Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: Wifipumpkin3

Wifipumpkin3 is a framework that is built on python to give rogue access point attacks to red teamers and reverse engineers. In this article, we would look at how we can use this tool to create a bogus Wi-Fi access point for our victims to connect and how to exploit the system. Table of Content<o:p· Overview<o:p

· Installing Wifipumpkin3 <o:p

· Using captive portal attack <o:p

· Generating Custom Captiveflask<o:p

· Writing pulp file for Wifipumpkin<o:p

· One-liner attack<o:p

· DNS Spoof with Wifipumkin<o:p

Overview<o:p

wifipumpkin3 is a powerful framework for rogue access point attack, written in Python, that allows and offers to security researchers, red teamers, and reverse engineers to mount a wireless network to conduct a man-in-the-middle attack.<o:p

Main Features<o:p

· Rogue access point attack<o:p

· Man-in-the-middle attack<o:p

· Module for deauthentication attack<o:p

· Module for extra-captiveflask templates<o:p

· Rogue Dns Server<o:p

· Captive portal attack (captiveflask)<o:p

· Intercept, inspect, modify and replay web traffic<o:p

· WiFi networks scanning<o:p

· DNS monitoring service<o:p

· Credentials harvesting<o:p

· Transparent Proxies<o:p

· LLMNR, NBT-NS and MDNS poisoner (Responder3)<o:p

Installing Wifipumpkin3 <o:p

Before we can use this tool, we need to install the dependent packages for this to work use the following command to do that.<o:p apt install libssl-dev libffi-dev build-essential<o:phttps://1.bp.blogspot.com/-mEfr8fDLWBA/YQFqhESjGII/AAAAAAAAx5U/AW0NH2fuCSo1PZtWPgb2zysTYr5vBY84ACLcBGAsYHQ/s16000/1.png Now that we have installed the dependencies, we need to download the tool from GitHub and change the directory to the wifipumpkin3 and install the python dependency.<o:p git clone https://github.com/P0cL4bs/wifipumpkin3.git <o:pcd Wifipumpkin3 <o:papt install pyhton3-pyqt5<o:phttps://1.bp.blogspot.com/-AOMSgVCh6q0/YQFqoJnBC6I/AAAAAAAAx5Y/lQ4RBWe8cPEzdSibcBhaA_BcZOwLJI3vACLcBGAsYHQ/s16000/2.png Ahh, there are some more packages we would need to import from python<o:p python3 -c "from PyQt5.QtCore import QSettings; print('done')"<o:phttps://1.bp.blogspot.com/-mERnWUfjX4E/YQFqr53M7dI/AAAAAAAAx5c/JEciut5GBJwMvnhBgQLUOcrJU2oT1of2ACLcBGAsYHQ/s16000/3.png As we are done with that we would like to install the setup file which came with wifipumpkin3, this python file will install all the other dependencies that this tool will need to function properly.<o:p python3 setup.py install<o:phttps://1.bp.blogspot.com/-iQwjbaI1GlE/YQFqvko90FI/AAAAAAAAx5g/0zk2E6G7Xx0M1rtQ9HBG6Vr7MJEPpNwYgCLcBGAsYHQ/s16000/4.png Now that we have installed all the tools perfectly let’s get down into using wifipumpkin, the first thing we would do today is to create a fake access point with the name “Free wifi”, with this access point we would wait for a victim to connect to the network and also do a man-in-the middle attack to sniffing packets. we will try to sniff out the post request that may contain users’ credentials like email and password, this would only work with HTTP. Let’s go in to see how this works<o:p Wifipumpkin3<o:pset interface wlan0<o:pset ssid Free Wifi<o:pset proxy noproxy<o:pignore pydns_server<o:pstart <o:pAfter starting the Fake access point, we can see that some protocols have also been started these will help in the capturing of sensitive information which is passed over the network <o:p https://1.bp.blogspot.com/-pBk_CF0OdKo/YQFqz21dTDI/AAAAAAAAx5k/P8i-rz_vOiMNyzWeN9q3AWJfTbMj9_7IQCLcBGAsYHQ/s16000/20.png From our second device, we will fin[...]

