Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: Detect Hidden SSID
IntroductionYou see an SSID, you connect to it and you on board a wireless network. But what if I wanted to prevent you from seeing my SSID and thus you are unable to connect? This can be done using Hide SSID option under your router settings. However, hiding is not always the best option to prevent attacks from happening because even while hidden an attacker can capture encrypted frames in monitor mode and know the SSID. We’ll see different methods by which we can detect hidden SSIDs around us. Table of Content<o:p1. What is SSID<o:p
2. Purpose to hide SSID<o:p
3. Configure Router to Hide SSID<o:p
4. Detecting Hidden SSID using airodump-ng <o:p
5. Detecting Hidden SSID using mdk3 <o:p
6. Detecting Hidden SSID using Wireshark<o:p
<o:p What is SSID<o:pSSID Service Set Identifier also known as Network name. It is the name given to identify wireless network. In the range of the wireless AP, SSID is detected by other wireless enabled devices as it is broadcast by wireless AP. Every packet sent over wireless network consists of SSID.<o:p Purpose to Hide SSID<o:pFrom Security Point of View. Hiding your SSID is to makes your Access Point invisible and attackers won’t try to attack this directly as this is less of a low hanging fruit. However, a smart attacker knows how to detect them.<o:p
Hiding an SSID simply refers to disabling the SSID broadcast feature of your Access Point. <o:p Configure Router to Hide SSID<o:pDifferent routers have different configuration settings. Please explore your router features accordingly and find the option to hide the SSID.<o:p
We are having T-Plink router so find the configuration steps accordingly. Let us head to our router settings, Under Wireless setting, Hide SSID option is there against Network Name (SSID), you just need to mark the tick.<o:p https://1.bp.blogspot.com/-JNahehVW6qc/YNjU3R7tAYI/AAAAAAAAw28/wnodbtYJ1eoBfQqi9EkoflgwYMFsm95LQCLcBGAsYHQ/s16000/1.png <o:p
Let’s Begin:<o:p
First Interface should be in the monitor mode. Simple command to convert the interface into monitor mode.<o:p airmon-ng start wlan0<o:p<o:p Detecting Hidden SSID using airodump-ng <o:p<o:pNow when an attacker would do a recon using airodump he’d see something like this:<o:p airodump-ng wlan0mon<o:phttps://1.bp.blogspot.com/-mwYU1GuuAqo/YNjU7UEBIhI/AAAAAAAAw3A/B7QFHw5sy0otxNeBc0ALoD0WD9wa3T7EACLcBGAsYHQ/s16000/2.png As you can see the SSID isn’t visible. Let’s scan this network using its BSSID.<o:p airodump-ng -c 6 --bssid D8:47:32:E9:3F:33 wlan0mon<o:phere, -c = channel 6 on which target is operating (see above screenshot)<o:p https://1.bp.blogspot.com/-DsxdWzjJviA/YNjU_XhEwGI/AAAAAAAAw3E/nUPudMp7meg_UoJz-udjAPQZg1ax9UuTgCLcBGAsYHQ/s16000/3.png Just wait for someone to reconnect. And sure enough, after waiting for a while we see that a client has connected and we are able to retrieve the SSID<o:p
<o:p https://1.bp.blogspot.com/-Gm3TJbe-pIU/YNjVEE75eLI/AAAAAAAAw3M/qHmz2k8ZdLgeYT2sQiAy7965NMvqBBwRQCLcBGAsYHQ/s16000/4.png Detecting Hidden SSID using mdk3<o:pmdk3 is an installable tool in Kali Linux. This tool hosts a feature to conduct offensive tests against Access Points and inject some purposefully constructed data to APs without associating to it. This injection can conduct tests against various vulnerabilities like DoS, deauth, WPA downgrade attacks etc.<o:p
Here, we’d use bruteforce technique against the target AP using mdk3.<o:p apt install mdk3<o:pmdk3 wlan0mon p -b l -c 6 -t D8:47:32:E9:3F:33<o:p
Here, p is the bruteforce mode (ESSID Probing)<o:p
-b : full bruteforc[...]
