for it to finish...

It does take about 30 minutes for this big file to flash. Now you will see the progress bar filling up. When the progress bar is full don't worry that the zip isn't done flashing. It may take 5-7 minutes after the progress bar is full for the zip file to finish flashing.

Caveats:
-The error  "unable to load ramdisk" and the top screen which said "Error: unable to flash zip". Don't worry this will not affect your system. 
-Once the file finished regardless if you got "zip file flashed successfully" or "unable to load ramdisk" error you will need to reboot your tablet.

3. Let's light this candle!

- Boot into the ROM you flashed KALI in
- Start your Terminal Emulator
- On the prompt, type "SU"
- Get the party started by typing "bootkali"


PHASE 5: USB Drivers and ALFA

09/06/2014 Update: I have recently ordered the cables I need to get the external Wifi connected to the Nexus.  I also have not really flashed the kernel to add the drivers.  I'll continue this project when the required materials arrive.

Project Xplico (PLANNED)

$
0
0
Estimate Time of Completion: December 2014

r00tabaga: I F'ed it up! what now!

$
0
0

Lifted from the most excellent Ace Hackware forum:   https://acehackware.zendesk.com/entries/25149852-I-broke-my-r00tabaga-

I broke my r00tabaga :(


Taylor Banks
posted this on August 09, 2013 17:11
If your r00tabaga gets b0rked, here are a few common diagnostic steps you can take to identify and/or reset the device's behavior that may save you needing to rebuild.

Get in.

First and foremost: Try to get in, any way you can. Once you're in, you can re-set passwords, change IPs, enable and disable ethernet and wireless adapters, install and uninstall packages and even re-flash the device with a fresh OpenWRT build if you just want to start over from scratch.

If you can't communicate with your r00tabaga:

  • look for an AP you don't recognize with a BSSID that matches your router's MAC address
  • try to connect to it via ethernet and get an IP address from it via DHCP
  • otherwise, the default ethernet IP is possibly 172.16.42.1 (pineapple) or it's acting as a DHCP client (minipwner)
  • if you are unable to ssh to the device on 172.16.42.1, try telnet and ssh on 192.168.1.1 or assign the device an IP with a local DHCP server
  • if you still can't get in via SSH, you can try failsafe mode, which will allow you to re-flash the device:
    power on the device, wait almost 5s, push and hold reset button for almost 3s, release.
    the re00tabaga  should reboot and bring up ethernet port with 192.168.1.1, listening via telnet.
    > do you see "failsafe" in the motd when you first login?
  • If booted into failsafe mode, try to re-mount your root & extroot:
    mount your root flash filesystem to manually correct a file with
    mount_root then try 
    /etc/init.d/fstab whole_root_enable and reboot; 
    you may need to modify /etc/config/fstab
    once mounted, you'll likely want to modify /etc/config/network and/or /etc/config/wireless
  • otherwise, reboot out of failsafe mode with reboot -f
  • if SSHed in, you can try using activate minipwner or activate pineapple to reset to default configs on a stable build
  • if default configs have been modified or removed, you may need to rebuild (see below).
OpenWRT Resources:

Option 1 - Rebuild it from scratch.

To rebuild a r00tabaga:

Read all of the directions through at least once before proceeding so that you understand the process from start to finish. While it isn't complex, building r00tabagas manually does take a little patience and requires at least basic knowledge of a linux or OS X command line. We've automated the setup and configuration in our lab, but knowing how to rebuild your r00tabaga from scratch, by hand, may still come in handy when you least expect it. :)
  1. Try to login via telnet or ssh and do a firstboot && reboot. If you can do so, it's faster and easier than re-flashing, but should accomplish the same goal, which is a reset of configuration files to their default state.
  2. Once in firstboot, you can: 
  3. Re-flash the r00tabaga with attitude-adjustment. If you're using an MR11Uv2, you need the eko build.
    Download the firmware and host it for download on your local machine with netcat:
    nc -l < filename.bin 6666
  4. From your router, download the firmware from your local machine with netcat:
    cd /tmp
    nc 192.168.1.111 6666 > filename.bin
    mtd -r write filename.bin firmware
  5. Build as Pineapple using a pivot root
    (If you have a dd image from your original r00tabaga USB drive, you can skip copying the filesystem and go straight to the section entitled Re-image It below.)
  6. Copy firewall, network and wireless configs into /etc/config directory as *.p
  7. Copy MiniPwner files into /etc/config as *.m
  8. Install MiniPwner packages (from the list in step 20, but do NOT install to dest -usb since it's a pivot root)
  9. Download and install activate script to //usr/bin, adjust paths as necessary
  10. install any additional optional packages
  11. run activate minipwner && reboot

Option 2 - Re-image it.

If you want to start with a known-good image of the 8GB root filesystem used at build time, you can download it here and rebuild your r00tabaga by configuring the device to mount the USB filesystem as an extroot. This method is known to work with Sandisk Cruzer Fit 8GB sticks, and has not been tested or verified to work with any other devices.
  • Re-flash the r00tabaga with attitude-adjustment (make sure to use the correct version for your hardware! MR11Uv2 needs the eko build to flash from the web gui) or login to the device and run firstboot to get the router into a known fresh state
  • Download this dd image and write it to an 8GB Sandisk Cruzer Fit stick.
  • Power on the router
  • Enabled wireless so that we can get the wireless adapter's MAC address:
    cp /etc/config/wireless /etc/config/wireless.orig 2>/dev/null
    sed -e 's/option disabled 1/# option disabled 1/'</etc/config/wireless.orig >/etc/config/wireless 2>/dev/null
    reboot
  • Make backups of all of the files in /etc/config/ as well as /etc/opkg.conf
  • Determine the MAC address of your r00tabaga:
    ifconfig -a | awk '/wlan0/{print $5}'
  • Edit /etc/config/wireless as below, replacing the MAC address with your own and the ssid (ex: my-home-wifi), encryption mode (ex: psk2) and key (ex: 1234567890)  with values corresponding to a wireless network your r00tabaga can use to connect to the internet to complete its configuration:
    config wifi-device wlan0
       option type mac80211
       option channel 6
       option macaddr xx:xx:xx:xx:xx:xx
       option hwmode 11ng
       option htmode HT20
       list ht_capab SHORT-GI-20
       list ht_capab SHORT-GI-40
       list ht_capab RX-STBC1
       list ht_capab DSSS_CCK-40
       # REMOVE THIS LINE TO ENABLE WIFI:
       # option disabled 1
    config wifi-iface
       option device wlan0
       option network wan
       option mode sta
       option ssid {xxxx}
       option encryption {xxxx}
       option key {xxxx}
  • Add a WAN stanza to /etc/config/network that looks like this:
    config interface 'wan'
       option ifname 'wlan0'
       option proto 'dhcp'
  • Bounce the network to restart the wifi adapter:
    /etc/init.d/network restart
  • Confirm you've got internet access via wlan0:
    ifconfig
    ping 4.2.2.2
  • Insert the USB stick and confirm that the filesystems are visible. You should be able to see the contents of the USB stick mounted under /mnt/sda2
  • Edit /etc/opkg.conf and make sure the URL for the attitude adjustment repository is:
  • http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/
  • Install base packages and dependencies:
    opkg update
    opkg install block-mount kernel kmod-usb-core kmod-usb2 kmod-usb-ohci kmod-usb-storage kmod-fs-ext4 kmod-scsi-generic
  • Create an /etc/config/fstab file that looks like this (assuming your USB filesystem is on sda2 wih swap on sda1):
    config global automount
       option from_fstab 1
       option anon_mount 1

    config global autoswap
       option from_fstab 1
       option anon_swap 0

    config mount
       option target /
       option device /dev/sda2
       option fstype ext4
       option options rw,sync
       option enabled_fsck 0
       option enabled 1

    config swap
       option device /dev/sda1
       option enabled 1
  • Reboot.
  • Now enable the pivot root:
    /etc/init.d/fstab whole_root_enable
  • Reboot again. 
  • Now update all of your wireless configs (/etc/config/wireless.*) to have the correct MAC address identified above.
  • Finally, update your wireless SSIDs to match your device MAC:
    export MAC=`ifconfig -a | awk -F: '/wlan0/{print $6$7}'`
    sed -i -e "s/option ssid.*/option ssid r00tabaga-${MAC}/" /etc/config/wireless.m
    sed -i -e "s/option ssid.*/option ssid r00tabaga-${MAC}/" /etc/config/wireless
    /usr/sbin/activate minipwner
  • ... and reboot one last time.
  • Et voila! One updated r00tabaga!
 Broke it beyond your ability to repair it?  Contact support@acehackware.com

r00tabaga basic operations manual (IN PROGRESS)

$
0
0
So, here we go again. Another gadget project.  I got this one during Defcon 21 and haven't really spent any time to explore it until now.  (Note: I also have a good collection of Wifi Pineapples in storage which I have not had time to experiment on.)

So, just like before, i start exploring the net to find manuals and forums for the best way to utilize the r00tabaga.  I'm looking to find basic operational commands, configurations and topology setups which seems like non-existent.  All I can find are the marketing information and recovery instructions (which I posted) just in case you brick it. Due to the lack of an operation manual, this is my working research notes on trying to compile one. 

As always, this will be a hot mess of copied, pasted, lifted and borrowed information from existing websites, (and my own notes).  I will always do my best to credit the talented people who gave their time and effort to share their knowledge to the world, but please pardon me if I miss some.

PHASE 1: Topology (Physical Setup) and System Update

09/06/2014 Update: I'm still looking for resources available on the net to see if anyone has posted how they set this up on their network or computer.  Maybe the latest firmware and running updates.  Being a dual purpose device (minipwner and wifipineapple) network setup might be a little tricky.  I figure the secure shell is where the magic.  I'll post whatever I learn in the next couple of days. Stay tuned.

