Abstract image of a woman sitting on books and studying on a laptop

Wi-Fi Hotspot Attacks

Greg Foss, profile picture
Greg Foss

The document is a presentation on Wi-Fi hacking techniques aimed at web pentesters, discussing various attacks such as WEP cracking, WPA/WPA2 attacks, and man-in-the-middle strategies. It provides methods for bypassing captive portals, deauthentication of clients, and hijacking techniques, while also warning that many techniques demonstrated are likely illegal and not advisable against unauthorized targets. The document includes resources and tools for testing and defending against potential Wi-Fi security threats.

Technology
1 of 73
Downloaded 173 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
Wi-Fi Hacking for Web Pentesters Greg Foss Sr. Security Research Engineer @heinzarelli
Greg Foss Sr. Security Research Engineer OSCP, GAWN, GPEN, GWAPT, GCIH, CEH, CYBER APT # whoami
Wi-Fi Hotspot Attacks
*I am not liable for what you do with any of this information* Section 638:17 House Bill 495 - US rules against wireless hacking http://en.wikipedia.org/wiki/Legality_of_piggybacking#United_States
DISCLAIMER Not a ‘Wi-Fi Security Expert’ nor a Lawyer Just about everything I’m going to demonstrate is probably illegal, don’t do any of this against unauthorized targets…
Not Discussing Wi-Fi Security Basics • 802.11 • WEP Cracking - ridiculously easy, google it • WPA / WPA2 Attacks - Reaver • WPS Attacks - Reaver • PEAP, LEAP, etc. - Out of Scope
Agenda…
Wi-Fi Hotspot Attacks
it’s everywhere… enough free WiFi that it’s almost not worth the time it takes to infiltrate unless free internet’s not the goal…
Bypassing is easy… • Sometimes Tor or a VPN will simply be allowed through the captive portal, no joke • Try appending ?.jpg or ?.png to the URL • Look for Open Redirect flaws, iFrames, etc. • Tunnel out over DNS! • Same tricks work if your ISP suspends your internet access, depending on the ISP of course…
Bypassing is easy… • On time-limited access points, just change your MAC when the time runs out. Or sniff MACs and ride on another’s paid access. • De-auth existing clients and/or DoS access points: • Aireplay-ng or Airdrop • http://www.aircrack-ng.org/ • MDK3 • https://forums.kali.org/showthread.php?19498- MDK3-Secret-Destruction-Mode
Bypassing is easy… • Sniff MAC Addresses and wait for a user to go idle, then modify your MAC and IP to match • Works on just about any open access point, especially captive portals • CPSCAM by Josh Wright will do this for you: • http://www.willhackforsushi.com/code/ cpscam.pl
Hijacking is also easy…
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
The Evil Twin… source: http://www.breakthesecurity.com/2014/04/evil-twin-attack-fake-wifi-hack.html
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
How to clone and weaponize captive portals 1. Connect to the access point and wait for the splash page to pop- up. 2. Close the splash page, and open your browser. Visit any random web page (http normally works better than https). 3. When the splash page comes up, save the entire landing page. Use the splash page and save additional pages as necessary. 4. Change the UA string and grab the mobile version as well if it exists. 5. Replace the form processor to write a log file and pass the client through to a legitimate landing page. 6. Modify the page HTML to point to your form processor and modify parameters as necessary. 7. Deploy the captive portal (will discuss this shortly) 8. Use IPTables to allow the victim’s MAC through to the internet using the form processor.
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Mobile Cloning
Mobile Cloning • HTTrack: http://www.httrack.com/
Mobile Cloning • VT View Source:
 