Wireless Penetration Testing: Detect Hidden SSID
IntroductionYou see an SSID, you connect to it and you on board a wireless network. But what if I wanted to prevent you from seeing my SSID and thus you are unable to connect? This can be done using Hide SSID option under your router settings. However, hiding is not always the best option to prevent attacks from happening because even while hidden an attacker can capture encrypted frames in monitor mode and know the SSID. We’ll see different methods by which we can detect hidden SSIDs around us. Table of Content<o:p1. What is SSID<o:p
2. Purpose to hide SSID<o:p
3. Configure Router to Hide SSID<o:p
4. Detecting Hidden SSID using airodump-ng <o:p
5. Detecting Hidden SSID using mdk3 <o:p
6. Detecting Hidden SSID using Wireshark<o:p
<o:p What is SSID<o:pSSID Service Set Identifier also known as Network name. It is the name given to identify wireless network. In the range of the wireless AP, SSID is detected by other wireless enabled devices as it is broadcast by wireless AP. Every packet sent over wireless network consists of SSID.<o:p Purpose to Hide SSID<o:pFrom Security Point of View. Hiding your SSID is to makes your Access Point invisible and attackers won’t try to attack this directly as this is less of a low hanging fruit. However, a smart attacker knows how to detect them.<o:p
Hiding an SSID simply refers to disabling the SSID broadcast feature of your Access Point. <o:p Configure Router to Hide SSID<o:pDifferent routers have different configuration settings. Please explore your router features accordingly and find the option to hide the SSID.<o:p
We are having T-Plink router so find the configuration steps accordingly. Let us head to our router settings, Under Wireless setting, Hide SSID option is there against Network Name (SSID), you just need to mark the tick.<o:p https://1.bp.blogspot.com/-JNahehVW6qc/YNjU3R7tAYI/AAAAAAAAw28/wnodbtYJ1eoBfQqi9EkoflgwYMFsm95LQCLcBGAsYHQ/s16000/1.png <o:p
Let’s Begin:<o:p
First Interface should be in the monitor mode. Simple command to convert the interface into monitor mode.<o:p airmon-ng start wlan0<o:p<o:p Detecting Hidden SSID using airodump-ng <o:p<o:pNow when an attacker would do a recon using airodump he’d see something like this:<o:p airodump-ng wlan0mon<o:phttps://1.bp.blogspot.com/-mwYU1GuuAqo/YNjU7UEBIhI/AAAAAAAAw3A/B7QFHw5sy0otxNeBc0ALoD0WD9wa3T7EACLcBGAsYHQ/s16000/2.png As you can see the SSID isn’t visible. Let’s scan this network using its BSSID.<o:p airodump-ng -c 6 --bssid D8:47:32:E9:3F:33 wlan0mon<o:phere, -c = channel 6 on which target is operating (see above screenshot)<o:p https://1.bp.blogspot.com/-DsxdWzjJviA/YNjU_XhEwGI/AAAAAAAAw3E/nUPudMp7meg_UoJz-udjAPQZg1ax9UuTgCLcBGAsYHQ/s16000/3.png Just wait for someone to reconnect. And sure enough, after waiting for a while we see that a client has connected and we are able to retrieve the SSID<o:p
<o:p https://1.bp.blogspot.com/-Gm3TJbe-pIU/YNjVEE75eLI/AAAAAAAAw3M/qHmz2k8ZdLgeYT2sQiAy7965NMvqBBwRQCLcBGAsYHQ/s16000/4.png Detecting Hidden SSID using mdk3<o:pmdk3 is an installable tool in Kali Linux. This tool hosts a feature to conduct offensive tests against Access Points and inject some purposefully constructed data to APs without associating to it. This injection can conduct tests against various vulnerabilities like DoS, deauth, WPA downgrade attacks etc.<o:p
Here, we’d use bruteforce technique against the target AP using mdk3.<o:p apt install mdk3<o:pmdk3 wlan0mon p -b l -c 6 -t D8:47:32:E9:3F:33<o:p