TOR Browser: Download, Install and Execution

$
0
0

Linux Instructions

Download the architecture-appropriate file above, save it somewhere, then run one of the following two commands to extract the package archive:
tar -xvJf tor-browser-linux32-3.6.5_LANG.tar.xz
or (for the 64-bit version):
tar -xvJf tor-browser-linux64-3.6.5_LANG.tar.xz
(where LANG is the language listed in the filename).
Once that's done, switch to the Tor browser directory by running:
cd tor-browser_LANG
(where LANG is the language listed in the filename).
To run Tor Browser, execute the start-tor-browser script:
./start-tor-browser
This will launch Tor Launcher and once that connects to Tor, it will launch Firefox. 

KALI: the latest and greatest

$
0
0
When new Kali versions are released, won't it be cool if you didn't have to download and reload your current setup from scratch?  Especially when a whole bunch of tool updates, a new kernel, and some cool new features are available.
Well, just run the  commands below from your preferred terminal emulation, and you can update to the latest and greatest using these simple commands:
apt-get update
apt-get dist-upgrade
# If you've just updated your kernel, then:
reboot

Nexus 7 (2012) Multi-boot with Kali NetHunter

$
0
0
09/26/2014 - NOTE: Kali NetHunter was just released a few days ago.  As of this time, I'm working on adding the NetHunter as another boot option for the Pwn Pad, therefore triple booting the poor Nexus 7 (2012) with 16GB (no expansion slots).  
Current ROMS:
1. internal (stock Nexus 7) - operational
2. Pwn Pad - operational
3. Kali NetHunter - currently broken (would not boot)
=========Stay Tuned=========

Unlocking and Rooting Your Nexus Under Windows

$
0
0

Unlocking and Rooting Your Nexus Under Windows

CREDITS: This whole post was lifted from nethunter.com (a.k.a. Kali NetHunter)

  1. On a Windows machine, download and install the Nexus Root Toolkit, which can be found at http://www.wugfresh.com/nrt/.
  2. Ensure the model type is set correctly for your device. You can find your build number by going to Settings, “About Phone/Tablet” and then scroll to the bottom.
  1. In the NRT app, click on the “Full driver installation guide” button, and read steps 1-3. Click on the Step 3 tab, then download and install Windows drivers for your Nexus device. The “Google drivers” worked for us. Click on Step 4 and confirm the drivers were installed successfully. This process will reboot your Nexus as part of the check.
  2. Once the check completes successfully, proceed to click the “Unlock” button on the Nexus Root Toolkit interface, to unlock your boot loader. Again, be aware this will completely wipe your device. Ensure you have backups of your data as needed. Follow the Nexus Toolkit prompts carefully. On the next boot, you should see an open padlock together with the Google logo.

Rooting Your Nexus Device

Once unlocked, you can now proceed to root your device and install a custom recovery using the Nexus Root Toolkit. To begin the rooting process, follow these steps:
  1. As the device has been wiped, you must re-do the process of Enabling Developer mode and Disabling Storage MTP instructions from previous. You will need to accept the computer RSA fingerprint once again.
  2. Still in the Nexus Root Toolkit, click the Root button, ensuring the Custom Recovery checkbox is checked.
Once the device has rebooted, and the rooting process complete, we need to install some core Android Applications for the NetHunter image to work properly.

Install BusyBox Free Stephen (Stericson)

The first application to install once rooted is Busybox Free (Stephen Sericson). The NetHunter image will fail to function without a proper installation of this app. Once downloaded from the App store, open up BusyBox and grant it root privileges. Wait until the “gathering information” stage completes, and press “install”. Exit the Busybox app.

Install the TWRP Boot Manager Application

To ease the process of booting your Nexus into fastboot and recovery mode (normally done by powering down the Nexus, then booting it by pressing both the power button and volume down), we can install the TWRP boot manager application through the Google play store. This will allow us to boot into recovery mode with a single press of the touchscreen.

Now your Nexus device is successfully unlocked and rooted.

Unlocking and Rooting Your Nexus Under Kali Linux

$
0
0

Unlocking and Rooting Your Nexus Under Kali Linux

CREDITS: This whole post was lifted from nethunter.com (a.k.a. Kali NetHunter)

Before flashing the Kali NetHunter image to your Nexus device, it must first be unlocked and rooted. Note that unlocking your device will result in all of your data being deleted so ensure you have made a backup. Begin by installing the google-nexus-tools package on your Kali Linux system:


1
root@kali:~# apt-get update && apt-get -y install google-nexus-tools

Connect your Nexus to Kali with a USB cable. You will be prompted to allow USB debugging from the computer as shown below. Tap ‘OK’ to allow the connection.
On your Kali system, use the nexus-adb command to verify that your Nexus has been successfully attached.


1
2
3
root@kali:~# nexus-adb devices
List of devices attached
0a6088af device

Download the correct TWRP recovery image for your Nexus device:
Next, we require the correct files needed to root the device:
In this example, we are flashing a Nexus 7 2013 LTE device so we download the necessary files for our device and unzip the CF-Auto-Root archive.


1
2
3
root@kali:~# wget -q -O twrp-recovery.img http://techerrata.com/file/twrp2/deb/openrecovery-twrp-2.8.0.1-deb.img
root@kali:~# wget -q -O cf-auto-root.zip http://download.chainfire.eu/361/CF-Root1/CF-Auto-Root-deb-razorg-nexus7.zip?retrieve_file=1
root@kali:~# unzip cf-auto-root.zip

With everything in place, we can now proceed to unlock the Nexus, install a new recovery, and root the device. First, reboot to the bootloader:


1
root@kali:~# nexus-adb reboot bootloader

Once the device has booted to the bootloader, we can unlock it with the command below. You will be prompted to confirm the unlock on the Nexus device itself. Use the volume button to select Yes and press the Power button to confirm the unlock.


1
2
3
4
5
6
7
8
9
root@kali:~# nexus-fastboot oem unlock
(bootloader) Unlocking bootloader...
(bootloader) erasing userdata...
(bootloader) erasing userdata done
(bootloader) erasing cache...
(bootloader) erasing cache done
(bootloader) Unlocking bootloader done!
OKAY [ 80.961s]
finished. total time: 80.961s

With the Nexus still in bootloader mode, we can flash the TWRP recovery downloaded previously:


1
2
3
4
5
6
root@kali:~# nexus-fastboot flash recovery openrecovery-twrp-2.8.0.1-deb.img
sending 'recovery'(7878 KB)...
OKAY [ 0.673s]
writing 'recovery'...
OKAY [ 0.302s]
finished. total time: 0.975s

The final step is to actually root the Nexus by making the ‘root-linux.sh’ script executable and then running it:


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
root@kali:~# chmod 755 root-linux.sh
root@kali:~# ./root-linux.sh

----- CF-Auto-Root-deb-razorg-nexus7 -----

Please make sure your device is in bootloader/fastboot mode before continuing.

***WARNING*** ALL YOUR DATA *MAY* BE WIPED ! ***WARNING***

We are going to run the OEM UNLOCK command on your device. If your device
was not previously unlocked, this will wipe all your data !

After the unlock, CF-Auto-Root will boot. You should see a big red Android
on your device's screen.

You may need to enter your administrator password to continue.

Press Ctrl+C to cancel !

Press ENTER to continue

... INFOThe bootloader is already unlocked!
OKAY
downloading 'boot.img'... OKAY
booting... OKAY

It may take a minute or so for the red Android to appear. If it doesn't show up
at all, there may be a problem.

Press ENTER to continue

After your Nexus reboots, re-enable developer mode as shown above in order to proceed.

Install BusyBox Free Stephen (Stericson)

The first application to install once rooted is Busybox Free (Stephen Sericson). The NetHunter image will fail to function without a proper installation of this app. Once downloaded from the App store, open up BusyBox and grant it root privileges. Wait until the “gathering information” stage completes, and press “install”. Exit the Busybox app.

Install the TWRP Boot Manager Application

To ease the process of booting your Nexus into fastboot and recovery mode (normally done by powering down the Nexus, then booting it by pressing both the power button and volume down), we can install the TWRP boot manager application through the Google play store. This will allow us to boot into recovery mode with a single press of the touchscreen. Your Nexus device is now successfully unlocked and rooted, 

DEFCON 23: WiFi Sheep Hunt Summary of Contest

$
0
0
WiFi Sheep Hunt Summary of Contest:

Hello potential WiFi Sheep Hunt contestants! We have lost our Ovis aries, or Sheep for the biologically impaired. Your job as a Sheep Herder is to help us find our sheep and return them to the “farm”. 


The first Sheep Herder to successfully return all lost sheep to the “farm” will be the 1 st Prize Winner of the WiFi Sheep Hunt contest. 

This year we have 3 ways of sheep herding (playing). You choose the way you want to play, but choose carefully, as once you choose you may not switch to another way of playing. A Sheep Herder may be an individual or a team but as a team you may only choose one way of playing.
 

Sheep Herder Type 1
This type of sheep herder has a computer, tablet or other type device with wireless packet sniffing capabilities/skills and is not afraid to use them at DEF CON. These individuals are brave, very brave.


Sheep Herder Type 2 
This type of sheep herder has no computing device whatsoever, which in some cases may be a wise choice at DEF CON, but wants to join in on the fun. YES, you do not need a phone, you do not need a tablet and you do not need a computer to play as type 2 sheep herder.

Sheep Herder Type 3
This type of sheep herder has a phone, tablet or other type device with NFC reading capabilities and is not afraid to use them at DEF CON. You did make a backup image of your phone and/or tablet before you arrived didn't you?