d the SSID for bogus AP, when the victim connects to this he will receive malicious IP from our DHCP server. <o:p https://1.bp.blogspot.com/-fKWBY_aiiwg/YQFq6pMdR-I/AAAAAAAAx5s/FkMHe-vC2cQj19ezwwo0rsAN3SAbdebLwCLcBGAsYHQ/s16000/22.jpg From our second device, we could go to an HTTP page that doesn’t have SSL (secured socket layer ) with this whatever information like email, username, or password entered we would be able to view the text entered by the victim.<o:p https://1.bp.blogspot.com/-uQcyidcJA2U/YQFq_NjvEzI/AAAAAAAAx5w/2cnKlkwtuuIBfUk84QwQVtKxTO98TUv_gCLcBGAsYHQ/s16000/23.jpg Wifipumkin capture the traffic and the credentials which were entered by the victim <o:p https://1.bp.blogspot.com/-J66qb07eXcM/YQFrDJVCg7I/AAAAAAAAx54/k_fBLSzNETsONR8uqFklL0PAE7K2VWGiQCLcBGAsYHQ/s16000/24.png Using captive portal attack with wifipumpkin <o:p

Like the first attack, we executed we saw that that had free Wi-Fi and didn’t have security for the access point, but in this, we would have a secure page where the victim would have to enter a username and password for the Wi-Fi, we could use this when we are doing evil twin attack. Now let’s get down to see how we could do this and create a captive portal using wifipumpkin.<o:p
set interface wlan0<o:p

set ssid<o:p

set ssid hotspot<o:p

set proxy captiveflask true<o:p

ignore pydns_server<o:p

start<o:p https://1.bp.blogspot.com/-a3kouU7Dm7g/YQFrK7vokpI/AAAAAAAAx6E/YblBbe_2m8s2luDs8u3GRKM1CEL54v7HACLcBGAsYHQ/s16000/39.png Bellow, we can see that the access point that we have created has started and now we can connect to it from our second device <o:p https://1.bp.blogspot.com/-_cRiqkJ5brE/YQFrUBrSDMI/AAAAAAAAx6M/se3x-1UawuAINXq9mUYnjVanwkIriXOTACLcBGAsYHQ/s16000/40.jpg Immediately we connect on our second device we would be directed to a login page which we would need to enter our wifi username and password before we could use the internet.<o:p https://1.bp.blogspot.com/--Iz3XGkwBsc/YQFrYfzwWtI/AAAAAAAAx6Q/pyi7mHei9cYB02z7j-JbzmmeBbIhywQmACLcBGAsYHQ/s16000/41.jpg From this page we can see that the username and password which we have entered has been captured by wifipumpkin and this information would be displayed in a table form <o:p https://1.bp.blogspot.com/-lO332Jbu3Ns/YQFrgFunxvI/AAAAAAAAx6Y/sdpEAN7BxHUeVUiEPAWvYrt14d9HFmItACLcBGAsYHQ/s16000/42.png Generate Custom Captiveflask<o:p

With wifipumpkin we can use another captive flask than the generic one which we used in the last attack in the following screenshot. It allows us to generate custom templates for a captive flask attack to phish your target.<o:p show<o:puse misc.extra_captiveflask<o:pdownload <o:phttps://1.bp.blogspot.com/-9dCNr-_BeEk/YQFrlIbh2tI/AAAAAAAAx6g/YpfOoTpFUHgH1Cp_DiqULcJn58CI21q2ACLcBGAsYHQ/s16000/43.png Now we would like to use the Facebook captive flask which we need to download as the last screenshot showed <o:p list <o:pinstall facebook<o:phttps://1.bp.blogspot.com/-gl7kEBsf6Iw/YQFrqL8a95I/AAAAAAAAx6k/UCDvyXTKcM83HxL9phXNh0xYTZQjmRTQgCLcBGAsYHQ/s16000/44.png Some dependencies would need to be downloaded for us to use the customized captive flag. which would be shown below <o:p sudo python3 setup.py install <o:phttps://1.bp.blogspot.com/-omECbk-LAJc/YQFrt1632aI/AAAAAAAAx6o/1LoXGd5_s1UQV3B-aObWwi2EKtXRf7gQACLcBGAsYHQ/s16000/45.1.png Now let's get into it and see how we can use the customized captive flask we have downloaded, we would still use the commands we use in the previous attack but just adding the customized captive flask which we downloaded <o:p set interface wlan0<o:pset ssid open wifi<o:pset proxy captive flask<o:pset captiveflask.facebook true <o:pignore pydns_server <o:pstart<o:phttps://1.bp.blogspot.com/-ulZ0jQbzoPE/YQFrzhM5DZI/AAAAAAAAx6w/vYNM5lQxzJ00sk4aiq1VhcI8c9Usg_H2ACLcBGAsYHQ/s16000/45.png From ou[...]