 https://play.google.com/ store/apps/details? id=com.tozalakyan.view source&hl=en
Wi-Fi Hotspot Attacks
How to Deauthenticate Clients and DoS Access Points • Aireplay-ng using the —deauth flag • file2air - deauth packet injection flood tool by Josh Wright • http://www.willhackforsushi.com/code/file2air/1.1/ file2air-1.1.tgz • Spoof AP MAC, send deauth requests to clients • Target a single user, all users, or AP itself • MDK3 Deauth Amok Mode to take out all WPA AP’s
How to Deauthenticate Clients and DoS Access Points source: https://github.com/sophron/wifiphisher
How to Deauthenticate Clients and DoS Access Points https://github.com/sophron/wifiphisher
source: https://www.isecpartners.com/blog/2013/july/man-in-the-middling-non-proxy-aware-wi-fi-devices-with-a-pineapple.aspx
Wi-Fi Pineapple https://wifipineapple.com/
Generic Splash Page Pineapple Configuration /etc/nodogsplash/htdocs/splash.html
Landing Page Pineapple Configuration - JavaScript Necessities /www/[directory]/index.html
PHP Form Processor Pineapple Configuration Easier than using IPTables /www/[directory]/auth/login.php
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
A word of caution w/ the Pineapple…
A word of caution w/ the Pineapple…
Existing Router Ideally one supporting guest mode…
DDWRT • Flash with DDWRT, then you can use NocatSplash to configure a captive portal. • Many other ways to go about this… DDWRT is just one of the easier options. • http://www.dd-wrt.com/site/index • http://sourceforge.net/projects/ nocatsplash/
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Laptop Hotspot and/or Proxy
• Kali Linux • http://www.kali.org/ • Can do just about anything to connecting clients • Unlimited attack potential and plenty of drive space to build elaborate landing pages and believable scenarios Laptop Hotspot and/or Proxy
• Makes hacking Wi-Fi even easier! • https://github.com/SilverFoxx/PwnSTAR PwnStar - By SilverFoxx
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
Demo
Deploy Malware
Combine Pineapple portability with the versatility of Kali Linux • http://www.offensive-security.com/kali- linux/kali-linux-evil-wireless-access-point/
BeagleBone Black + Alfa Wi-Fi Card http://beagleboard.org/black http://www.alfa.com.tw/
BeagleBone AP Deployment Options get creative…
Wi-Fi Hotspot Attacks
Going Mobile! • Nexus Device with Kali NetHunter • https://www.kali.org/kali-linux-nethunter/ • Pwnie Express Pwn Phone/Pad • https://www.pwnieexpress.com/product/ pwn-phone2014/
Going Mobile!
Going Mobile!
Wi-Fi Hotspot Attacks
Wi-Fi Hotspot Attacks
MITM Basic Tools • AirSSL • AirJack • Airsnarf • Dsniff • Cain • void11 • Ferret • SSLStrip • Wireshark • AirPwn • Ettercap • Etc…
You don’t even need to authenticate to attack clients
Fun with MITM • Snapception - https://github.com/thebradbain/ snapception • Love Thy Neighbors - http:// neighbor.willhackforsushi.com/ • AirPWN - http://airpwn.sourceforge.net/ Airpwn.html • Intercepter-NG - http://intercepter.nerf.ru/ • Many, many more…
Demo
Client Defense… • Always use a VPN/VPS/SSH Port Forwarding/ etc. when connected to an open access point. • Turn all Wireless devices off when traveling or in crowded areas, many devices still connect to wireless networks even when ‘sleeping’. • Hotspot not served up over HTTPS and other generally suspicious behavior. • Beware duplicate networks with different encryption.
Client Defense… • Use different login details and passwords for public wifi. Test false-credentials first, if it lets you through it’s not legit. • Turn off Wi-Fi on devices when traveling. • Exercise caution when connections suddenly drop, especially if it happens for everyone on the network. • If it just ‘doesn’t feel right’ then trust your instincts…
Resources • http://www.willhackforsushi.com/code/cpscam.pl • http://neighbor.willhackforsushi.com/ • http://www.aircrack-ng.org/ • http://www.dd-wrt.com/ • https://github.com/SilverFoxx/PwnSTAR • http://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/ • http://beagleboard.org/black • http://www.armhf.com/boards/beaglebone-black/bbb-sd-install/ • http://grinninggecko.com/2013/09/13/kali-linux-on-headless-beaglebone-black-via- os-x/ • https://github.com/thebradbain/snapception • http://airpwn.sourceforge.net/Airpwn.html • http://intercepter.nerf.ru/
Thank You! Questions? https://github.com/gfoss/misc/Wireless/Captive-Portals/ Greg Foss
 Senior Security Research Engineer
 greg.foss[at]LogRhythm.com
 @heinzarelli