Here, p is the bruteforce mode (ESSID Probing)<o:p
-b : full bruteforc[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Wireless Penetration Testing: Detect Hidden SSID IntroductionYou see an SSID, you connect to it and you on board a wireless network. But what if I wanted to prevent you from seeing my SSID and thus you are unable to connect?…
e mode<o:p
l : character set (lower case alphabets). Other denotations being:<o:p
* upper case (u)<o:p
* digits (n)<o:p
* all printed (a)<o:p
* lower and upper case (c)<o:p
* lower and upper case plus numbers (m)<o:p
-c : channel (here, 6)<o:p
-t : MAC or the BSSID of target AP<o:p https://1.bp.blogspot.com/-PoiWyfn62Ww/YNjVH5g4_FI/AAAAAAAAw3U/LOJRdMu2GaYc6DoPGO7q_2cbQ-T17GJjQCLcBGAsYHQ/s16000/5.png As you can see above, the SSID has been successfully detected using probing technique!<o:p Detecting Hidden SSID using Wireshark<o:pFirst Method<o:pFor the old school network analysts, we have a method to detect Hidden SSID using Wireshark too. You know when a client connects to an AP, the hidden SSID is transferred along with the authentication frame.<o:p
So, we put Wireshark in promiscuous mode and select the interface as WLAN and wait for a client to connect automatically to the Wi-Fi<o:p
And sure enough, after waiting for a while we see that a client has connected and we are able to retrieve the SSID<o:p https://1.bp.blogspot.com/-2pPl2JnFaSE/YNjVMWT3srI/AAAAAAAAw3Y/9Ml08dZXg9Afo49oU2SO-KGcpFsCchbQwCLcBGAsYHQ/s16000/8.png However, if you are in a haste to crack ASAP, we can simply deauthenticate the client by force and wait for him to reconnect back.<o:p Second Method<o:pUsing aireplay-ng this can be done like:<o:p aireplay-ng -0 6 -a D8:47:32:E9:3F:33 --ignore-negative wlan0mon<o:phttps://1.bp.blogspot.com/-KvmHYpRrYIY/YNjVPxnm62I/AAAAAAAAw3c/T4HfZE2riEsagAu-706xEMn5mqWyUhw9QCLcBGAsYHQ/s16000/9.png Now the client has been de-authenticated, we can look for a re-authentication request in wireshark using this filter:<o:p wlan.bssid == D8:47:32:E9:3F:33 && !(wlan.fc.type_subtype == 0x08)<o:pwlan.bssid - MAC of the target AP<o:p
wlan.fc.type_subtype - filter to extract management frames. Management frames perform supervisory functions in a Wi-Fi<o:p
0x08 - code for beacons. Beacon is a type of management frame which is regulated after short period of time throughout the network announcing presence of WLAN. It contains network related information about AP like: Beacon interval, timestamp, SSID etc.<o:p
<o:p
We are extracting SSID from this beacon frame here.<o:p https://1.bp.blogspot.com/-eTjctxdYDys/YNjVUgR7TXI/AAAAAAAAw3o/vImLhQ81pnkf18QWXOfoi5uEDWWDPkSPwCLcBGAsYHQ/s16000/10.png The same thing is achievable in airodump-ng as well. We just have to wait for a client to connect to the SSID we are targeting using this command:<o:p
Hope that this article will prove to be useful in detecting previously undetected sneaky Access Points. Thanks for the read.<o:p
l : character set (lower case alphabets). Other denotations being:<o:p
* upper case (u)<o:p
* digits (n)<o:p
* all printed (a)<o:p
* lower and upper case (c)<o:p
* lower and upper case plus numbers (m)<o:p
-c : channel (here, 6)<o:p
-t : MAC or the BSSID of target AP<o:p https://1.bp.blogspot.com/-PoiWyfn62Ww/YNjVH5g4_FI/AAAAAAAAw3U/LOJRdMu2GaYc6DoPGO7q_2cbQ-T17GJjQCLcBGAsYHQ/s16000/5.png As you can see above, the SSID has been successfully detected using probing technique!<o:p Detecting Hidden SSID using Wireshark<o:pFirst Method<o:pFor the old school network analysts, we have a method to detect Hidden SSID using Wireshark too. You know when a client connects to an AP, the hidden SSID is transferred along with the authentication frame.<o:p
