[Tutorial] The Way I USED To Get Hotspot User Credentials Using Wireless Router!!

Well, This is a tutorial/article I wrote about a year ago for hackcommunity.com, and thought of sharing it here too,Please bear with it until my new Tutorials come...

Its really basic way ( Before I learnt proper methods).  My Tutorial on Phishing Page is better than this. Also, problems , i had faced, written here have been already solved.So here it comes:

*********************
Half of the credit goes to enc0de for his tutorial of mass destruction using mdk3... it helped me a lot to save time.. other wise i had to keep on waiting or deauth clients one by one.

This May be simple and most of you may have done it with better ways.
But my hotspot has client isolation and i am unable to sniff anything using ettercap and other tools. If anyone knows how to do it please share.

My method:
**connect to hotspot and save the login page using "save complete" addon of firefox. it works better than the default save option.

**save the page in localhost.

**Set essid of the ap same as that of hotspot. and connect to the machine. I dont prefer airbase-ng because i have seen that i am never able to connect to fake ap by airbase using linux machine. not sure why.

**start redirecting all request to the ap to the localhost of the machine.
I used <dnsspoof -i wlan0> or dns_spoof plugin of ettercap.

**start mdk3 to disconnect all the clients connected to the real hotspot. Many clients will surely connect to my AP.

I have connected a 10 dbi omnidirectional antenna to my AP. I got it for free...lucky me.

start sniffing tools, i prefer ettercap. No need of MITM, just normal sniffing is enough for me.

Now whoever connects to the AP will be redirected to my localhost with hotspot login page no matter what they request, like the real hostpot.
But the thing is, i dont have internet connection so to make it look less suspicious what i have done is, after they hit login button... they will again be redirected to the same login page with blank username and password field. in this way i gathered a lot of username and passwords..

I have only one problem here.. the dns spoofing is not stable... sometimes it works..sometimes it doesnt..... if anyone has solution to this.. please share.

Also please tell me if there are other better ways.. or anything i can do to make it more accurate.

**********************************

END

The  problem of dnsspoofing written here has been already solved. Check my dnsspoofing tutorial.
If you want to try this method and have any queries please feel free to ask.

Also, better ideas are always welcomed, my current strategies are phishing page or using ettercap directly in the hotspot itself.

P.S, combine this method with  php script from my Phishing Page Tutorial in your localhost for easier gain.

[Index] All mdk3 Tutorial Links In One Page.

 

 Links to all pages of MDK3 Series in a Singe Page for Your Ease :)

  [Tutorial] Wireless Havoc With MDK3!! (I)

  [Tutorial] Wireless Havoc With MDK3!! (II)

  [Tutorial] Wireless Havoc With MDK3!! (III)

  [Tutorial] Wireless Havoc With MDK3!! (IV)

 

 

 

 

 

[Tutorial] Wireless Havoc With MDK3!! (IV)

contd...
This is the fourth post of "wireless havoc with MDK3" series. If you havent already read the first three posts then please go here(i), here(ii) and here(iii).


This probably is going to be the last post in the MDK3 series... or maybe I will post about other options too, maybe the "g" (WPA downgrade test), which is also equally useful and fun to try.

This post will describe about "a", Authentication DoS mode.

First, what is DoS? It stand for Denial of Service. If DoS attack is performed on certain target or whole network, all the network traffics of the client/clients will be stopped..that means it Denies The Service.
Maybe you have heard of DoS or DDoS attacks on servers,websites etc. A good DoS/DDoS attack will crash or freeze the server in no time.

**DDoS= Distributed Denial of Service, which is carried out in team of large numbers in many computers at once targetting either one or more servers at a single time.


Back To The Topic:

This "a", Authentication DoS mode is based on the principle that too many clients authentication will either freeze,crash or reset the AP. Even if it doesnt crash,reset or freeze the AP, it surely DoSes It.... No Data In Or Out.

Simple Principle With Disastrous Result.

Lets check the options available for "a" attack.