More Related Content

PPTX
Password Cracking
Sagar Verma
 
PDF
Web App Security Presentation by Ryan Holland - 05-31-2017
TriNimbus
 
PPT
Intro to Web Application Security
Rob Ragan
 
PPTX
Firewalls and packet filters
MOHIT AGARWAL
 
PPTX
Introduction to ethical hacking
Vikram Khanna
 
PPTX
Cyber security
Sajid Hasan
 
PPTX
1 understanding cyber threats
mohamad Hamizi
 
PPTX
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Mark Arena
 
Password Cracking
Sagar Verma
 
Web App Security Presentation by Ryan Holland - 05-31-2017
TriNimbus
 
Intro to Web Application Security
Rob Ragan
 
Firewalls and packet filters
MOHIT AGARWAL
 
Introduction to ethical hacking
Vikram Khanna
 
Cyber security
Sajid Hasan
 
1 understanding cyber threats
mohamad Hamizi
 
Cyber Threat Intelligence: Building and maturing an intelligence program that...
Mark Arena
 

What's hot (20)

PPTX
Social engineering-Attack of the Human Behavior
James Krusic
 
PPT
Ethical Hacking Powerpoint
Ren Tuazon
 
PPT
Web filtering through Software
university of education,Lahore
 
PPTX
Security testing fundamentals
Cygnet Infotech
 
PPTX
What is Penetration Testing?
btpsec
 
PPTX
Cyber security presentation
Parab Mishra
 
PDF
Secure coding presentation Oct 3 2020
Moataz Kamel
 
PPT
Secure code practices
Hina Rawal
 
PPTX
Password management
Wilmington University
 
PDF
Cyber Security Vulnerabilities
Siemplify
 
PPTX
Wireshark
Sourav Roy
 
PPTX
Brute force-attack presentation
Mahmoud Ibra
 
PPTX
Password cracking and brute force
vishalgohel12195
 
PPT
Web Security
Bharath Manoharan
 
PDF
Zero Trust : How to Get Started
EyesOpen Association
 
PPTX
Vulnerability assessment & Penetration testing Basics
Mohammed Adam
 
PPTX
Mobile security
dilipdubey5
 
PDF
Diving into Common AWS Misconfigurations
Nikhil Sahoo
 
PPTX
Buffer overflow
Evgeni Tsonev
 
PPTX
WTF is Penetration Testing v.2
Scott Sutherland
 
Social engineering-Attack of the Human Behavior
James Krusic
 
Ethical Hacking Powerpoint
Ren Tuazon
 
Web filtering through Software
university of education,Lahore
 
Security testing fundamentals
Cygnet Infotech
 
What is Penetration Testing?
btpsec
 
Cyber security presentation
Parab Mishra
 
Secure coding presentation Oct 3 2020
Moataz Kamel
 
Secure code practices
Hina Rawal
 
Password management
Wilmington University
 
Cyber Security Vulnerabilities
Siemplify
 
Wireshark
Sourav Roy
 
Brute force-attack presentation
Mahmoud Ibra
 
Password cracking and brute force
vishalgohel12195
 
Web Security
Bharath Manoharan
 
Zero Trust : How to Get Started
EyesOpen Association
 
Vulnerability assessment & Penetration testing Basics
Mohammed Adam
 
Mobile security
dilipdubey5
 
Diving into Common AWS Misconfigurations
Nikhil Sahoo
 
Buffer overflow
Evgeni Tsonev
 
WTF is Penetration Testing v.2
Scott Sutherland
 
Ad

Viewers also liked (20)

PPTX
WiFi Pineapple - Alex R
Alexander Rippee
 
ODP
Easy Tutorial Step-by-Step How to use Airolib-ng
Tisya Ka
 
PDF
Activated Charcoal - Making Sense of Endpoint Data
Greg Foss
 
PPT
Caffe Latte Attack Presented In Toorcon
Md Sohail Ahmad
 
PPTX
The Hacker News: Hacking Wireless DSL routers via Admin Panel Password Reset ...
The Hacker News
 