So, we put Wireshark in promiscuous mode and select the interface as WLAN and wait for a client to connect automatically to the Wi-Fi<o:p
And sure enough, after waiting for a while we see that a client has connected and we are able to retrieve the SSID<o:p https://1.bp.blogspot.com/-2pPl2JnFaSE/YNjVMWT3srI/AAAAAAAAw3Y/9Ml08dZXg9Afo49oU2SO-KGcpFsCchbQwCLcBGAsYHQ/s16000/8.png However, if you are in a haste to crack ASAP, we can simply deauthenticate the client by force and wait for him to reconnect back.<o:p Second Method<o:pUsing aireplay-ng this can be done like:<o:p aireplay-ng -0 6 -a D8:47:32:E9:3F:33 --ignore-negative wlan0mon<o:phttps://1.bp.blogspot.com/-KvmHYpRrYIY/YNjVPxnm62I/AAAAAAAAw3c/T4HfZE2riEsagAu-706xEMn5mqWyUhw9QCLcBGAsYHQ/s16000/9.png Now the client has been de-authenticated, we can look for a re-authentication request in wireshark using this filter:<o:p wlan.bssid == D8:47:32:E9:3F:33 && !(wlan.fc.type_subtype == 0x08)<o:pwlan.bssid - MAC of the target AP<o:p
wlan.fc.type_subtype - filter to extract management frames. Management frames perform supervisory functions in a Wi-Fi<o:p
0x08 - code for beacons. Beacon is a type of management frame which is regulated after short period of time throughout the network announcing presence of WLAN. It contains network related information about AP like: Beacon interval, timestamp, SSID etc.<o:p
<o:p
We are extracting SSID from this beacon frame here.<o:p https://1.bp.blogspot.com/-eTjctxdYDys/YNjVUgR7TXI/AAAAAAAAw3o/vImLhQ81pnkf18QWXOfoi5uEDWWDPkSPwCLcBGAsYHQ/s16000/10.png The same thing is achievable in airodump-ng as well. We just have to wait for a client to connect to the SSID we are targeting using this command:<o:p
Hope that this article will prove to be useful in detecting previously undetected sneaky Access Points. Thanks for the read.<o:p
Mythic - A Collaborative, Multi-Platform, Red Teaming Framework
http://www.kitploit.com/2021/06/mythic-collaborative-multi-platform-red.html
http://www.kitploit.com/2021/06/mythic-collaborative-multi-platform-red.html
A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly (https://www.kitploit.com/search/label/User%20Friendly) interface for operators, managers, and reporting (https://www.kitploit.com/search/label/Reporting) throughout red teaming.
Details
Check out a series of YouTube videos (https://www.youtube.com/playlist?list=PLHVFedjbv6sNLB1QqnGJxRBMukPRGYa-H) showing how Mythic looks/works and highlighting a few key features Check out the blog post (https://posts.specterops.io/a-change-of-mythic-proportions-21debeb03617) on the rebranding. BSides Seattle 2019 Slides: Ready Player 2: Multiplayer (https://www.slideshare.net/CodyThomas6/ready-player-2-multiplayer-red-teaming-against-macos)Red Teaming (https://www.kitploit.com/search/label/Red%20Teaming) against macOS BSides Seattle 2019 Demo Videos: Available on my Youtube (https://www.youtube.com/playlist?list=PLHVFedjbv6sOz8OGuLdomdkr6-7VdMRQ9) Objective By the Sea 2019 talk on JXA: https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf Objective By the sea 2019 Video: https://www.youtube.com/watch?v=E-QEsGsq3uI&list=PLliknDIoYszvTDaWyTh6SYiTccmwOsws8&index=17 Current Version: 2.1.18
Documentation
All documentation for the Mythic project is being maintained on the docs.mythic-c2.net (https://docs.mythic-c2.net/) website.