r second service, we need to connect to the ssid “open wifi"<o:p https://1.bp.blogspot.com/-bcGfD52nTdw/YQFr3idoyrI/AAAAAAAAx60/NMWh1ye-aaIIvcXSd6f9VICIaeqvngvkACLcBGAsYHQ/s16000/46.jpg Ahhhh, now that we have connected to the ssid and redirected to the login homepage we can see that what shows wasn’t the generic one we had the last time but this shows a cloned Facebook login page where a victim can put in his credentials and it would be taken.<o:p https://1.bp.blogspot.com/-2IVX-6UOyho/YQFr8fKdckI/AAAAAAAAx64/txYsEr2viiYP4fCHqG_nEwDUo5BEJmF5gCLcBGAsYHQ/s16000/47.jpg From the below screenshot credentials has been taken and printed on the attacker’s screen <o:p https://1.bp.blogspot.com/-vO6ZPlu7Y_U/YQFsDystTQI/AAAAAAAAx7A/-72BJLcOmc0NEyEdS4sBDPbBujT05NX6wCLcBGAsYHQ/s16000/48.png Writing pulp for Wifipumkin<o:p

At times as hackers we would like to make things easier for us and faster one way, we could do this not only with this tool but legitimate everything is to write a script that automates all the commands we would like to input into the program. below we would use the command “nano” to create a file which we have written the command we need to input into wifipumpkin . we need to also make sure that the extension of the file is pulp because that is how wifipumpkin would be able to read the script <o:p https://1.bp.blogspot.com/-ErUf139F9VY/YQFsJay4H2I/AAAAAAAAx7I/-e8omlpk-HQ_ZgD5K6lsqnvmoJZ3u5KLQCLcBGAsYHQ/s16000/75.png Now that we have created the pulp extension script we just need to call up wifipumpkin with the extension of where the script is located <o:p https://1.bp.blogspot.com/-_ngbu-ftG_c/YQFsNJ9o5NI/AAAAAAAAx7M/s3e2embqLHwjsYU4Fax_wI19Z9QjELARwCLcBGAsYHQ/s16000/76.png One-liner Attack<o:p

Just like we created a script to run our commands we can also do that by writing all the requests in one line.<o:p wifipumpkin3 --xpulp “set interface wlan0; set ssid Nisha; set proxy noproxy; start”<o:phttps://1.bp.blogspot.com/-qN0vpAn-7t4/YQFsSOnTY_I/AAAAAAAAx7Q/KYB31_GTMnk9XSFSz8eHhFc6gLx5mxj4gCLcBGAsYHQ/s16000/77.png Here we another SSID as Nisha.<o:p https://1.bp.blogspot.com/-xHSL2TBjJf0/YQFsWq3c4tI/AAAAAAAAx7Y/kIgU73LyhYoSCeU5aB-nfdTBEFoPlKfAgCLcBGAsYHQ/s16000/78.jpg DNS Spoofing with wifipumpkin<o:p

Just as we can use the customized flask which is in the tool we could also use the Html document which we have created and would like to use for the attack on a user. Bellow we would see that we are in the “www” “HTML” directory here is where any HTML file which we need to use for a website is located, we would create an HTML file which displays “welcome to the hacking article” below we would see the walkthrough on how to do this.<o:p https://1.bp.blogspot.com/-rd6qF4v5DjA/YQFscs8lDKI/AAAAAAAAx7c/qgaJtuapmdM6cDX-bfMNaSds9gIVP2lrACLcBGAsYHQ/s16000/80.png Now that we have created the HTML file and know the Ip address for our ethernet cable lets go into wifipumpkin and try to add this new HTML file to our command and see how we can spoof the DNS server so that when we visit the site the DNS server will spoof it to the page which we want it to be <o:p set interface wlan0<o:pset ssid HA<o:pset proxy noproxy <o:pIgnore pydns_server<o:pshow <o:puse spoof.dns_spoof <o:pset domains vulweb.com<o:pset redirectTO 192.168.1.2<o:pstart <o:phttps://1.bp.blogspot.com/-nkGhXw88Hxc/YQFshpP6UmI/AAAAAAAAx7k/XDCuKIElMsYxEkS_PPv1759lRTcFpcR9gCLcBGAsYHQ/s16000/81.png Now that the attack has started we can now connect to the ssid “HA” . and when the victim visits the “vulweb.com” he would be redirected by the DNS server to the page which we created on our attacking machine.<o:p https://1.bp.blogspot.com/-cAl2mBG3two/YQFsrNo4qrI/AAAAAAAAx7s/LWkSRV4q32gXKkJQDLkqr4r0O5C6TsBHACLcBGAsYHQ/s16000/82.jpg Below shows the HTML file which we created and how the DNS server spoof the webpage “vulweb.com” to[...]

the one we wanted. <o:p https://1.bp.blogspot.com/-4RNariejzKs/YQFszzCe-iI/AAAAAAAAx70/1E-3XJCdGfgS1sI4vA-uGuWreDNVG58EwCLcBGAsYHQ/s16000/83.jpg

hacking: security in practice
Do you consider ddos/dos hacking?