PPT
Wireless router
roza921
 
PDF
Threat Intelligence Field of Dreams
Greg Foss
 
PDF
SecureSet WarGames - Logging and Packet Capture Training
Greg Foss
 
PDF
Setting hotspot-web-proxy-mikrotik
wayan abyong
 
PPT
Configuring linksys wireless router
anku3
 
PDF
DerbyCon 5 - Tactical Diversion-Driven Defense
Greg Foss
 
PDF
Deception Driven Defense - Infragard 2016
Greg Foss
 
PDF
Wireless Cracking using Kali
n|u - The Open Security Community
 
PPT
Caffe Latte Attack
AirTight Networks
 
PPT
Metasploit-TOI-Ebryx-PVT-Ltd
Ali Hussain
 
PDF
Penetration test
Digicomp Academy AG
 
PDF
Informationssicherheit im Übersetzungsprozess
Hans Pich
 
PPTX
Tranning-2
Ali Hussain
 
PPTX
Static PIE, How and Why - Metasploit's new POSIX payload: Mettle
Brent Cook
 
PDF
Webinar Metasploit Framework - Academia Clavis
Clavis Segurança da Informação
 
WiFi Pineapple - Alex R
Alexander Rippee
 
Easy Tutorial Step-by-Step How to use Airolib-ng
Tisya Ka
 
Activated Charcoal - Making Sense of Endpoint Data
Greg Foss
 
Caffe Latte Attack Presented In Toorcon
Md Sohail Ahmad
 
The Hacker News: Hacking Wireless DSL routers via Admin Panel Password Reset ...
The Hacker News
 
Wireless router
roza921
 
Threat Intelligence Field of Dreams
Greg Foss
 
SecureSet WarGames - Logging and Packet Capture Training
Greg Foss
 
Setting hotspot-web-proxy-mikrotik
wayan abyong
 
Configuring linksys wireless router
anku3
 
DerbyCon 5 - Tactical Diversion-Driven Defense
Greg Foss
 
Deception Driven Defense - Infragard 2016
Greg Foss
 
Wireless Cracking using Kali
n|u - The Open Security Community
 
Caffe Latte Attack
AirTight Networks
 
Metasploit-TOI-Ebryx-PVT-Ltd
Ali Hussain
 
Penetration test
Digicomp Academy AG
 
Informationssicherheit im Übersetzungsprozess
Hans Pich
 
Tranning-2
Ali Hussain
 
Static PIE, How and Why - Metasploit's new POSIX payload: Mettle
Brent Cook
 
Webinar Metasploit Framework - Academia Clavis
Clavis Segurança da Informação
 
Ad

Similar to Wi-Fi Hotspot Attacks (20)

