Tag Info

Hot answers tagged

37

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here. With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use ...


10

For example, using the great aircrack-ng, specifically the airodump-ng utility from it. The information you are looking for will show up under "Probes" in the lower section.


7

WiMax is a radio communications standard, so locating the origin of a broadcast signal is of course possible whenever you're transmitting. As implemented in cellular networks, such as LTE, the coverage will overlap and the protocol will provide means of switching between masts as you move between cells. This means you will likely be within contact from two ...


7

Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link. Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, ...


6

What you are thinking of doing is incredible similar to an existing attack known as the karma attack, made popular by the super fun Wifi Pineapple. The basic principle behind the attack is for the attacker to setup an AP that responds to the wireless probe packets clients send out when attempting to connect to a previously trusted AP. By responding to each ...


6

The evil twin attack works because with most versions of WPA there is no validation of the AP. When connecting to an AP a system authenticates trusts that the AP is what it says it is. This isn't a good design frankly, however we are stuck with it. WPA enterprise allows the use of certificates for verification of both AP and connecting system, however it ...


6

There are two main ways in which SSL/TLS and EAP may mix: EAP-TLS and EAP-TTLS. Basically, EAP is a generic protocol for exchanging "messages", and the "authentication method" defines the message contents. In the case of the TLS-based EAP methods, the messages contain the various handshake messages from SSL/TLS. In EAP-TLS, the normal case is that the client ...


6

This should work for most Linuxes: sudo apt-get install aircrack-ng sudo airmon-ng start <card> sudo airodump-ng mon0 This outputs a list of what all devices are trying to connect to. Some devices only probe networks that are available, however, as you suspected, smartphones probe all networks that they know about, no matter whether they are ...


5

Safe is a big word, and depending on how tempting of a target you are, achieving it in public might not be possible. XKCD #538 - Security that's rather popular here explains this pretty well:                             ...


5

After putting your wireless network card in monitor mode as mentioned in the other answers, you can do something like the following to print out MAC addresses and ssid. This code is dependent on the scapy library/tool. #!/usr/bin/env python from scapy.all import * conf.iface = "mon0" def handle_pkt(pkt): if Dot11 in pkt and pkt[Dot11].type == 0 and ...


4

Sure there is! In the absence of a "guest" SSID feature on your router, use one of the bands for guests/visitors, and the other band for private use. That way you can regularly change the password for the guest/visitor WiFi without disrupting connectivity on your own devices. Granted, this is more of a practical consideration (even though you do gain some ...


4

For WPA, The authentication process is known as a four-way handshake. It's a bit complex to describe but in short, the access point will know that there was an unsuccessful attempt to connect, but it will not know what key was actually supplied. Fortunately, this would mean that the bogus wifi ap will not be able to figure out the key to the "real" ap. ...


3

Sure this is possible. There's a couple of ways to approach it. The easiest way is to run kismet then as you're running it look for your Rogue access point appearing on the list of access points seen. When it does, lock the channel that kismet is looking on to the channel being used by your rogue access point (this gives a clearer signal than if kismet is ...


3

So several companies have a database of Wireless Access Points (Google, Apple, Skyhook). In terms of how the data is collected, I don't believe that any of the companies have made official statements on the matter, but there's a couple of likely avenues. First one point is that your wireless Access Point broadcasts it's BSSID address into, likely public, ...


3

As VMWare workstation provides USB Passthrough, it should be fine using USB wireless cards and doing testing from a kali/linux Virtual Machine. I say should as there's always a risk of bugs in how VMWare passes the data through to the guest VM, so it could have an impact in some circumstances. That said, my experience of VMWare Workstation and using USB ...


3

Short answer: Yes, change it. As long as you can ensure that the attacker is not able to break into your WiFi (using WPA2 is good beginning) and is also not able to get access by other ways (e.g. over VPN, weak WPA2 password, plugging a cable into your switch, malware on your devices, ...), theoretically there is no need to change the password. However, ...