Ok, not much is there, and only -a option is enough for us. no need of -m, -c, -i or -s.

The Command is just:

mdk3 mon0 -a F4:EC:38:F1:65:72

Just see what this little shit does... :D

see?? it has already connected 3000 clients to the target AP.... It surely crashes or at least freezes the AP if left for about 5-10 minutes.. but it depends upon APs too.. some come back to function immediately.... if it comes back to function.. mdk3 will again start to attack it. At least it will be DoS'd.

Note: The MAC address of the connected clients are automatically generated by mdk3 itself, only the MAC of AP is to be provided.

So, what do you say of the mdk3 and mdk3 series in this blog? please comment, your comments are always welcomed, positive as well as negative. But if its too much negative then it will be moderated. :)

[Tutorial] Wireless Havoc With MDK3!! (III)

contd...
This is the third post of "wireless havoc with MDK3" series. If you havent already read the first two posts then please go here(i) and here(ii).

This one is probably going to be the most effective way of using mdk3 to create a real wireless havoc in the environment around you. Please enjoy...


1) First we will learn about "d", Deauthentication / Dissassociation Amok Mode. And after that we will learn the effect of "d" used with "b", ( I guess many of you have already known or guessed the result!! :D)

Ok, as the name suggests, this attack is used to deauthenticate/dissaossociate the connected clients from the taget AP. In simple language it just kicks/disconnects the clients from AP everytime they try to connect. As long as the attack runs, the target will never be able to connect to the AP unless he does some serious change to the AP or interface itself, but it still can be attacked again after changing the credentials. :D

Lets check the options of "d".

Not much options here, so easy and short to learn.. but still one of the most disastrous exploits. :D

First lets understand how it works,

you can see -w and -b options for whitelisted MACs and Blacklisted MACs respectively.

Create a file of any name, add the MAC address of AP or Clients that you dont want to attack, this will be your whitelist file. It is recommended to add MAC of your client and AP so that you dont get kicked out of your own AP by your own doings. :D
Similarly, create a file of any name, add MAC address of AP or Clients that you wish to attack, this will be your blacklist file.

Basic command is:
mdk3 mon0 d  

As you can see, this command disconnected each and every AP and Client it found in its range. Good for mass attack, but probably not that good if you want to save yourself and target some particulars. So, lets play witht the options.

* -w

mdk3 mon0 d -w whitelist_file

What this command does is, it disconnects everything it finds except for the MACs saved in the whitelist file.

I have added MAC of my wifi adapter connected to the AP with address 00:16:01:ED:2B:CB, it disconnected other clients except mine.

*-b

mdk3 mon0 d -b blacklist_file

Similarly, it searches and disconnects just the MACs saved in the blacklist file, good for attacking a single client.

I had hadded the MAC 00:26:B0:AE:8D:E5 in the blaclist_file, so no matter how many times he tries, he will never succeed in connecting to the AP.

Update: Specify the channel option too for better performance. chipset rt3070/2870 needs channel to deauthenticate, maybe other chips need it too. 
>>>mdk3 mon0 d -b blacklist_file -c channelofap<<<


Finally, how to use "b" with "d"?? Use "d" first and start the "b" with either no options or some essid's matching your target so that he gets disconnected each and every time, and when he scans the network he will find strange ESSIDs which will make him think that his wireless card has broken/damaged.

Another good use of mdk3 is, suppose you are in your school/office where there is wifi with good speed, but many people are connected to it and the speed has decreased dramatically, you desperately need/want all the bandwidth, now guess what you can do with "d"?? 
Though there is a better way of getting all the bandwidth from a network without kicking anyone out, which we will discuss in later posts.

Now final tutorial of "a" remains. We will cover it in next post. :)

[Tutorial] Wireless Havoc With MDK3!! (II)

contd...
If you havent read part (I) of this tutorial then please do, its here. 