NOTE: In years past we have frowned upon hacking our contest equipment but this year we have had change of heart, as long as you don't render it useless. 


DO NOT BRICK IT. 

Our equipment is dated, has not been patched and may be vulnerable to attacks. This is DEF CON btw. Hack at least 2 of our wireless access points and ONLY OUR WIRELESS ACCESS POINTS and prove to us YOU hacked them by changing their broadcasting SSIDs to something that identifies YOU and if no one returns all our sheep to the “farm” then you win 1st Prize. You must have signed up as a Sheep Herder Type 1 to win in this way.

DEFCON 23: WiFi Sheep Hunt - FAQs

$
0
0
FAQ:

How do I sign up?
 

Come by the Packet Hacking Village, and drop by the WiFi Sheep Hunt desk.  Say Hi!, and give your full name, address, phone number and bosses name to a “farm” hand. OR at the very least give a team name and email address so we can identify you. WE WILL need a picture of you if you are a prize winner however. So if you are camera shy you better buy a mask or bribe a stand-in for the picture.

Wait but what clues am I sniffing for exactly?
Well, we have AeroScout Tags that are broadcasting messages that will help you because those messages will be clues as to how to connect to the access points. We also may or may not have devices constantly connected to those access points that may or may not help you find the right access points to connect to. Remember bogus clues, tags, hints, devices do exist.
 

Where will I need to be in order to receive the clue packets?
You will want to stay close to the Packet Hacking Village and preferably close to the WiFi Sheep Hunt information desk. Well, that is if you don't have specific types of antennas to be farther that is.
 

What hours will the clues be transmitting?
Contest equipment will be broadcasting starting August 6th Thursday morning around 10am until August 9th Sunday morning around 10am.
 

How do I know what access points to actually connect to?
Here is your first hint, they will have at the very least the following letters in the broadcasting SSID name: S H F I W. But you know what, our admins have just informed me they do not know if they set the access points to actually broadcast an SSID or not. I guess you have your work cut out for you.


When I successfully connect to an access point how do I get the credit for bringing that sheep to the “farm”?
Well you do have an SSID and a password and/or username and password combination don't you? I think you just answered your own question. Keep that information with you and if you want verification maybe one of the “farm” hands will help you, or maybe they will not.


Will hints be provided on twitter like they were last year?
I don't know what do you think? Maybe you should follow @wallofsheep and #WiFiSheepHunt and find out.


Will you take bribes for clues and help or assistance?
MOST DEFINITELY! FOOD, DRINKS, SWAG, ETC are all fair game. This is DEF CON. Now remember we didn't say they would be good clues but they could be. You have been warned.
 

What if I choose the hack the WiFi Sheep Hunt contest wireless access points route how do I get credit?
You may want to read the fine print at the top (see previous blog post). OR you can show your work to a “farm” hand and they will give you credit. But remember, you can only win in this way if no other Sheep Herder brings all three sheep back to the “farm”. 


There are other ways to play so at least one of the other ways does not involve connecting to a contest access point. You will get notoriety however because we will tweet what you did and give you props!
 

When will the winners be announced?
The winners will be announced at the Packet Hacking Village and on Twitter on or about August 9th at noon. 


NOTE: For logistic reasons YOU MUST BE PRESENT TO WIN A PRIZE! 

I repeat YOU MUST BE PRESENT TO WIN A PRIZE! 

So for example, if you are the 1 st prize winner but are not able to pickup the prize you will get the props on twitter but the prize will be given to the next eligible contestant with the most sheep brought to the “farm”.

DEFCON 23: Find our "sheeps" (radio transmitting beacons)

$
0
0
WiFi Sheep Hunt – Sheep Herder Type 2:

How To Play – Instructions
This type of sheep herder has no computing device whatsoever, which in some cases may be a wise choice at DEF CON, but wants to join in on the fun.

You do not need a phone.
You do not need a tablet.
You do not need a computer.

Your goal as a  herder Type 2 is to use your senses and our military grade beacon finding equipment to find our radio transmitting beacons.

But wait, once you found those beacons you must listen carefully as those beacons are transmitting morse code that much be deciphered. By deciphering each of the three beacon's morse code correctly you have successfully brought a sheep home to it's “farm”.



TOOLS: 'tcpdump'

$
0
0

12 Tcpdump Commands – A Network Sniffer Tool


How to Install tcpdump in Linux

Many of Linux distributions already shipped with tcpdump tool, if in case you don’t have it on systems, you can install it using following Yum command.
# yum install tcpdump
Once tcpdump tool is installed on systems, you can continue to browse following commands with their examples.

1. Capture Packets from Specific Interface

The command screen will scroll up until you interrupt and when we execute tcpdumpcommand it will captures from all the interfaces, however with -i switch only capture from desire interface.
# tcpdump -i eth0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:33:31.976358 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 3500440357:3500440553, ack 3652628334, win 18760, length 196
11:33:31.976603 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 196, win 64487, length 0
11:33:31.977243 ARP, Request who-has tecmint.com tell 172.16.25.126, length 28
11:33:31.977359 ARP, Reply tecmint.com is-at 00:14:5e:67:26:1d (oui Unknown), length 46
11:33:31.977367 IP 172.16.25.126.54807 > tecmint.com: 4240+ PTR? 125.25.16.172.in-addr.arpa. (44)
11:33:31.977599 IP tecmint.com > 172.16.25.126.54807: 4240 NXDomain 0/1/0 (121)
11:33:31.977742 IP 172.16.25.126.44519 > tecmint.com: 40988+ PTR? 126.25.16.172.in-addr.arpa. (44)
11:33:32.028747 IP 172.16.20.33.netbios-ns > 172.16.31.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
11:33:32.112045 IP 172.16.21.153.netbios-ns > 172.16.31.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
11:33:32.115606 IP 172.16.21.144.netbios-ns > 172.16.31.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
11:33:32.156576 ARP, Request who-has 172.16.16.37 tell old-oraclehp1.midcorp.mid-day.com, length 46
11:33:32.348738 IP tecmint.com > 172.16.25.126.44519: 40988 NXDomain 0/1/0 (121)

2. Capture Only N Number of Packets

When you run tcpdump command it will capture all the packets for specified interface, until you Hit cancel button. But using -c option, you can capture specified number of packets. The below example will only capture 6 packets.
# tcpdump -c 5 -i eth0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:40:20.281355 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 3500447285:3500447481, ack 3652629474, win 18760, length 196
11:40:20.281586 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 196, win 65235, length 0
11:40:20.282244 ARP, Request who-has tecmint.com tell 172.16.25.126, length 28
11:40:20.282360 ARP, Reply tecmint.com is-at 00:14:5e:67:26:1d (oui Unknown), length 46
11:40:20.282369 IP 172.16.25.126.53216 > tecmint.com.domain: 49504+ PTR? 125.25.16.172.in-addr.arpa. (44)
11:40:20.332494 IP tecmint.com.netbios-ssn > 172.16.26.17.nimaux: Flags [P.], seq 3058424861:3058424914, ack 693912021, win 64190, length 53 NBT Session Packet: Session Message
6 packets captured
23 packets received by filter
0 packets dropped by kernel

3. Print Captured Packets in ASCII

The below tcpdump command with option -A displays the package in ASCII format. It is a character-encoding scheme format.
# tcpdump -A -i eth0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:31:31.347508 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 3329372346:3329372542, ack 4193416789, win 17688, length 196
M.r0...vUP.E.X.......~.%..>N..oFk.........KQ..)Eq.d.,....r^l......m\.oyE....-....g~m..Xy.6..1.....c.O.@...o_..J....i.*.....2f.mQH...Q.c...6....9.v.gb........;..4.).UiCY]..9..x.)..Z.XF....'|..E......M..u.5.......ul
09:31:31.347760 IP 192.168.0.1.nokia-ann-ch1 > 192.168.0.2.ssh: Flags [.], ack 196, win 64351, length 0
M....vU.r1~P.._..........
^C09:31:31.349560 IP 192.168.0.2.46393 > b.resolvers.Level3.net.domain: 11148+ PTR? 1.0.168.192.in-addr.arpa. (42)
E..F..@.@............9.5.2.f+............1.0.168.192.in-addr.arpa.....

3 packets captured
11 packets received by filter
0 packets dropped by kernel

4. Display Available Interfaces

To list number of available interfaces on the system, run the following command with -Doption.
# tcpdump -D

1.eth0
2.eth1
3.usbmon1 (USB bus number 1)
4.usbmon2 (USB bus number 2)
5.usbmon3 (USB bus number 3)
6.usbmon4 (USB bus number 4)
7.usbmon5 (USB bus number 5)
8.any (Pseudo-device that captures on all interfaces)
9.lo

5. Display Captured Packets in HEX and ASCII

The following command with option -XX capture the data of each packet, including its link level header in HEX and ASCII format.
# tcpdump -XX -i eth0