I need to settle an argument

submitted by /u/kikiokol1
[link] [comments]

hacking: security in practice
How a program can run by him self ?

For example a ransomware worm like wannacry, when it spread, it is on the computers but nobody has to click on it to run it, it runs by himself. Can anybody can explain to me how it works ? Thanks

submitted by /u/Mx_Mlr
[link] [comments]

hacking: security in practice
How a program can run by him self ?

For example a ransomware worm like wannacry, when he spread, he is on the computers but nobody has to click on it to run it, he runs by himself. Can anybody can explain to me how it works ? Thanks

submitted by /u/Mx_Mlr
[link] [comments]

hacking: security in practice
Does anyone know what is this URL and what is this do?

okta2.pornhubpremiumemailblasts.com

​

What actually do this website?

submitted by /u/wisnshaftler
[link] [comments]

Kali Linux Tutorials
Ppmap : A Scanner/Exploitation Tool Written In GO, Which Leverages Prototype Pollution To XSS By Exploiting Known Gadgets

Ppmap is a simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advanced Prototype Pollution exploitation, which may include custom gadgets. Requirements […]

The post Ppmap : A Scanner/Exploitation Tool Written In GO, Which Leverages Prototype Pollution To XSS By Exploiting Known Gadgets appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Zero Trust Adoption Report: How does your organization compare?
https://www.reddit.com/r/redteamsec/comments/othhus/zero_trust_adoption_report_how_does_your/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/ZeroTrustAdoptionReport) [comments] (https://www.reddit.com/r/redteamsec/comments/othhus/zero_trust_adoption_report_how_does_your/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Recap: 1k high-quality and informative articles

https://cdn-images-1.medium.com/max/1920/1*htMGXyktOFg5YvnYjATW7w.jpeg
I love a hack. Here’s my playback on hacking article production.

Continue reading on Startup Kin »

___________________________
@hacking_Attack
@Hacking_Video

CredPhish - A PowerShell Script Designed To Invoke Legitimate Credential Prompts And Exfiltrate Passwords Over DNS
http://www.kitploit.com/2021/07/credphish-powershell-script-designed-to.html

___________________________
@hacking_Attack
@Hacking_Video

CredPhish is a PowerShell (https://www.kitploit.com/search/label/PowerShell) script designed to invoke credential prompts and exfiltrate passwords. It relies on CredentialPicker (https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.ui.credentialpicker?view=winrt-19041) to collect user passwords, Resolve-DnsName (https://docs.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname) for DNS exfiltration, and Windows (https://www.kitploit.com/search/label/Windows) Defender's ConfigSecurityPolicy.exe (https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/) to perform arbitrary GET requests.
For a walkthrough, see the Black Hills (https://www.blackhillsinfosec.com/how-to-phish-for-user-passwords-with-powershell/)Infosec (https://www.kitploit.com/search/label/Infosec) publication.

Download CredPhish (https://github.com/tokyoneon/CredPhish)

___________________________
@hacking_Attack
@Hacking_Video

CredPhish - A PowerShell Script Designed To Invoke Legitimate Credential Prompts And Exfiltrate Passwords Over DNS

CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. It relies on CredentialPicker to collect user passwords, Resolve-DnsName for DNS exfiltration, and Windows Defender's ConfigSecurityPolicy.exe to perform arbitrary GET requests. For a walkthrough, see the Black Hills Infosec publication. Download CredPhish
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it worth looking into an even deeper level beyond transistors?

I didn't know where to start with hacking, even after reading the posts on this sub. So I figured I might as well try to understand how a computer even works when it comes to hardware and what it is made of.

Would you guys say that transistors followed by logic gates etc. are the deepest level of understanding you need, or is there an even deeper level of knowledge about how computers are build tht is worth looking into?

submitted by /u/hahahalookatmexd
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
made a computer virus that shut downs the computers usability.

I made it to shut it down by disabling the keyboard and replacing all and adding text as "You are doomed" if it is downloaded by a victim computer it will fully disable it by not being able to shut it down and copying its self into the downloaded internet explorer and cant be shut off until it is shut off by the main domain. Should I use it on scammers in Indonesia? Edit: or on my teachers

submitted by /u/unkn_usr
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

NTLM relaying to AD CS - On certificates, printers and a little hippo
https://www.reddit.com/r/redteamsec/comments/otk100/ntlm_relaying_to_ad_cs_on_certificates_printers/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/) [comments] (https://www.reddit.com/r/redteamsec/comments/otk100/ntlm_relaying_to_ad_cs_on_certificates_printers/)

___________________________
@hacking_Attack
@Hacking_Video