PPTX
Adventures with Podman and Varlink
Jeremy Brown
 
PDF
What is being exposed from IoT Devices
The Security of Things Forum
 
PDF
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...
Zoltan Balazs
 
PPTX
Android Penetration Testing - Day 3
Mohammed Adam
 
PPTX
Cloud Device Insecurity
Jeremy Brown
 
PDF
Using Blockchain to Increase Supply Chain Transparency
Horea Porutiu
 
PDF
IoT security is a nightmare. But what is the real risk?
Zoltan Balazs
 
PDF
Honeypots for Active Defense
Greg Foss
 
PPTX
Ransomware - what is it, how to protect against it
Zoltan Balazs
 
PDF
Encode polkadot club
Vanessa Lošić
 
PDF
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
Jie Liau
 
PPTX
Red Team Apocalypse
Beau Bullock
 
PDF
Browser Horror Stories
EC-Council
 
PPTX
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
EC-Council
 
PDF
MNSEC 2018 - Observations from the APNIC Community Honeynet Project
MNCERT
 
PDF
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
fangjiafu
 
PDF
The Internet of Things: We've Got to Chat
Duo Security
 
PPTX
Personal Internet Security Practice
Brian Pichman
 
PDF
IoT_and_the_Impact_on_Security_Brian_Knopf_ISSA-OC_July-2014
Brian Knopf
 
PPTX
Pichman privacy, the dark web, & hacker devices i school (1)
Stephen Abram
 
Adventures with Podman and Varlink
Jeremy Brown
 
What is being exposed from IoT Devices
The Security of Things Forum
 
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...
Zoltan Balazs
 
Android Penetration Testing - Day 3
Mohammed Adam
 
Cloud Device Insecurity
Jeremy Brown
 
Using Blockchain to Increase Supply Chain Transparency
Horea Porutiu
 
IoT security is a nightmare. But what is the real risk?
Zoltan Balazs
 
Honeypots for Active Defense
Greg Foss
 
Ransomware - what is it, how to protect against it
Zoltan Balazs
 
Encode polkadot club
Vanessa Lošić
 
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
Jie Liau
 
Red Team Apocalypse
Beau Bullock
 
Browser Horror Stories
EC-Council
 
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
EC-Council
 
MNSEC 2018 - Observations from the APNIC Community Honeynet Project
MNCERT
 
Layer one 2011-joe-mccray-you-spent-all-that-money-and-still-got-0wned
fangjiafu
 
The Internet of Things: We've Got to Chat
Duo Security
 
Personal Internet Security Practice
Brian Pichman
 
IoT_and_the_Impact_on_Security_Brian_Knopf_ISSA-OC_July-2014
Brian Knopf
 
Pichman privacy, the dark web, & hacker devices i school (1)
Stephen Abram
 

More from Greg Foss (9)

PPTX
Cloud Crime Ops
Greg Foss
 
PPTX
Future of Destructive Malware
Greg Foss
 
PDF
Crypto Hacks - Quit your Job and Become a Crypto Farmer
Greg Foss
 
PDF
PIE - BSides Vancouver 2018
Greg Foss
 
PDF
Phishing Intelligence Engine - BlueHat v17
Greg Foss
 
PDF
Security Automation and Orchestration
Greg Foss
 
PDF
Advanced Threats and Lateral Movement Detection
Greg Foss
 
PDF
CMS Hacking Tricks - DerbyCon 4 - 2014
Greg Foss
 
PDF
Attacking Drupal
Greg Foss
 
Cloud Crime Ops
Greg Foss
 
Future of Destructive Malware
Greg Foss
 
Crypto Hacks - Quit your Job and Become a Crypto Farmer
Greg Foss
 
PIE - BSides Vancouver 2018
Greg Foss
 
Phishing Intelligence Engine - BlueHat v17
Greg Foss
 
Security Automation and Orchestration
Greg Foss
 
Advanced Threats and Lateral Movement Detection
Greg Foss
 
CMS Hacking Tricks - DerbyCon 4 - 2014
Greg Foss
 
Attacking Drupal
Greg Foss
 

Recently uploaded (20)

PDF
Convolutional neural network based encoder-decoder for efficient real-time ob...
IAESIJAI
 
PDF
Improvisation in detection of pomegranate leaf disease using transfer learni...
IAESIJAI
 
PDF
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
PPT
Galois Field Theory of Risk: A Perspective, Protocol, and Mathematical Backgr...
Melanie Swan
 
PDF
Rapid Prototyping: A lecture on prototyping techniques for interface design
Mark Billinghurst
 
PDF
Transform-Your-Supply-Chain-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
Co-training pseudo-labeling for text classification with support vector machi...
IAESIJAI
 
PDF
4 layer Arch & Reference Arch of IoT.pdf
sendilkumar66
 
PPTX
GROUP4NURSINGINFORMATICSREPORT-2 PRESENTATION
ClarisejaneSartillo1
 
PPTX
MuleSoft-Compete-Deck for midddleware integrations
zupittejas
 
PDF
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PPTX
AI-driven Assurance Across Your End-to-end Network With ThousandEyes
ThousandEyes
 
PDF
“A New Era of 3D Sensing: Transforming Industries and Creating Opportunities,...
Edge AI and Vision Alliance
 
PDF
The influence of sentiment analysis in enhancing early warning system model f...
IAESIJAI
 
PDF
INTERSPEECH 2025 「Recent Advances and Future Directions in Voice Conversion」
NU_I_TODALAB
 
PDF
Enhancing plagiarism detection using data pre-processing and machine learning...
IAESIJAI
 
PDF
Taming the Chaos: How to Turn Unstructured Data into Decisions
Safe Software
 
PDF
Transform-Quality-Engineering-with-AI-A-60-Day-Blueprint-for-Digital-Success.pdf
Kalilur Rahman
 
PDF
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
PPTX
Build Your First AI Agent with UiPath.pptx
suhanisingh58689
 
Convolutional neural network based encoder-decoder for efficient real-time ob...
IAESIJAI
 
Improvisation in detection of pomegranate leaf disease using transfer learni...
IAESIJAI
 
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
Galois Field Theory of Risk: A Perspective, Protocol, and Mathematical Backgr...
Melanie Swan
 
Rapid Prototyping: A lecture on prototyping techniques for interface design
Mark Billinghurst
 