11:51:18.974360 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 3509235537:3509235733, ack 3652638190, win 18760, length 196
0x0000: b8ac 6f2e 57b3 0001 6c99 1468 0800 4510 ..o.W...l..h..E.
0x0010: 00ec 8783 4000 4006 275d ac10 197e ac10 ....@.@.']...~..
0x0020: 197d 0016 1129 d12a af51 d9b6 d5ee 5018 .}...).*.Q....P.
0x0030: 4948 8bfa 0000 0e12 ea4d 22d1 67c0 f123 IH.......M".g..#
0x0040: 9013 8f68 aa70 29f3 2efc c512 5660 4fe8 ...h.p).....V`O.
0x0050: 590a d631 f939 dd06 e36a 69ed cac2 95b6 Y..1.9...ji.....
0x0060: f8ba b42a 344b 8e56 a5c4 b3a2 ed82 c3a1 ...*4K.V........
0x0070: 80c8 7980 11ac 9bd7 5b01 18d5 8180 4536 ..y.....[.....E6
0x0080: 30fd 4f6d 4190 f66f 2e24 e877 ed23 8eb0 0.OmA..o.$.w.#..
0x0090: 5a1d f3ec 4be4 e0fb 8553 7c85 17d9 866f Z...K....S|....o
0x00a0: c279 0d9c 8f9d 445b 7b01 81eb 1b63 7f12 .y....D[{....c..
0x00b0: 71b3 1357 52c7 cf00 95c6 c9f6 63b1 ca51 q..WR.......c..Q
0x00c0: 0ac6 456e 0620 38e6 10cb 6139 fb2a a756 ..En..8...a9.*.V
0x00d0: 37d6 c5f3 f5f3 d8e8 3316 d14f d7ab fd93 7.......3..O....
0x00e0: 1137 61c1 6a5c b4d1 ddda 380a f782 d983 .7a.j\....8.....
0x00f0: 62ff a5a9 bb39 4f80 668a b....9O.f.
11:51:18.974759 IP 172.16.25.126.60952 > mddc-01.midcorp.mid-day.com.domain: 14620+ PTR? 125.25.16.172.in-addr.arpa. (44)
0x0000: 0014 5e67 261d 0001 6c99 1468 0800 4500 ..^g&...l..h..E.
0x0010: 0048 5a83 4000 4011 5e25 ac10 197e ac10 .HZ.@.@.^%...~..
0x0020: 105e ee18 0035 0034 8242 391c 0100 0001 .^...5.4.B9.....
0x0030: 0000 0000 0000 0331 3235 0232 3502 3136 .......125.25.16
0x0040: 0331 3732 0769 6e2d 6164 6472 0461 7270 .172.in-addr.arp
0x0050: 6100 000c 0001 a.....

6. Capture and Save Packets in a File

As we said, that tcpdump has a feature to capture and save the file in a .pcap format, to do this just execute command with -w option.
# tcpdump -w 0001.pcap -i eth0

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
4 packets captured
4 packets received by filter
0 packets dropped by kernel

7. Read Captured Packets File

To read and analyze captured packet 0001.pcap file use the command with -r option, as shown below.
# tcpdump -r 0001.pcap

reading from file 0001.pcap, link-type EN10MB (Ethernet)
09:59:34.839117 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 3353041614:3353041746, ack 4193563273, win 18760, length 132
09:59:34.963022 IP 192.168.0.1.nokia-ann-ch1 > 192.168.0.2.ssh: Flags [.], ack 132, win 65351, length 0
09:59:36.935309 IP 192.168.0.1.netbios-dgm > 192.168.0.255.netbios-dgm: NBT UDP PACKET(138)
09:59:37.528731 IP 192.168.0.1.nokia-ann-ch1 > 192.168.0.2.ssh: Flags [P.], seq 1:53, ack 132, win 65351, length 5

8. Capture IP address Packets

To capture packets for a specific interface, run the following command with option -n.
# tcpdump -n -i eth0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:07:03.952358 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 3509512873:3509513069, ack 3652639034, win 18760, length 196
12:07:03.952602 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 196, win 64171, length 0
12:07:03.953311 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 196:504, ack 1, win 18760, length 308
12:07:03.954288 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 504:668, ack 1, win 18760, length 164
12:07:03.954502 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 668, win 65535, length 0
12:07:03.955298 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 668:944, ack 1, win 18760, length 276
12:07:03.955425 IP 172.16.23.16.netbios-ns > 172.16.31.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
12:07:03.956299 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 944:1236, ack 1, win 18760, length 292
12:07:03.956535 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 1236, win 64967, length 0

9. Capture only TCP Packets.

To capture packets based on TCP port, run the following command with option tcp.
# tcpdump -i eth0 tcp

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:10:36.216358 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 3509646029:3509646225, ack 3652640142, win 18760, length 196
12:10:36.216592 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 196, win 64687, length 0
12:10:36.219069 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 196:504, ack 1, win 18760, length 308
12:10:36.220039 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 504:668, ack 1, win 18760, length 164
12:10:36.220260 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 668, win 64215, length 0
12:10:36.222045 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 668:944, ack 1, win 18760, length 276
12:10:36.223036 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 944:1108, ack 1, win 18760, length 164
12:10:36.223252 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 1108, win 65535, length 0
^C12:10:36.223461 IP mid-pay.midcorp.mid-day.com.netbios-ssn > 172.16.22.183.recipe: Flags [.], seq 283256512:283256513, ack 550465221, win 65531, length 1[|SMB]

10. Capture Packet from Specific Port

Let’s say you want to capture packets for specific port 22, execute the below command by specifying port number 22 as shown below.
# tcpdump -i eth0 port 22

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:37:49.056927 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 3364204694:3364204890, ack 4193655445, win 20904, length 196
10:37:49.196436 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 4294967244:196, ack 1, win 20904, length 248
10:37:49.196615 IP 192.168.0.1.nokia-ann-ch1 > 192.168.0.2.ssh: Flags [.], ack 196, win 64491, length 0
10:37:49.379298 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 196:616, ack 1, win 20904, length 420
10:37:49.381080 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 616:780, ack 1, win 20904, length 164
10:37:49.381322 IP 192.168.0.1.nokia-ann-ch1 > 192.168.0.2.ssh: Flags [.], ack 780, win 65535, length 0

11. Capture Packets from source IP

To capture packets from source IP, say you want to capture packets for 192.168.0.2, use the command as follows.
# tcpdump -i eth0 src 192.168.0.2

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:49:15.746474 IP 192.168.0.2.ssh > 192.168.0.1.nokia-ann-ch1: Flags [P.], seq 3364578842:3364579038, ack 4193668445, win 20904, length 196
10:49:15.748554 IP 192.168.0.2.56200 > b.resolvers.Level3.net.domain: 11289+ PTR? 1.0.168.192.in-addr.arpa. (42)
10:49:15.912165 IP 192.168.0.2.56234 > b.resolvers.Level3.net.domain: 53106+ PTR? 2.0.168.192.in-addr.arpa. (42)
10:49:16.074720 IP 192.168.0.2.33961 > b.resolvers.Level3.net.domain: 38447+ PTR? 2.2.2.4.in-addr.arpa. (38)

12. Capture Packets from destination IP

To capture packets from destination IP, say you want to capture packets for 50.116.66.139, use the command as follows.
# tcpdump -i eth0 dst 50.116.66.139

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:55:01.798591 IP 192.168.0.2.59896 > 50.116.66.139.http: Flags [.], ack 2480401451, win 318, options [nop,nop,TS val 7955710 ecr 804759402], length 0
10:55:05.527476 IP 192.168.0.2.59894 > 50.116.66.139.http: Flags [F.], seq 2521556029, ack 2164168606, win 245, options [nop,nop,TS val 7959439 ecr 804759284], length 0
10:55:05.626027 IP 192.168.0.2.59894 > 50.116.66.139.http: Flags [.], ack 2, win 245, options [nop,nop,TS val 7959537 ecr 804759787], length 0
This article may help you to explore tcpdump command in depth and also to capture and analysis packets in future. There are number of options available, you can use the options as per your requirement. Please share if you find this article useful through our comment box.

20 Basic Linux Commands

$
0
0
from: http://www.tecmint.com/useful-linux-commands-for-newbies/
as noted before, all blog entries are utilized as my personal repository for tools and stuff. 

1. Command: ls

The command “ls” stands for (List Directory Contents), List the contents of the folder, be it file or folder, from which it runs.
root@tecmint:~# ls

Android-Games Music
Pictures Public
Desktop Tecmint.com
Documents TecMint-Sync
Downloads Templates
The command “ls -l” list the content of folder, in long listing fashion.
root@tecmint:~# ls -l

total 40588
drwxrwxr-x 2 ravisaive ravisaive 4096 May 8 01:06 Android Games
drwxr-xr-x 2 ravisaive ravisaive 4096 May 15 10:50 Desktop
drwxr-xr-x 2 ravisaive ravisaive 4096 May 16 16:45 Documents
drwxr-xr-x 6 ravisaive ravisaive 4096 May 16 14:34 Downloads
drwxr-xr-x 2 ravisaive ravisaive 4096 Apr 30 20:50 Music
drwxr-xr-x 2 ravisaive ravisaive 4096 May 9 17:54 Pictures
drwxrwxr-x 5 ravisaive ravisaive 4096 May 3 18:44 Tecmint.com
drwxr-xr-x 2 ravisaive ravisaive 4096 Apr 30 20:50 Templates
Command “ls -a“, list the content of folder, including hidden files starting with ‘.’.
root@tecmint:~# ls -a

. .gnupg .dbus .goutputstream-PI5VVW .mission-control
.adobe deja-dup .grsync .mozilla .themes
.gstreamer-0.10 .mtpaint .thumbnails .gtk-bookmarks .thunderbird
.HotShots .mysql_history .htaccess .apport-ignore.xml .ICEauthority
.profile .bash_history .icons .bash_logout .fbmessenger
.jedit .pulse .bashrc .liferea_1.8 .pulse-cookie
.Xauthority .gconf .local .Xauthority.HGHVWW .cache
.gftp .macromedia .remmina .cinnamon .gimp-2.8
.ssh .xsession-errors .compiz .gnome teamviewer_linux.deb
.xsession-errors.old .config .gnome2 .zoncolor
Note: In Linux file name starting with ‘.‘ is hidden. In Linux every file/folder/device/command is a file. The output of ls -l is:
  1. d (stands for directory).
  2. rwxr-xr-x is the file permission of the file/folder for owner, group and world.
  3. The 1st ravisaive in the above example means that file is owned by user ravisaive.
  4. The 2nd ravisaive in the above example means file belongs to user group ravisaive.
  5. 4096 means file size is 4096 Bytes.
  6. May 8 01:06 is the date and time of last modification.
  7. And at the end is the name of the File/Folder.
For more “ls” command examples read 15 ‘ls’ Command Examples in Linux.