Contributions
A bunch of people have suffered through bug reports, changes, and fixes to help make this project better. Thank you! The following people have contributed a lot to the project. As you see their handles throughout the project on Payload Types and C2 Profiles, be sure to reach out to them for help and contributions: @djhohnstein (https://twitter.com/djhohnstein) @xorrior (https://twitter.com/xorrior) @Airzero24 (https://twitter.com/airzero24)
Liability
This is an open source project meant to be used with authorization (https://www.kitploit.com/search/label/Authorization) to assess the security posture and for research (https://www.kitploit.com/search/label/Research) purposes.
Download Mythic (https://github.com/its-a-feature/Mythic)
Details
Check out a series of YouTube videos (https://www.youtube.com/playlist?list=PLHVFedjbv6sNLB1QqnGJxRBMukPRGYa-H) showing how Mythic looks/works and highlighting a few key features Check out the blog post (https://posts.specterops.io/a-change-of-mythic-proportions-21debeb03617) on the rebranding. BSides Seattle 2019 Slides: Ready Player 2: Multiplayer (https://www.slideshare.net/CodyThomas6/ready-player-2-multiplayer-red-teaming-against-macos)Red Teaming (https://www.kitploit.com/search/label/Red%20Teaming) against macOS BSides Seattle 2019 Demo Videos: Available on my Youtube (https://www.youtube.com/playlist?list=PLHVFedjbv6sOz8OGuLdomdkr6-7VdMRQ9) Objective By the Sea 2019 talk on JXA: https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf Objective By the sea 2019 Video: https://www.youtube.com/watch?v=E-QEsGsq3uI&list=PLliknDIoYszvTDaWyTh6SYiTccmwOsws8&index=17 Current Version: 2.1.18
Documentation
All documentation for the Mythic project is being maintained on the docs.mythic-c2.net (https://docs.mythic-c2.net/) website.
Contributions
A bunch of people have suffered through bug reports, changes, and fixes to help make this project better. Thank you! The following people have contributed a lot to the project. As you see their handles throughout the project on Payload Types and C2 Profiles, be sure to reach out to them for help and contributions: @djhohnstein (https://twitter.com/djhohnstein) @xorrior (https://twitter.com/xorrior) @Airzero24 (https://twitter.com/airzero24)
Liability
This is an open source project meant to be used with authorization (https://www.kitploit.com/search/label/Authorization) to assess the security posture and for research (https://www.kitploit.com/search/label/Research) purposes.
Download Mythic (https://github.com/its-a-feature/Mythic)
Mythic - A Collaborative, Multi-Platform, Red Teaming Framework
A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming.Details Check out a series of YouTube videos showing how Mythic looks/works and highlighting a few key features Check out the blog post on the rebranding. BSides Seattle 2019 Slides: Ready Player 2: Multiplayer Red Teaming against macOS BSides Seattle 2019 Demo Videos: Available on my Youtube Objective By the Sea 2019 talk on JXA: https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf Objective By the sea 2019 Video: https://www.youtube.com/watch?v=E-QEsGsq3uI&list=PLliknDIoYszvTDaWyTh6SYiTccmwOsws8&index=17 Current Version: 2.1.18 Documentation All documentation for the Mythic project is being maintained on the docs.mythic-c2.net website. Contributions A bunch of people have suffered through bug reports, changes, and fixes to help make this project better. Thank you! The following people have contributed a lot to the project. As you see their handles throughout the project on Payload Types and C2 Profiles, be sure to reach out to them for help and contributions: @djhohnstein @xorrior @Airzero24 Liability This is an open source project meant to be used with authorization to assess the security posture and for research purposes. Download Mythic
Read more...