Transform-Your-Supply-Chain-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
Co-training pseudo-labeling for text classification with support vector machi...
IAESIJAI
 
4 layer Arch & Reference Arch of IoT.pdf
sendilkumar66
 
GROUP4NURSINGINFORMATICSREPORT-2 PRESENTATION
ClarisejaneSartillo1
 
MuleSoft-Compete-Deck for midddleware integrations
zupittejas
 
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
AI-driven Assurance Across Your End-to-end Network With ThousandEyes
ThousandEyes
 
“A New Era of 3D Sensing: Transforming Industries and Creating Opportunities,...
Edge AI and Vision Alliance
 
The influence of sentiment analysis in enhancing early warning system model f...
IAESIJAI
 
INTERSPEECH 2025 「Recent Advances and Future Directions in Voice Conversion」
NU_I_TODALAB
 
Enhancing plagiarism detection using data pre-processing and machine learning...
IAESIJAI
 
Taming the Chaos: How to Turn Unstructured Data into Decisions
Safe Software
 
Transform-Quality-Engineering-with-AI-A-60-Day-Blueprint-for-Digital-Success.pdf
Kalilur Rahman
 
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
Build Your First AI Agent with UiPath.pptx
suhanisingh58689
 

Wi-Fi Hotspot Attacks

  • 1. Wi-Fi Hacking for Web Pentesters Greg Foss Sr. Security Research Engineer @heinzarelli
  • 2. Greg Foss Sr. Security Research Engineer OSCP, GAWN, GPEN, GWAPT, GCIH, CEH, CYBER APT # whoami
  • 4. *I am not liable for what you do with any of this information* Section 638:17 House Bill 495 - US rules against wireless hacking http://en.wikipedia.org/wiki/Legality_of_piggybacking#United_States
  • 5. DISCLAIMER Not a ‘Wi-Fi Security Expert’ nor a Lawyer Just about everything I’m going to demonstrate is probably illegal, don’t do any of this against unauthorized targets…
  • 6. Not Discussing Wi-Fi Security Basics • 802.11 • WEP Cracking - ridiculously easy, google it • WPA / WPA2 Attacks - Reaver • WPS Attacks - Reaver • PEAP, LEAP, etc. - Out of Scope
  • 9. it’s everywhere… enough free WiFi that it’s almost not worth the time it takes to infiltrate unless free internet’s not the goal…
  • 10. Bypassing is easy… • Sometimes Tor or a VPN will simply be allowed through the captive portal, no joke • Try appending ?.jpg or ?.png to the URL • Look for Open Redirect flaws, iFrames, etc. • Tunnel out over DNS! • Same tricks work if your ISP suspends your internet access, depending on the ISP of course…
  • 11. Bypassing is easy… • On time-limited access points, just change your MAC when the time runs out. Or sniff MACs and ride on another’s paid access. • De-auth existing clients and/or DoS access points: • Aireplay-ng or Airdrop • http://www.aircrack-ng.org/ • MDK3 • https://forums.kali.org/showthread.php?19498- MDK3-Secret-Destruction-Mode
  • 12. Bypassing is easy… • Sniff MAC Addresses and wait for a user to go idle, then modify your MAC and IP to match • Works on just about any open access point, especially captive portals • CPSCAM by Josh Wright will do this for you: • http://www.willhackforsushi.com/code/ cpscam.pl
  • 13. Hijacking is also easy…
  • 16. The Evil Twin… source: http://www.breakthesecurity.com/2014/04/evil-twin-attack-fake-wifi-hack.html
  • 25. How to clone and weaponize captive portals 1. Connect to the access point and wait for the splash page to pop- up. 2. Close the splash page, and open your browser. Visit any random web page (http normally works better than https). 3. When the splash page comes up, save the entire landing page. Use the splash page and save additional pages as necessary. 4. Change the UA string and grab the mobile version as well if it exists. 5. Replace the form processor to write a log file and pass the client through to a legitimate landing page. 6. Modify the page HTML to point to your form processor and modify parameters as necessary. 7. Deploy the captive portal (will discuss this shortly) 8. Use IPTables to allow the victim’s MAC through to the internet using the form processor.
  • 29. Mobile Cloning • HTTrack: http://www.httrack.com/
  • 30. Mobile Cloning • VT View Source:
 