2. Command: lsblk

The “lsblk” stands for (List Block Devices), print block devices by their assigned name (but not RAM) on the standard output in a tree-like fashion.
root@tecmint:~# lsblk

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 232.9G 0 disk
├─sda1 8:1 0 46.6G 0 part /
├─sda2 8:2 0 1K 0 part
├─sda5 8:5 0 190M 0 part /boot
├─sda6 8:6 0 3.7G 0 part [SWAP]
├─sda7 8:7 0 93.1G 0 part /data
└─sda8 8:8 0 89.2G 0 part /personal
sr0 11:0 1 1024M 0 rom
The “lsblk -l” command list block devices in ‘list‘ structure (not tree like fashion).
root@tecmint:~# lsblk -l

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 232.9G 0 disk
sda1 8:1 0 46.6G 0 part /
sda2 8:2 0 1K 0 part
sda5 8:5 0 190M 0 part /boot
sda6 8:6 0 3.7G 0 part [SWAP]
sda7 8:7 0 93.1G 0 part /data
sda8 8:8 0 89.2G 0 part /personal
sr0 11:0 1 1024M 0 rom
Note: lsblk is very useful and easiest way to know the name of New Usb Device you just plugged in, especially when you have to deal with disk/blocks in terminal.

3. Command: md5sum

The “md5sum” stands for (Compute and Check MD5 Message Digest), md5 checksum (commonly called hash) is used to match or verify integrity of files that may have changed as a result of a faulty file transfer, a disk error or non-malicious interference.
root@tecmint:~# md5sum teamviewer_linux.deb 

47790ed345a7b7970fc1f2ac50c97002 teamviewer_linux.deb
Note: The user can match the generated md5sum with the one provided officially. Md5sum is considered less secure than sha1sum, which we will discuss later.

4. Command: dd

Command “dd” stands for (Convert and Copy a file), Can be used to convert and copy a file and most of the times is used to copy a iso file (or any other file) to a usb device (or any other location), thus can be used to make a ‘Bootlable‘ Usb Stick.
root@tecmint:~# dd if=/home/user/Downloads/debian.iso of=/dev/sdb1 bs=512M; sync
Note: In the above example the usb device is supposed to be sdb1 (You should Verify it using command lsblk, otherwise you will overwrite your disk and OS), use name of disk very Cautiously!!!.
dd command takes some time ranging from a few seconds to several minutes in execution, depending on the size and type of file and read and write speed of Usb stick.

5. Command: uname

The “uname” command stands for (Unix Name), print detailed information about the machine name, Operating System and Kernel.
root@tecmint:~# uname -a

Linux tecmint 3.8.0-19-generic #30-Ubuntu SMP Wed May 1 16:36:13 UTC 2013 i686 i686 i686 GNU/Linux
Note: uname shows type of kernel. uname -a output detailed information. Elaborating the above output of uname -a.
  1. Linux“: The machine’s kernel name.
  2. tecmint“: The machine’s node name.
  3. 3.8.0-19-generic“: The kernel release.
  4. #30-Ubuntu SMP“: The kernel version.
  5. i686“: The architecture of the processor.
  6. GNU/Linux“: The operating system name.

6. Command: history

The “history” command stands for History (Event) Record, it prints the history of long list of executed commands in terminal.
root@tecmint:~# history

1 sudo add-apt-repository ppa:tualatrix/ppa
2 sudo apt-get update
3 sudo apt-get install ubuntu-tweak
4 sudo add-apt-repository ppa:diesch/testing
5 sudo apt-get update
6 sudo apt-get install indicator-privacy
7 sudo add-apt-repository ppa:atareao/atareao
8 sudo apt-get update
9 sudo apt-get install my-weather-indicator
10 pwd
11 cd && sudo cp -r unity/6 /usr/share/unity/
12 cd /usr/share/unity/icons/
13 cd /usr/share/unity
Note: Pressing “Ctrl + R” and then search for already executed commands which lets your command to be completed with auto completion feature.
(reverse-i-search)`if': ifconfig

7. Command: sudo

The “sudo” (super user do) command allows a permitted user to execute a command as the superuser or another user, as specified by the security policy in the sudoers list.
root@tecmint:~# sudo add-apt-repository ppa:tualatrix/ppa
Note: sudo allows user to borrow superuser privileged, while a similar command ‘su‘ allows user to actually log in as superuser. Sudo is safer than su.
It is not advised to use sudo or su for day-to-day normal use, as it can result in serious error if accidentally you did something wrong, that’s why a very popular saying in Linux community is:
“To err is human, but to really foul up everything, you need root password.”

8. Command: mkdir

The “mkdir” (Make directory) command create a new directory with name path. However is the directory already exists, it will return an error message “cannot create folder, folder already exists”.
root@tecmint:~# mkdir tecmint
Note: Directory can only be created inside the folder, in which the user has write permission. mkdir: cannot create directory `tecmint‘: File exists
(Don’t confuse with file in the above output, you might remember what i said at the beginning – In Linux every file, folder, drive, command, scripts are treated as file).

9. Command: touch

The “touch” command stands for (Update the access and modification times of each FILE to the current time). touch command creates the file, only if it doesn’t exist. If the file already exists it will update the timestamp and not the contents of the file.
root@tecmint:~# touch tecmintfile
Note: touch can be used to create file under directory, on which the user has write permission, only if the file don’t exist there.

10. Command: chmod

The Linux “chmod” command stands for (change file mode bits). chmod changes the file mode (permission) of each given file, folder, script, etc.. according to mode asked for.
There exist 3 types of permission on a file (folder or anything but to keep things simple we will be using file).
Read (r)=4
Write(w)=2
Execute(x)=1
So if you want to give only read permission on a file it will be assigned a value of ‘4‘, for write permission only, a value of ‘2‘ and for execute permission only, a value of ‘1‘ is to be given. For read and write permission 4+2 = ‘6‘ is to be given, ans so on.
Now permission need to be set for 3 kinds of user and usergroup. The first is owner, then usergroup and finally world.
rwxr-x--x   abc.sh
Here the root’s permission is rwx (read, write and execute).
usergroup to which it belongs, is r-x (read and execute only, no write permission) and
for world is –x (only execute).
To change its permission and provide read, write and execute permission to owner, group and world.
root@tecmint:~# chmod 777 abc.sh
only read and write permission to all three.
root@tecmint:~# chmod 666 abc.sh
read, write and execute to owner and only execute to group and world.
root@tecmint:~# chmod 711 abc.sh
Note: one of the most important command useful for sysadmin and user both. On a multi-user environment or on a server, this command comes to rescue, setting wrong permission will either makes a file inaccessible or provide unauthorized access to someone.

11. Command: chown

The Linux “chown” command stands for (change file owner and group). Every file belongs to a group of user and a owner. It is used Do ‘ls -l‘ into your directory and you will see something like this.
root@tecmint:~# ls -l 

drwxr-xr-x 3 server root 4096 May 10 11:14 Binary
drwxr-xr-x 2 server server 4096 May 13 09:42 Desktop
Here the directory Binary is owned by user “server” and it belongs to usergroup “root” where as directory “Desktop” is owned by user “server” and belongs to user group “server“.
This “chown” command is used to change the file ownership and thus is useful in managing and providing file to authorised user and usergroup only.
root@tecmint:~# chown server:server Binary

drwxr-xr-x 3 server server 4096 May 10 11:14 Binary
drwxr-xr-x 2 server server 4096 May 13 09:42 Desktop
Note: “chown” changes the user and group ownership of each given FILE to NEW-OWNER or to the user and group of an existing reference file.

12. Command: apt

The Debian based “apt” command stands for (Advanced Package Tool). Apt is an advanced package manager for Debian based system (Ubuntu, Kubuntu, etc.), that automatically and intelligently search, install, update and resolves dependency of packages on Gnu/Linux system from command line.
root@tecmint:~# apt-get install mplayer

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
java-wrappers
Use 'apt-get autoremove' to remove it.
The following extra packages will be installed:
esound-common libaudiofile1 libesd0 libopenal-data libopenal1 libsvga1 libvdpau1 libxvidcore4
Suggested packages:
pulseaudio-esound-compat libroar-compat2 nvidia-vdpau-driver vdpau-driver mplayer-doc netselect fping
The following NEW packages will be installed:
esound-common libaudiofile1 libesd0 libopenal-data libopenal1 libsvga1 libvdpau1 libxvidcore4 mplayer
0 upgraded, 9 newly installed, 0 to remove and 8 not upgraded.
Need to get 3,567 kB of archives.
After this operation, 7,772 kB of additional disk space will be used.
Do you want to continue [Y/n]? y
root@tecmint:~# apt-get update

Hit http://ppa.launchpad.net raring Release.gpg
Hit http://ppa.launchpad.net raring Release.gpg
Hit http://ppa.launchpad.net raring Release.gpg
Hit http://ppa.launchpad.net raring Release.gpg
Get:1 http://security.ubuntu.com raring-security Release.gpg [933 B]
Hit http://in.archive.ubuntu.com raring Release.gpg
Hit http://ppa.launchpad.net raring Release.gpg
Get:2 http://security.ubuntu.com raring-security Release [40.8 kB]
Ign http://ppa.launchpad.net raring Release.gpg
Get:3 http://in.archive.ubuntu.com raring-updates Release.gpg [933 B]
Hit http://ppa.launchpad.net raring Release.gpg
Hit http://in.archive.ubuntu.com raring-backports Release.gpg
Note: The above commands results into system-wide changes and hence requires root password (Check ‘#‘ and not ‘$’ as prompt). Apt is considered more advanced and intelligent as compared to yum command.
As the name suggest, apt-cache search for package containing sub package mpalyer. apt-get install, update all the packages, that are already installed, to the newest one.
Read more about apt-get and apt-cache commands at 25 APT-GET and APT-CACHE Commands

