Overview of the Wi-Fi Daemon and Framework components. If you are new to performing Wi-Fi experiments on Linux it is highly recommended to first read the libwifi Linux Tutorial (https://github.com/vanhoefm/libwifi/blob/master/docs/linux_tutorial.md). When you are implementing basic Wi-Fi attacks without the need to reuse Linux functionality, then the framework provides limited advantages and you can instead consider directly implementing attacks in Scapy and optionally use the libwifi (https://github.com/vanhoefm/libwifi) library. Usage To use the framework: Install it (https://github.com/domienschepers/wifi-framework/blob/master/setup). Read the usage tutorial (https://github.com/domienschepers/wifi-framework/blob/master/docs/USAGE.md). Example Say you want to test whether a client ever encrypts frames using an all-zero key. This can happen during a key reinstallation attack (https://www.krackattacks.com/#demo). By using the framework you do not need to reimplement all functionality of an access point, but only need to write the following test case: Handshake Message 3/4. Action( trigger=Trigger.Connected, action=Action.Function ), # Receive all frames and search for one encrypted with an all-zero key. Action( trigger=Trigger.NoTrigger, action=Action.Receive ), # When we receive such a frame, we can terminate the test. Action( trigger=Trigger.Received, action=Action.Terminate ) ]) def resend(self, station): # Resend 4-Way Handshake Message 3/4. station.wpaspy_command("RESEND_M3 " + station.clientmac ) def receive(self, station, frame): if frame[Dot11].addr2 != station.clientmac or not frame.haslayer(Dot11CCMP): return False # Check if CCMP-encrypted frame can be decrypted using an all-zero key plaintext = decrypt_ccmp(frame.getlayer(Dot11), tk=b"\x00"*16) if plaintext is None: return False # We received a valid plaintext frame! log(STATUS,'Client encrypted a frame with an all-zero key!', color="green") return True">class ExampleKrackZerokey(Test):
name = "example-krack-zero-key"
kind = Test.Authenticator

def __init__(self):
super().__init__([
# Replay 4-Way Handshake Message 3/4.
Action( trigger=Trigger.Connected, action=Action.Function ),
# Receive all frames and search for one encrypted with an all-zero key.
Action( trigger=Trigger.NoTrigger, action=Action.Receive ),
# When we receive such a frame, we can terminate the test.
Action( trigger=Trigger.Received, action=Action.Terminate )
])


def resend(self, station):
# Resend 4-Way Handshake Message 3/4.
station.wpaspy_command("RESEND_M3 " + station.clientmac )


def receive(self, station, frame):
if frame[Dot11].addr2 != station.clientmac or not frame.haslayer(Dot11CCMP):
return False

# Check if CCMP-encrypted frame can be decrypted using an all-zero key
plaintext = decrypt_c cmp(frame.getlayer(Dot11), tk=b"\x00"*16)
if plaintext is None: return False

# We received a valid plaintext frame!
log(STATUS,'Client encrypted a frame with an all-zero key!', color="green")
return True The above test case will create an access point that clients can connect to. After the client connects, a new 3rd message in the 4-way handshake will be sent to the client. A vulnerable (https://www.kitploit.com/search/label/Vulnerable) client will then start using an all-zero encryption (https://www.kitploit.com/search/label/Encryption) key, which the test case automatically detects. You can run the above test case using simulated Wi-Fi radios as follows: ./setup/setup-hwsim.sh 4
source setup/venv/bin/activate
./run.py wlan1 example-krack-zero-key
You can connect to the created access point to test it: ./hostap.py wlan2

By changing the network configuration (https://github.com/domienschepers/wifi-framework/blob/master/docs/USAGE.md#id-network-configuration) this AP can easily be configured to use WPA2 or WPA3 and/or can be configured to use enterprise authentication, without making any changes to the test case that we wrote! Additional benifits of using the framework in this example are: No need to manually broadcast beacons The authentication (https://www.kitploit.com/search/label/Authentication) and association stage is handled by the framework The WPA2 and/or WPA3 handshake is handled by the framework Injected packets will be automatically retransmitted by the Linux kernel Packets sent towards the AP will be acknowledged Sleep mode of the client is automatically handled by the kernel ... See a detailed description of all our examples (https://github.com/domienschepers/wifi-framework/blob/master/docs/EXAMPLES.md) for more examples. Publications This work was published at ACM Conference on Security and Privacy in Wireless (https://www.kitploit.com/search/label/Wireless) and Mobile Networks (WiSec '21): DEMO: A Framework to Test and Fuzz Wi-Fi Devices (https://dl.acm.org/doi/10.1145/3448300.3468261) Works that have used this framework or a similar one: FragAttacks: Fragmentation & Aggregation Attacks (https://github.com/vanhoefm/fragattacks)

Download Wifi-Framework (https://github.com/domienschepers/wifi-framework)

What tool do you think is criminally underrated in pentesting?
https://www.reddit.com/r/Pentesting/comments/s2gbm2/what_tool_do_you_think_is_criminally_underrated/

could be also cool to hear about cool or creative tools you found lately. submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/s2gbm2/what_tool_do_you_think_is_criminally_underrated/) [comments] (https://www.reddit.com/r/Pentesting/comments/s2gbm2/what_tool_do_you_think_is_criminally_underrated/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Wifi-Framework - Wi-Fi Framework For Creating Proof-Of-Concepts, Automated Experiments, Test Suites, Fuzzers, And More...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Explain port knocking

Can anyone explain to me what port knocking is, what it's for and how it works? I just don't understand it.

submitted by /u/nonono64qwertyu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Playing with Kerberos tickets (Host service)

https://cdn-images-1.medium.com/max/886/1*_8bR0Lvqh_lKUpjUQyMpkw.png
I’m going to share the results of some experimentation with Kerberos tickets. I’m sorry if this doesn’t add any new value or someone else…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ciberdelincuentes utilizan la nueva puerta trasera de PowerShell en los ataques de Log4j

https://cdn-images-1.medium.com/max/1600/0*rm8QHQ5pzDwsZEnL
PUBLICADO EN 12 ENERO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
El nuevo backdoor SysJoker apunta a Windows, macOS y Linux

https://cdn-images-1.medium.com/max/1600/0*lBj94q0Babv1--jF
PUBLICADO EN 12 ENERO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Why Is Cyber Assessment So Important in Security?

All the pen testing and tabletop exercises in the world won't help unless an organization has a complete and accurate understanding of its assets.

Dark Reading: Attacks/Breaches
New Cyberattack Campaign Uses Public Cloud Infrastructure to Spread RATs

An attack campaign detected in October delivers variants of Nanocore, Netwire, and AsyncRATs to target user data.

Dark Reading: Attacks/Breaches
New Research Reveals Public-Sector IAM Weaknesses and Priorities

Auth0 Public Sector Index shows that governments are struggling to provide trustworthy online citizen services.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Oxeye Introduce Open Source Payload Deobfuscation Tool

Ox4Shell exposes hidden payloads thatare actively being used to confuse security protection tools and security teams.

___________________________
@hacking_Attack
@Hacking_Video

Defeating EDRs with Office Products
https://www.reddit.com/r/redteamsec/comments/s2j4nq/defeating_edrs_with_office_products/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.optiv.com/insights/source-zero/blog/defeating-edrs-office-products) [comments] (https://www.reddit.com/r/redteamsec/comments/s2j4nq/defeating_edrs_with_office_products/)

___________________________
@hacking_Attack
@Hacking_Video