 https://play.google.com/ store/apps/details? id=com.tozalakyan.view source&hl=en
  • 32. How to Deauthenticate Clients and DoS Access Points • Aireplay-ng using the —deauth flag • file2air - deauth packet injection flood tool by Josh Wright • http://www.willhackforsushi.com/code/file2air/1.1/ file2air-1.1.tgz • Spoof AP MAC, send deauth requests to clients • Target a single user, all users, or AP itself • MDK3 Deauth Amok Mode to take out all WPA AP’s
  • 33. How to Deauthenticate Clients and DoS Access Points source: https://github.com/sophron/wifiphisher
  • 34. How to Deauthenticate Clients and DoS Access Points https://github.com/sophron/wifiphisher
  • 37. Generic Splash Page Pineapple Configuration /etc/nodogsplash/htdocs/splash.html
  • 38. Landing Page Pineapple Configuration - JavaScript Necessities /www/[directory]/index.html
  • 39. PHP Form Processor Pineapple Configuration Easier than using IPTables /www/[directory]/auth/login.php
  • 44. A word of caution w/ the Pineapple…
  • 45. A word of caution w/ the Pineapple…
  • 46. Existing Router Ideally one supporting guest mode…
  • 47. DDWRT • Flash with DDWRT, then you can use NocatSplash to configure a captive portal. • Many other ways to go about this… DDWRT is just one of the easier options. • http://www.dd-wrt.com/site/index • http://sourceforge.net/projects/ nocatsplash/
  • 51. • Kali Linux • http://www.kali.org/ • Can do just about anything to connecting clients • Unlimited attack potential and plenty of drive space to build elaborate landing pages and believable scenarios Laptop Hotspot and/or Proxy
  • 52. • Makes hacking Wi-Fi even easier! • https://github.com/SilverFoxx/PwnSTAR PwnStar - By SilverFoxx
  • 55. Demo
  • 57. Combine Pineapple portability with the versatility of Kali Linux • http://www.offensive-security.com/kali- linux/kali-linux-evil-wireless-access-point/
  • 58. BeagleBone Black + Alfa Wi-Fi Card http://beagleboard.org/black http://www.alfa.com.tw/
  • 59. BeagleBone AP Deployment Options get creative…
  • 61. Going Mobile! • Nexus Device with Kali NetHunter • https://www.kali.org/kali-linux-nethunter/ • Pwnie Express Pwn Phone/Pad • https://www.pwnieexpress.com/product/ pwn-phone2014/
  • 66. MITM Basic Tools • AirSSL • AirJack • Airsnarf • Dsniff • Cain • void11 • Ferret • SSLStrip • Wireshark • AirPwn • Ettercap • Etc…
  • 67. You don’t even need to authenticate to attack clients
  • 68. Fun with MITM • Snapception - https://github.com/thebradbain/ snapception • Love Thy Neighbors - http:// neighbor.willhackforsushi.com/ • AirPWN - http://airpwn.sourceforge.net/ Airpwn.html • Intercepter-NG - http://intercepter.nerf.ru/ • Many, many more…
  • 69. Demo
  • 70. Client Defense… • Always use a VPN/VPS/SSH Port Forwarding/ etc. when connected to an open access point. • Turn all Wireless devices off when traveling or in crowded areas, many devices still connect to wireless networks even when ‘sleeping’. • Hotspot not served up over HTTPS and other generally suspicious behavior. • Beware duplicate networks with different encryption.
  • 71. Client Defense… • Use different login details and passwords for public wifi. Test false-credentials first, if it lets you through it’s not legit. • Turn off Wi-Fi on devices when traveling. • Exercise caution when connections suddenly drop, especially if it happens for everyone on the network. • If it just ‘doesn’t feel right’ then trust your instincts…
  • 72. Resources • http://www.willhackforsushi.com/code/cpscam.pl • http://neighbor.willhackforsushi.com/ • http://www.aircrack-ng.org/ • http://www.dd-wrt.com/ • https://github.com/SilverFoxx/PwnSTAR • http://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/ • http://beagleboard.org/black • http://www.armhf.com/boards/beaglebone-black/bbb-sd-install/ • http://grinninggecko.com/2013/09/13/kali-linux-on-headless-beaglebone-black-via- os-x/ • https://github.com/thebradbain/snapception • http://airpwn.sourceforge.net/Airpwn.html • http://intercepter.nerf.ru/