3

Yes, “airplane mode” disables all methods through which the device voluntarily transmits information over wireless networks. That's the point. The device is still emitting, of course. For example it emits visible light: all information that is displayed on the screen can be snooped by shoulder surfing or hidden cameras. Even information that is not ...


3

MAC filtering is implemented by, indeed, ignoring packets whose source MAC address is deemed "inappropriate" by the access point. You won't get a response packet informing you that the access point does not wish to talk to you. You can test for a blacklist filter by temporarily changing the MAC address of your device: if the device can connect with another ...


3

Some of the options, such as Reaver's "ignore frame checksum errors" or Bully's "don't require ACKs" are technically violations of the WiFi spec, and can't be done by a device that's in managed mode. Additionally, I suspect that being in monitor mode is required to see the beacon packets that 1) tell if the AP supports WPS, and 2) tell if the AP has ...


3

Yes as there has been no exchange of password between client and AP. So it is pretty much impossible.


3

My approach to this was to use an OpenWRT (could be done with DDwrt or other similar projects) device (a TPlink 3600) and to use only tcpdump and monitor mode (not airodump). Using TCPdump lets you see all traffic (to profile area activity as well as watching for beacons/probes) The advantage to using a dedicated device is they are inexpensive, use little ...


3

It does indeed slightly facilitate a remote attack on your machine, since an attacker would be able to send you packets from your local network, rather than having to rely on NAT traversal from the router you use to connect to the Internet. You would still need to have network-facing services running on your machine, such as SMB/CIFS, Telnet, other protocols ...


2

WEP uses RC-4 for encryption, so by saying their encryption is AES means it has to be WPA2, not WEP or WPA. Almost all vendors offer WEP as an option in order to support legacy devices though, so that's not really an indicator. The fact that SSIDer showed it as WEP windows asked for a WEP key indicates it is simply a WEP-enabled access point.


2

Partly, yes...but mostly no - there are many other things that can identify you. The Media Access Control address is used on the local network segment only. Yes, it is (supposed) to be unique to each network interface device, and sometimes can be changed/spoofed. So to a slight extent, regularly changing your MAC address will provide you with some degree ...


2

You might be interested in this talk that was given at DEFCON a few years back. Summary: if you are using WPA2, a separate key is used to encrypt broadcast traffic vs. unicast traffic. So in that sense, connections are isolated from each other. HOWEVER, you're still vulnerable to an insider attack; a malicious client could spoof ARP and intercept traffic ...


2

No, it's not safe. Any time you're connecting to public wifi you're joining a network of potential attackers. It's possible you have other ports open which the attackers could exploit and gain system access. Unlikely, but possible.


2

Partially, yes. Windows OS (eg. using ipconfig command) sees the spoofed MAC address as the permanent MAC address. However you can NOT say all of the applications running on Windows will see the spoofed one as the permanent one. Applications might be using some ways to acquire the permanent (burned-in) MAC address of the adapter. (For instance they might be ...


2

Are you looking to monitor packets between your computer as a client on the network and the router and other wireless clients and the router? If you're using windows, it looks like the answer is yes: you'll need to purchase Airpcap. http://ask.wireshark.org/questions/8504/supported-adapters-for-wireless-packet-capturing If you're attempting to monitor at ...


2

@Ted has valid answers to a couple of your questions. I just wanted to add something referring a bit more to the one he didn't cover as well: What would it take for an hacker to get into my network? Really, not a lot. WEP has been pretty much cracked, and WPA/WPA-2 are still not perfect. The way most attackers hack into a WiFi network is with aircrack ...


2

I would definitely recommend reading up on Max “Vision” Butler, a rather infamous hacker. One of his regular practices was to use WiFi networks via a parabolic antenna, easily giving him the range to hit networks from a great distance. Not that password-protecting it is guaranteeing security, but the assumption that distance gives you any sort of protection ...



Only top voted, non community-wiki answers of a minimum length are eligible