A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming.Details Check out a series of YouTube videos showing how Mythic looks/works and highlighting a few key features Check out the blog post on the rebranding. BSides Seattle 2019 Slides: Ready Player 2: Multiplayer Red Teaming against macOS BSides Seattle 2019 Demo Videos: Available on my Youtube Objective By the Sea 2019 talk on JXA: https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf Objective By the sea 2019 Video: https://www.youtube.com/watch?v=E-QEsGsq3uI&list=PLliknDIoYszvTDaWyTh6SYiTccmwOsws8&index=17 Current Version: 2.1.18 Documentation All documentation for the Mythic project is being maintained on the docs.mythic-c2.net website. Contributions A bunch of people have suffered through bug reports, changes, and fixes to help make this project better. Thank you! The following people have contributed a lot to the project. As you see their handles throughout the project on Payload Types and C2 Profiles, be sure to reach out to them for help and contributions: @djhohnstein @xorrior @Airzero24 Liability This is an open source project meant to be used with authorization to assess the security posture and for research purposes. Download Mythic
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Wireless Penetration Testing: Detect Hidden SSID
Introduction You see an SSID, you connect to it and you onboard a wireless network. But what if I wanted to prevent you from seeing my SSID and thus you are unable to connect? This can be done using the Hide SSID option under your router settings. However, hiding is
The post Wireless Penetration Testing: Detect Hidden SSID appeared first on Hacking Articles.
Wireless Penetration Testing: Detect Hidden SSID
Introduction You see an SSID, you connect to it and you onboard a wireless network. But what if I wanted to prevent you from seeing my SSID and thus you are unable to connect? This can be done using the Hide SSID option under your router settings. However, hiding is
The post Wireless Penetration Testing: Detect Hidden SSID appeared first on Hacking Articles.
How to solve a challenge from Intigrity in under 60 minutes
https://medium.com/@terjanq/how-to-solve-a-challenge-from-intigrity-in-under-60-minutes-6843ba9b9552?source=rss------bug_bounty-5
https://medium.com/@terjanq/how-to-solve-a-challenge-from-intigrity-in-under-60-minutes-6843ba9b9552?source=rss------bug_bounty-5
Writeup to Intigriti’s 0621 XSS challengeContinue reading on Medium » (https://medium.com/@terjanq/how-to-solve-a-challenge-from-intigrity-in-under-60-minutes-6843ba9b9552?source=rss------bug_bounty-5)
Fingerprinting a webserver + finding new web applications
https://thexssrat.medium.com/fingerprinting-a-webserver-finding-new-web-applications-820aea96082?source=rss------bug_bounty-5
https://thexssrat.medium.com/fingerprinting-a-webserver-finding-new-web-applications-820aea96082?source=rss------bug_bounty-5
Tools, methodology and thoughtsContinue reading on Medium » (https://thexssrat.medium.com/fingerprinting-a-webserver-finding-new-web-applications-820aea96082?source=rss------bug_bounty-5)
Intigriti — XSS Challenge 0621
https://infosecwriteups.com/intigriti-xss-challenge-0621-cf76c28840c1?source=rss------bug_bounty-5
https://infosecwriteups.com/intigriti-xss-challenge-0621-cf76c28840c1?source=rss------bug_bounty-5
XSS via WebAssemblyContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/intigriti-xss-challenge-0621-cf76c28840c1?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Data Scientist Mathematics Syllabus Complete Road Map Part 1
https://cdn-images-1.medium.com/max/600/0*fKF9Z8QErO-jBTcp.jpg
Data science means different things for different people, but as its gits, data science is using data to answer questions.
this definition…
Continue reading on Medium »
Data Scientist Mathematics Syllabus Complete Road Map Part 1
https://cdn-images-1.medium.com/max/600/0*fKF9Z8QErO-jBTcp.jpg
Data science means different things for different people, but as its gits, data science is using data to answer questions.
this definition…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Fingerprinting a webserver + finding new web applications
https://cdn-images-1.medium.com/max/803/0*08dvzygaB7agS4EY.png
Tools, methodology and thoughts
Continue reading on Medium »
Fingerprinting a webserver + finding new web applications
https://cdn-images-1.medium.com/max/803/0*08dvzygaB7agS4EY.png
Tools, methodology and thoughts
Continue reading on Medium »