13. Command: tar

The “tar” command is a Tape Archive is useful in creation of archive, in a number of file format and their extraction.
root@tecmint:~# tar -zxvf abc.tar.gz (Remember 'z' for .tar.gz)
root@tecmint:~# tar -jxvf abc.tar.bz2 (Remember 'j' for .tar.bz2)
root@tecmint:~# tar -cvf archieve.tar.gz(.bz2) /path/to/folder/abc
Note: A ‘tar.gz‘ means gzipped. ‘tar.bz2‘ is compressed with bzip which uses a better but slower compression method.
Read more about “tar command” examples at 18 Tar Command Examples

14. Command: cal

The “cal” (Calendar), it is used to displays calendar of the present month or any other month of any year that is advancing or passed.
root@tecmint:~# cal 

May 2013
Su Mo Tu We Th Fr Sa
1 2 3 4
5 6 7 8 9 10 11
12 13 14 15 16 17 18
19 20 21 22 23 24 25
26 27 28 29 30 31
Show calendar of year 1835 for month February, that already has passed.
root@tecmint:~# cal 02 1835

February 1835
Su Mo Tu We Th Fr Sa
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
Shows calendar of year 2145 for the month of July, that will advancing
root@tecmint:~# cal 07 2145

July 2145
Su Mo Tu We Th Fr Sa
1 2 3
4 5 6 7 8 9 10
11 12 13 14 15 16 17
18 19 20 21 22 23 24
25 26 27 28 29 30 31
Note: You need not to turn the calendar of 50 years back, neither you need to make complex mathematical calculation to know what day you were worn or your coming birthday will fall on which day.

15. Command: date

The “date” (Date) command print the current date and time on the standard output, and can further be set.
root@tecmint:~# date

Fri May 17 14:13:29 IST 2013
root@tecmint:~# date --set='14 may 2013 13:57'

Mon May 13 13:57:00 IST 2013
Note: This Command will be very use-full in scripting, time and date based scripting, to be more perfect. Moreover changing date and time using terminal will make you feel GEEK!!!. (Obviously you need to be root to perform this operation, as it is a system wide change).

16. Command: cat

The “cat” stands for (Concatenation). Concatenate (join) two or more plain file and/or print contents of a file on standard output.
root@tecmint:~# cat a.txt b.txt c.txt d.txt >> abcd.txt
root@tecmint:~# cat abcd.txt
....
contents of file abcd
...
Note: “>>” and “>” are called append symbol. They are used to append the output to a file and not on standard output. “>” symbol will delete a file already existed and create a new file hence for security reason it is advised to use “>>” that will write the output without overwriting or deleting the file.
Before Proceeding further, I must let you know about wildcards (you would be aware of wildcard entry, in most of the Television shows) Wildcards are a shell feature that makes the command line much more powerful than any GUI file managers. You see, if you want to select a big group of files in a graphical file manager, you usually have to select them with your mouse. This may seem simple, but in some cases it can be very frustrating.
For example, suppose you have a directory with a huge amount of all kinds of files and subdirectories, and you decide to move all the HTML files, that have the word “Linux” somewhere in the middle of their names, from that big directory into another directory. What’s a simple way to do this? If the directory contains a huge amount of differently named HTML files, your task is everything but simple!
In the Linux CLI that task is just as simple to perform as moving only one HTML file, and it’s so easy because of the shell wildcards. These are special characters that allow you to select file names that match certain patterns of characters. This helps you to select even a big group of files with typing just a few characters, and in most cases it’s easier than selecting the files with a mouse.
Here’s a list of the most commonly used wildcards :
WildcardMatches
* zero or more characters
? exactly one character
[abcde] exactly one character listed
[a-e] exactly one character in the given range
[!abcde] any character that is not listed
[!a-e] any character that is not in the given range
{debian,linux} exactly one entire word in the options given
! is called not symbol, and the reverse of string attached with ‘!’ is true.
Read more examples of Linux “cat command” at 13 Cat Command Examples in Linux

17. Command: cp

The “copy” stands for (Copy), it copies a file from one location to another location.
root@tecmint:~# cp /home/user/Downloads abc.tar.gz /home/user/Desktop (Return 0 when sucess)
Note: cp is one of the most commonly used command in shell scripting and it can be used with wildcard characters (Describe in the above block), for customised and desired file copying.

18. Command: mv

The “mv” command moves a file from one location to another location.
root@tecmint:~# mv /home/user/Downloads abc.tar.gz /home/user/Desktop (Return 0 when sucess)
Note: mv command can be used with wildcard characters. mv should be used with caution, as moving of system/unauthorised file may lead to security as well as breakdown of system.

19. Command: pwd

The command “pwd” (print working directory), prints the current working directory with full path name from terminal.
root@tecmint:~# pwd 

/home/user/Desktop
Note: This command won’t be much frequently used in scripting but it is an absolute life saver for newbie who gets lost in terminal in their early connection with nux. (Linux is most commonly referred as nux or nix).

20. Command: cd

Finally, the frequently used “cd” command stands for (change directory), it change the working directory to execute, copy, move write, read, etc. from terminal itself.
root@tecmint:~# cd /home/user/Desktop
server@localhost:~$ pwd

/home/user/Desktop
Note: cd comes to rescue when switching between directories from terminal. “Cd ~” will change the working directory to user’s home directory, and is very useful if a user finds himself lost in terminal. “Cd ..” will change the working directory to parent directory (of current working directory).
These commands will surely make you comfortable with Linux. But it’s not the end. Very soon I will be coming with other commands which will be useful for ‘Middle Level User‘ i.e., You! No don’t exclaim, if you get used-to these commands, You will notice promotion in user-level from newbie to Middle-level-user. In the next article, I will be coming up with commands like ‘Kill‘, ‘Ps‘, ‘grep‘,….Wait for the article and I don’t want to spoil your interest.

WIFISH: Fox Hunting with a Handheld Radio

$
0
0

Foxhunting with a Handheld Radio

NOTE: I've have not tried this personally but will update this blog when I get the chance to test this technique.  The information below are excerpts  from: http://www.homingin.com/equipment.html

Handie-Talkie Tricks

(Adapted from a handout given to first-timers at southern California two-meter international-style foxhunts.) 

If you are a typical ham radio operator, all you need to get started quickly and find foxes successfully is your VHF/UHF handi-talkie (HT) or scanner and some simple accessories.  

The most elementary way is called the "body fade" or "body shield" technique.  Hold your HT tight against your chest and turn around slowly, looking for the direction at which your body blocks the signal most effectively (the signal null).  At this point, the signal is coming from behind you.  Walk in the direction of the null, taking bearings at regular intervals, and observe the signal strength get stronger.

When the signal is so strong that you can't find the null, tune 5 or 10 KHz off frequency to put the signal into the skirts of the receiver's IF passband.  If your hand-held is dual-band (144/440 MHz) and you are hunting on two meters, try tuning to the much weaker third harmonic of the signal in the 70 cm band while performing the "body shield."


Disconnecting the HT's "rubber duck" antenna will knock down the signal even more.  Hearing the signal with antenna off is usually a "You are here!" indicator.  Some foxtailers wrap aluminum foil around their HTs to attenuate the signal even more.  
WARNING: If you do this, be sure to put insulating tape over the battery charging terminals on the bottom of the set first.  You might damage the radio by shorting these terminals with the foil.


The "body fade" null, which is rather shallow to begin with, can be filled in by signal reflections (multipath), nearby objects, etc.  When using this method, stay away from large buildings, chain-link fences, metal signs, and the like.  If you do not get a good null, move to a clearer location and try again.

Ten Essential WiFi Hacking Tools

$
0
0
Note: All the information below are from http://www.hackingtutorials.org/wifi-hacking-tutorials/ - for additional cool WiFi info visit their website. 
In this top 10 Wifi Hacking Tools we will be talking about a very popular subject: hacking wireless networks and how to prevent it from being hacked. Wifi is often a vulnerable side of the network when it comes to hacking since signals can be picked up everywhere and by anyone. Router manufacturers and ISPs turning on WPS by default makes wireless security and penetration testing even more important. With the following top 10 Wifi hacking tools we are able to test our own wireless networks for potential security issues. Let’s start off the top 10 Wifi Hacking Tools with the first tool:

1 Aircrack-ng

Aircrack is one of the most popular tools for WEP/WPA/WPA2 cracking. The Aircrack-ng suite contains tools to capture packets and handshakes, de-authenticate connected clients and generate traffic and tools to perform brute force and dictionary attacks. Aicrack-ng is an all-in-one suite containing the following tools (among others):
– Aircrack-ng for wireless password cracking
– Aireplay-ng to generate traffic and client de-authentication
– Airodump-ng for packet capturing
– Airbase-ng to configure fake access points
The Aicrack-ng suite is available for Linux and comes standard with Kali Linux. If you plan to use this tool you have to make sure your Wifi card is capable of packet injection.

Aircrack-ng aireplay-ng WPA Handshake

2 Reaver

Number 2 in the top 10 Wifi hacking tools is Reaver. Reaver is another popular tool for hacking wireless networks and targets specifically WPS vulnerabilities. Reaver performs brute force attacks against Wifi Protected Setup (WPS) registrar PINs to recover the WPA/WPA2 passphrase. Since many router manufacturers and ISPs turn on WPS by default a lot of routers are vulnerable to this attack out of the box.
In order to use Reaver you need a good signal strength to the wireless router together with the right configuration. On average Reaver can recover the passphrase from vulnerable routers in 4-10 hours, depending on the access point, signal strength and the PIN itself off course. Statistically you have a 50% chance of cracking the WPS PIN in half of the time.