Warning: If misused this really really will cause a havoc, and I am not joking. You should only use this on the network you are authorized to fiddle with. :P

In this session, my network interface is wlan0, my  MAC-address is 12:23:34:45:56:78, my test AP: DeathKnight (WPA2-PSK Encrypted) , test AP MAC-address 00:16:01:ED:2B:CB



First get your wireless card in monitor-mode.

airmon-ng start  wlan0

You will get a new interface mon0. 

1) Beacon Flood Mode:

Now, if you remeber previous post, "b" was the first option. Try "mdk3 --fullhelp", You will see that "b" is for "beacon flood mode".  With correct options, what it does is, it floods the area with random or given ESSIDs so that when you scan with your wifi enabled device you will see tons of Wireless Networks around you. This one is not harmful. :D

The options in "beacon flood mode" are:

Ok, the basic beacon flood command is just:

mdk3 mon0 b

Try it and scan with your wifi device like mobile or another pc or anything, you will see large number of essids, now to play with the options to make it more interesting.

*if -n is not specified it sends out random ESSIDs like:

*with -n <essid> specified it sends the ESSID of our desire:

* for -f, we first need to create a text file with lots of essids of our choice, you can put anything you want :D. The output will be like this:

* -d will show the station as ad-hoc when scanned with wifi devices.

  here, "hell" is the essid from mdk3, and in Mode, you can see that it is Ad-Hoc


* -w will show our spam essid as wep encrypted, just add -w, no need to assign key.

* -g will show our station as 54 Mbit. nothing special here.

* -t and -a will show our AP as WPA encrypted, TKIP and AES respectively.


* I did not find any visible effect of -h and -m option.

* -c option will allow you to fix the channel for your Spam AP. eg:

mdk3 mon0 -n hell -c 12 -w

 it will flood essid called hell in channel 12 with WEP encryption.

* -s just set the speed for packets, nothing importan here.

Some of the combinations:

mdk3 mon0 -f filename -c 11 -a
essids from selected file will be flooded in channel 11 with AES encryption

mdk3 mon0 -w
will flood environment with randomley generated essid with wep encryption.

Try out some of the combinations.  Your neighbour may be happy too see lots of unsecured WIFI network in the area. But if he sees something like this

This "beacon flood mode" is more fun to use with deauthentication mode, which we will discuss in next tutorial. :)

[Tutorial] Wireless Havoc With MDK3!! (I)

Introduction:


This is the first part of the MDK3 series, you will find out the basic dangers you will face while using wifi. Articles about bigger dangers will come later. Please read all the episodes and enjoy!!


MDK is a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses, and it does that perfectly. Some of its exploits are beacon flood mode, deauthenticating connected clients, cracking hidden essids, crashing wireless APs etc. We we talk about some of them in this article.

And guess what, this little program file is no more than 208 Kb when downloaded, it wont consume more than 2-3 Mb in your disk.. but you will find out how powerful it is after you read all the episodes.


Installation:

MDK3 is a tool already included in BackTrack 5 R1.
If you want to install it in other distro then:

sudo apt-get install mdk3 --> for debian based 

sudo yum install mdk3 --> for redhat based

If it is not already there in repo then get a copy from here and manually install it.


Installation process:

tar -xjf mdk3-v6.tar.bz2
cd mdk3-v6
make
make install.

* you may get whole pages of errors when you enter "make", but ignore it and proceed to make install, it will install mdk3 fine. If it doesnt then please leave a comment, I will take a look at it again. :)

Update: If it doesnt work, you may need to edit your Makefile. ( I had to do so in Ubuntu 12.04) 

Open Makefile
change this line: LINKFLAGS = -lpthread to
                                 LINKFLAGS = -pthread
make && make install

Help page:

Before starting lets have a look at the help page of mdk3:

As mentioned in the third line, mdk3 --fullhelp will give us with a detailed help page. Please have a look at it in your own terminal.

The test modes we are going to be using in this sessions will be, "b , a and d" These are the most interesting modes ever that you can use to play prank to your neighbour or even worse can make him suffer.


Please stay tuned, I will post a detailed tutorial in my next post, as will be too long if i include all of them in this single post. :)

The second part is located here.