All posts by zitstif

Code, Posts

Kismet: passively sniffing wireless network traffic

Leave a comment

The threat of information leakage via unencrypted wireless networks is quite real and needs to be taken into consideration. Especially if you’re an organization/entity, who handles sensitive information.

Today I’ll be covering a simple demonstration that will have 3 hosts. The three hosts are as follows:

Host A (Attacker)
Host B (Client)
Host C (Server)

Host A will be running kismet, so it will not be connected to the network. The network will only have MAC filtering deployed. Host B and C will be wireless clients on the network, but I will set up netcat loops that will just simply print a string over the network.

Host B will be running this:

while true; do echo "CAPTURE THIS WHILE NOT CONNECTED" | nc -w2 hostC 8080; done

Host C will be running this:

while true; do nc -l -s hostCIP -p 8080 -vv; done

Host A which is the attacker, will simply be within close range of the network and will give the kismet log files a name as well by doing:

kismet -t capture-test

Once kismet has started to run, make sure to use ‘L’ to lock onto the channel that the wireless network is on. With this done, wait a few minutes and you should have captured the test string.

To view your captured information, you need to view the contents of the dump files. The dump files are located in/var/log/kismet.

Upon location of the dump file, what worked for me was using egrep to look for the captured string.

egrep 'CAP*' capture-test*.dump

This may ‘bork’ your terminal, so just use reset. Per contra, you should see the captured text.

This simple demo demonstrates how real of a threat passive wireless sniffing devices are. If you’re curious, I actually used my Nokia N810 as the attacker. 🙂

I’ll have more to come as usual… (I’m back in school so I’m going to have less time to work on ettersploit 🙁 )

Code, Posts

Creating an md5sum hash dictionary file

Leave a comment

If you’re ever put in a situation where you need to assess the strength of passwords that may be stored in an md5sum, there are a few options you have:

There are numerous websites for cracking md5sums such as:

http://passcracking.com

The simple way I assess how these websites is by searching for a very simple md5sum that can be generated via:

echo password | md5sum -;

Also, you could just merely, google the md5sum and see if you can find the unciphered text. That being said, the point of this post though, is to generate an md5sum hash dictionary. Let’s look at a simple word list.

cat wordlist.txt | head 
aaaaa
aaaab
aaaac
aaaad
aaaae
aaaaf
aaaag
aaaah
aaaai
aaaaj

We will then, use a for loop and append the output of each iteration, to a file simply by doing:

for i in `cat wordlist.txt`; do echo ${i} >> hashdict.txt; echo ${i} | md5sum - >> hashdict.txt; done

Now in our hashdict.txt file, we have our unciphered text and then on the next line, it’s md5sum equivalent. Ergo, if we want to look up a hash some and find the unciphered text, we could do as follows:

egrep --before-context=1 '4ab36a961cd2198e4a49915f820db5c0' hashdict.txt
aaaae

We have now found out that ‘4ab36a961cd2198e4a49915f820db5c0’ is equivalent to ‘aaaae’.

Similarly, if we wanted to find md5sum equivalent of ‘aaaae’ , we could use the list, or just simply do:

echo aaaae | md5sum -

I’ll have more to come. In the next few days, I’m going to work on my ‘ettersploit’, idea.

Posts

Blippy FAIL rant

3 Comments

mashable.com/2010/04/23/blippy-credit-card-numbers/

Alright, sharing information is nothing new, along with sharing information online. We as a society aggregate massive amounts of data for companies to use for targeted marketing and the like.

With that being said, you must ask yourself, “Our we willingly sharing too much information?” Is there such a thing as a too much information? Some would argue no and for the most part I would have to agree with them. Despite this being true, I still strongly believe that reasonable forms of denial are a useful tool for coping with everyday life.

Twitter, facebook, myspace.. and even the faded out xanga, are all websites that are used for basically spying on our social lives. With this being said, Blippy steps up the ante by spying on our buying habits and having a space for us to publicly share this information.

Was I a little surprised to find out about the latest ‘Blippy fail’ ? A little, but the more I took into consideration and remembered how Google can be used in such a way, it wasn’t very hard for me to fathom.

Is there an easy mend for this issue? You have to ask yourself, especially if you’re a Blippy user, “Do I really need to share this information, with this company and the realm of the internet?”.

My mantra on disclosing information is, ‘share information as felt necessary’. I hope more people start taking this into consideration, but it seems that people tend to like to live in the view of the public to an extent via social networking mediums. I believe for some individuals, it gives them a sense of identity and self importance.

Do I really care about who broke up with such and so? Is it necessary for me to learn about unnecessary information about yourself? I don’t think so, but social networking websites seem to think it’s necessary, but it’s also part of their business model.

Consider this simple logic: The more websites that I share personal information with, the more likely a privacy breach of information that I did not intend to disclose will occur.

More to come..