Pixie Dust attack

3 Pixiewps

PixieWPS is a relatively new tool included with Kali Linux and also targets a WPS vulnerability. PixieWPS is written in C and is used to brute force the WPS PIN offline exploiting the low or non-existing entropy of vulnerable access points. This is called a pixie dust attack. PixieWPS requires a modified version of Reaver or Wifite to work with. Since this tools has become quite popular in little time, it earns the number 3 in our top 10 Wifi hacking tools list.

Pixie Dust attack

4 Wifite

Wifite is an automated tool to attack multiple wireless networks encrypted with WEP/WPA/WPA2 and WPS. On start-up Wifite requires a few parameters to work with and Wifite will do all the hard work. It will capture WPA handshakes, automatically de-authenticate connected clients, spoof your MAC address and safe the cracked passwords.


5 Wireshark

Wireshark is one of the best network protocal analyzer tools available, if not the best. With Wireshark you can analyse a network to the greatest detail to see what’s happening. Wireshark can be used for live packet capturing, deep inspection of hundreds of protocols, browse and filter packets and is multiplatform.
Wireshark is included with Kali Linux but also available for Windows and Mac. For certain features you do need a Wifi adapter which is supports promiscuous and monitoring mode.


6 oclHashcat

Number 6 in our top 10 Wifi hacking tools is oclHashcat. oclHashcat is not a dedicated Wifi hacking tool and is not included with Kali Linux, but it can do brute force and dictionary attacks on captured handshakes very fast when using a GPU. After using the Aircrack-ng suite, or any other tool, to capture the WPA handshake you can crack it with oclHashcat using your GPU. Using a GPU with oclHashcat, instead of a CPU with Aicrack-ng, will speed up the cracking process a lot. An average GPU can try about 50.000 combinations per second with oclHashcat.
oclHashcat is available for Windows and Linux and has a version for AMD and Nvidia video cards. AMD video cards require Catalyst 14.9 exactly and Nvidia video cards require ForceWare 346.x or later to work.

oclhashcat

7 Fern Wifi Cracker

Fern Wifi Cracker is a wireless security auditing and attack tool written in Python. Fern Wifi Cracker is the first dedicated Wifi hacking tool in this list which has an graphical user interface. Fern is able to crack and recover WEP, WPA and WPS keys and contains tools to perfom MiTM attacks.
Fern Wifi Cracker runs on any Linux distribution which contains the prerequisites. Fern Wifi Cracker is included with Kali Linux.


8 Wash

Wash is a tool to determine whether an access point has WPS enabled or not. You can also use Wash to check if an access point locked up WPS after a number of Reaver attempts. A lot of access points locks itself up as a security measure when brute forcing the WPS PIN. Wash is included with the Reaver package and comes as a standard tool with Kali Linux.

Wash-WPS-locks wifi hacking tools Top 10 Wifi Hacking Tools

9 Crunch

Crunch is a great and easy to use tool for generating custom wordlists which can be used for dictionary attacks. Since the success rate of every dictionary attack depends on the quality of the used wordlist, you cannot avoid creating your own wordlist. Especially when you want to create wordlists based on default router passwords. Crunch can also be piped directly to other tools like Aircrack-ng. This feature can save a lot of time since you won’t have to wait until large password lists have been generated by Crunch before you can use them.

Crunch Password List generation Top 10 Wifi Hacking Tools

10 Macchanger

Last but not least in this top 10 Wifi Hacking Tools is Macchanger. Macchanger is a little utility which can be used to spoof your MAC address to a random MAC address or you can make up your own. Spoofing your MAC address for wifi hacking might be necessary to avoid MAC filters or to mask your identity on a wireless network.

MAC Address spoofing with macchanger

Wireshark 101

$
0
0
NOTE: This article is from another excellent resource called How-To Geek. Visit them at http://www.howtogeek.com/ and learn other cool geeky stuff.
How-To Geek

How to Use Wireshark to Capture, Filter and Inspect Packets


Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format. Wireshark includes filters, color-coding and other features that let you dig deep into network traffic and inspect individual packets.
This tutorial will get you up to speed with the basics of capturing packets, filtering them, and inspecting them. You can use Wireshark to inspect a suspicious program’s network traffic, analyze the traffic flow on your network, or troubleshoot network problems.

Getting Wireshark

You can download Wireshark for Windows or Mac OS X from its official website. If you’re using Linux or another UNIX-like system, you’ll probably find Wireshark in its package repositories. For example, if you’re using Ubuntu, you’ll find Wireshark in the Ubuntu Software Center.
Just a quick warning: Many organizations don’t allow Wireshark and similar tools on their networks. Don’t use this tool at work unless you have permission.

Capturing Packets

After downloading and installing Wireshark, you can launch it and click the name of an interface under Interface List to start capturing packets on that interface. For example, if you want to capture traffic on the wireless network, click your wireless interface. You can configure advanced features by clicking Capture Options, but this isn’t necessary for now.

As soon as you click the interface’s name, you’ll see the packets start to appear in real time. Wireshark captures each packet sent to or from your system. If you’re capturing on a wireless interface and have promiscuous mode enabled in your capture options, you’ll also see other the other packets on the network.

Click the stop capture button near the top left corner of the window when you want to stop capturing traffic.

Color Coding

You’ll probably see packets highlighted in green, blue, and black. Wireshark uses colors to help you identify the types of traffic at a glance. By default, green is TCP traffic, dark blue is DNS traffic, light blue is UDP traffic, and black identifies TCP packets with problems — for example, they could have been delivered out-of-order.

Sample Captures

If there’s nothing interesting on your own network to inspect, Wireshark’s wiki has you covered. The wiki contains a page of sample capture files that you can load and inspect.
Opening a capture file is easy; just click Open on the main screen and browse for a file. You can also save your own captures in Wireshark and open them later.

Filtering Packets

If you’re trying to inspect something specific, such as the traffic a program sends when phoning home, it helps to close down all other applications using the network so you can narrow down the traffic. Still, you’ll likely have a large amount of packets to sift through. That’s where Wireshark’s filters come in.
The most basic way to apply a filter is by typing it into the filter box at the top of the window and clicking Apply (or pressing Enter). For example, type “dns” and you’ll see only DNS packets. When you start typing, Wireshark will help you autocomplete your filter.

You can also click the Analyze menu and select Display Filters to create a new filter.

Another interesting thing you can do is right-click a packet and select Follow TCP Stream.

You’ll see the full conversation between the client and the server.

Close the window and you’ll find a filter has been applied automatically — Wireshark is showing you the packets that make up the conversation.

Inspecting Packets

Click a packet to select it and you can dig down to view its details.

You can also create filters from here — just right-click one of the details and use the Apply as Filter submenu to create a filter based on it.


Wireshark is an extremely powerful tool, and this tutorial is just scratching the surface of what you can do with it. Professionals use it to debug network protocol implementations, examine security problems and inspect network protocol internals.

2016.0128.WEP.WPA

$
0
0

Choosing the right security configuration for your wireless network is very important, especially because hacking is so easy now. Free software tools are now easily available that make it trivial for even unsophisticated "script kiddies" to break into secured wireless networks. Securing your Wi-Fi network with a password is the first step but its efficacy is very low if the security method chosen is WEP. Passwords for Wi-Fi networks secured with WEP can usually be cracked within minutes.[1]WPA2 is the recommended security method for wireless networks today.

Comparison chart

Edit this comparison chart

WEP

WPA

Stands forWired Equivalent PrivacyWi-Fi Protected Access
What is it?A security protocol for wireless networks introduced in 1999 to provide data confidentiality comparable to a traditional wired network.A security protocol developed by the Wi-Fi Alliance in 2003 for use in securing wireless networks; designed to replace the WEP protocol.
MethodsThrough the use of a security algorithm for IEEE 802.11 wireless networks it works to create a wireless network that is as secure as a wired network.As a temporary solution to WEP's problems, WPA still uses WEP's insecure RC4 stream cipher but provides extra security through TKIP.
UsesWireless security through the use of an encryption key.Wireless security through the use of a password.
Authentication methodOpen system authentication or shared key authenticationAuthentication through the use of a 64 digit hexadecimal key or an 8 to 63 character passcode.
WEP and WPA security options while connecting to a wireless network
WEP and WPA security options while connecting to a wireless network

Encryption in a Wi-Fi network

It is possible to "sniff" data being exchanged on a wireless network. This means that if the wireless network is "open" (requires no password), a hacker can access any information transferred between a computer and the wireless router. Not having your Wi-Fi network password-protected also creates problems such as an intruder piggy-backing on your Internet connection, thereby slowing it down or even illegally downloading copyrighted content.
Seucring a Wi-Fi network with a password is, therefore, absolutely essential. WEP and WPA are the two security methods supported almost universally by routers and the devices that connect to them, such as computers, printers, phones or tablets. WEP (Wired Equivalent Privacy) was introduced when the 802.11 standard for Wi-Fi networks was launched. It allows the use of a 64-bit or 128-bit key. However, researchers discovered vulnerabilities in WEP in 2001 and proved that it was possible to break into any WEP network by using a brute-force method to decipher the key. Using WEP is not recommended.
WPA, which stands for Wi-Fi Protected Access, is a newer standard and is much more secure. The first iteration of the WPA protocol used the same cipher (RC4) as WEP but added TKIP (Termporal Key Integrity Protocol) to make it harder to decipher the key. The next version - WPA2 - replaced RC$ with AES (Advanced Encryption Standard) and replaced TKIP with CCMP (Counter mode with Cipher block chaining Message authentication code Protocol). This made WPA2 a better and more secure configuration compared with WPA. WPA2 has two flavors - personal and enterprise.

Other Wi-Fi security best practices

Choosing WPA2 is a good start but there are other things you can do to make your Wi-Fi network even more secure. For example,
  • Do not broadcast SSID: The SSID is the name of the Wi-Fi network. By not broadcasting the SSID, the wireless network becomes "hidden". It will still show up in network scans by devices but they would only see it as "Unidentified Network". When the network broadcasts its SSID (name), the hacker only has to decipher the password. But when the network name is unknown, logging on to the network will require that the intruder must know not only the password but also the SSID.
  • Use a strong password: This one is obvious but bears a mention because it is very important. Computers are very powerful and cloud computing has made it very cheap and easy to rent extraordinarily large raw computational power. This makes brute-force attacks possible, where the hacker tries every combination of letters and numbers until the key is deciphered. A good password has the following characteristics:
    • is longer than 10 characters
    • uses a healthy mix of characters — upper case, lower case, numbers and special characters like ^*
    • is not easily guessable, like a birthday, or name of a family member or pet name
  • Change the default IP address of the router: Virtually all wireless routers are preconfigured to use 192.168.1.1 as the IP address of the router on the network it creates. There are some sophisticated exploits that use this common setting to transmit the infection to the router, thereby compromising not just one computer but all Internet traffic that goes via the router from any device. It is advisable to change the routers IP address to something else, such as 192.168.37.201. 
  • Security measures

    There are a range of wireless security measures, of varying effectiveness and practicality.

    SSID hiding

    A simple but ineffective method to attempt to secure a wireless network is to hide the SSID (Service Set Identifier).[15] This provides very little protection against anything but the most casual intrusion efforts.

    MAC ID filtering

    One of the simplest techniques is to only allow access from known, pre-approved MAC addresses. Most wireless access points contain some type of MAC ID filtering. However, an attacker can simply sniff the MAC address of an authorized client and spoof this addresses.

    Static IP addressing

    Typical wireless access points provide IP addresses to clients via DHCP. Requiring clients to set their own addresses makes it more difficult for a casual or unsophisticated intruder to log onto the network, but provides little protection against a sophisticated attacker.[15]
     
PHV.DCXXIV.2016.0128

    2016.0128.WHY.FIGHT

    $
    0
    0
    SOURCE: 
    http://resources.infosecinstitute.com/wifite-walkthrough-part-1/#article
    http://resources.infosecinstitute.com/wifite-walkthrough-part-2/#article

    WHAT IS IT?
    In this article series, we will look at a tool named Wifite suitable for automated auditing of wireless networks. Most of you who have experience in wireless pentesting would use tools like airmon-ng, aireplay-ng, airodump-ng, aircrack-ng to crack wireless networks. This would involve a sequence of steps, like capturing a specific numbers of IV’s in case of WEP, capturing the WPA handshake in case of WPA etc, and then subsequently using aircrack-ng to crack the password required for  authentication to the network. Wifite aims to ease this process by using a wrapper over all these tools and thus making it super easy to crack Wifi networks.
    Ethical Hacking Training – Resources (InfoSec)

    Here is a list of features of Wifite as per its official homepage.
    • sorts targets by signal strength (in dB); cracks closest access points first
    • automatically de-authenticates clients of hidden networks to reveal SSIDs
    • numerous filters to specify exactly what to attack (wep/wpa/both, above certain signal strengths, channels, etc)
    • customizable settings (timeouts, packets/sec, etc)
    • “anonymous” feature; changes MAC to a random address before attacking, then changes back when attacks are complete
    • all captured WPA handshakes are backed up to wifite.py’s current directory
    • smart WPA de-authentication; cycles between all clients and broadcast deauths
    • stop any attack with Ctrl+C, with options to continue, move onto next target, skip to cracking, or exit
    • displays session summary at exit; shows any cracked keys
    • all passwords saved to cracked.txt
    • built-in updater: ./wifite.py -upgrade

    RECOMMENDED WIRELESS CARD
    Before we start using wifite, make sure you have a proper wireless card that supports packet injection. If you don’t have one, i would suggest that you buy this card.

    ALFA 1000mW 1W 802.11b/g USB Wireless WiFi network Adapter with 5dBi Antenna

     

    "aireplay-ng" bug info and fix
    Note that there is a bug in Wifite that may or may not be there in your particular version of Wifite. The bug basically doesn’t aireplay-ng to function properly and displays an error like aireplay-ng exited unexpectedly . In order to fix this, you will have to make slight modifications in the code of wifite. You can install gedit (apt-get install gedit) which is a text editor and then edit the wifite python script (found in /usr/bin/wifite) using the steps mentioned here. To open wifite, use the command gedit /usr/bin/wifite. This will open up the source code of wifite. Then replace every occurence of cmd = [‘aireplay-ng’, with cmd = [‘aireplay-ng’,’–ignore-negative-one’,

    UPDATE to the latest version
    Wifite can be found under Applications -> Kali Linux -> Wireless Attacks -> 802.11 Wireless Tools. Also, note that if you are running wifite in a different VM than Kali Linux, then you have to make sure that tools like airmon-ng, aireplay-ng, airodump-ng, aircrack-ng are already installed on that system. This is because Wifite is nothing but a wrapper over all these tools. Before we even start using Wifite, it is better to update to the latest version.



    LIST ALL THE COMMANDS and SWITCHES 
    In my case, i already have the latest version. In this tutorial, we will be targeting a simple Wifi network with WEP encryption. Just using the command wifite -h will give you a list of all the commands.


    Crack some WEP
    A very tempting option would be -all which tries to attack every network that it finds. We will try it in later articles in this series. However, first lets take a look at all the targets that we have. To do that, use the command wifite -showb


    Once this is done, we can see that wifite has put our network interface card into monitor mode (using airmon-ng) and started to look for clients. After a few more seconds, it will start displaying the list of access points.


    Note that as it is mentioned in its feature list (automatically de-authenticates clients of hidden networks to reveal SSIDs), this list will also include hidden access points. Hence, wifite can also be used to find hidden access points. In this case we will attack an access point with the BSSID 00:26:75:02:EF:65 that i have set up for testing purposes. The access point has a simple WEP password 1234567890.


    To start attacking an access point, just press Ctrl+C. Wifite will now ask you to choose a target number from the list. The target number for my test network is 1, so let me enter that. Note that if you press Ctrl+C again, it will quit Wifite.


    You can now see that Wifite will start attempting to crack the WEP access point using the different known techniques for cracking WEP encryption. After some unsuccessful tries, it has finally begun to start attacking the access points using different techniques for cracking WEP.


    Once enough IV’s are being captured, it will automatically start cracking the password.


    As we can see, Wifite has successfully figured out the WEP key for the access point. Wifite is an extremely useful tool for cracking wireless networks. As i mentioned previously, you need to have all the tools like airmon-ng, aireplay-ng, airodump-ng, aircrack-ng already installed on your system. To further prove the point, let’s dive into the source code of Wifite.


    As we can see, the python code has mentions of calling aireplay-ng. Hence, it is recommended to run Wifite inside Kali linux.  


    Crack some WPA
    In this article, we will look at cracking access points using WPA-PSK or WPA2-PSK using Wifite.
    If you have used tools like airodump-ng, aircrack-ng etc to crack WPA access points before, you would know that the required thing to successfully crack a WPA-PSK network is a captured WPA four-way handshake.


    To start wifite for cracking a WPA access point, give it the option -wpa to only target WPA networks. Also, give it a dictionary file as an input for cracking the WPA passphrase with the -dict option. In kali linux, the wordlists are stored at the location /usr/share/wordlists. Wifite will now start scanning for WPA access points.

    Press Ctrl+C to give a target number. In my case, the target number is 2 which is an access point i have configured for testing purposes. The access point uses WPA2-PSK encryption with the key as “password”.

    Wifite will now start listening for the handshake. Once it has found it, it will automatically start cracking the passphrase using the dictionary file that we supplied.

    And as you can see, Wifite has successfully found the passphrase for the access point.
    Sometimes, things may not work as smoothly. In order to capture a WPA handshake between the client and the access point, the client has to connect to the wireless network during that period when we are monitoring the network. If the client is already connected, there will be no handshake that is captured. Wifite does this by automatically sending deauthentication packets to a particular client or a broadcast deauthentication packet if it is required. You can specify the time between deauthentication packets using the -wpadt flag. Hence, when the client tries to reconnect to the access point, the handshake is captured.
    You can also specify which tool you want to use to crack the passphrase once the four-way handshake has been successfully captured. By default, aircrack-ng is selected. You can also use cowpatty, pyrit or tshark to crack the passphrase.

    Another cool option in Wifite is to anonymize your MAC address using the -mac option. Even though it is quite trivial using simple commands or macchanger utility to change the MAC address for a specific interface, it is good to have this feature in the tool itself. However, in order to make this work, you first have to take that specific interface for which you want to change the MAC address down to managed mode if it is in monitor mode previously. You can use the command iwconfig to check all the interfaces that are in monitor mode and then take them down using the command airmon-ng stop interface-name command. As we can see from the image below, the mon0 interface is in monitor mode.

    Hence, lets take it down using the command airmon-ng stop mon0
    .
    Now we can add the -mac option to anonymize the MAC address. As you can see, Wifite is intelligent enough to change the MAC address to something that is similar the existing MAC address of the interface and not to something ridiculous (for e.g AA:BB:CC:DD:EE:FF) which is a giveaway.

    And when you stop the capture, Wifite is nice enough to change the MAC address back to the original one.

    PHV.DCXXIV.2016.0128


    Viewing all 45 articles
    Browse latest View live