Wireshark --- Promiscuous Mode --- WPA

[ShadowMaster]

Have you looked at airtun-ng? It does kinda the same thing. Also, be aware that this will only work for TKIP encryption. For CCMP no matter how long you try to decrypt you will not be able to sniff. You may end up with a huge amount of encrypted packets, but you will not be able to decrypt them, sorry. :\ But the idea *IS* cool, and I look forward to the finished product as a new tool in my arsenal against WPA-TKIP .

[Virchanza]

Have you looked at airtun-ng? It does kinda the same thing. Also, be aware that this will only work for TKIP encryption. For CCMP no matter how long you try to decrypt you will not be able to sniff. You may end up with a huge amount of encrypted packets, but you will not be able to decrypt them, sorry. :\ But the idea *IS* cool, and I look forward to the finished product as a new tool in my arsenal against WPA-TKIP .

Nearly got it done.... about one hour more and I'll have it. Taking a break to have dinner. Then I need to figure out why is segfaulting when calling "getopt_long".... shouldn't take me too long. Other than that, everything's done. I've hijacked all the calls to "fread" and "fwrite" with my own functions that just spit frames out on the "lo" interface.

Won't be long now.

[Virchanza]

Nearly got it done.... about one hour more and I'll have it. Taking a break to have dinner. Then I need to figure out why is segfaulting when calling "getopt_long".... shouldn't take me too long. Other than that, everything's done. I've hijacked all the calls to "fread" and "fwrite" with my own functions that just spit frames out on the "lo" interface.

Won't be long now.

Spoke too soon... I'm having trouble with the pcap file format.... I've spent too long on it today, I'll leave it til another time. I'm close though, very close.

[Virchanza]

Mission Accomplished. I've got it working. I'm sniffing WPA traffic on the fly in promiscuous mode using Wireshark.

Here's how I did it:

1) I altered the code of Airdecap to get it to read from "stdio" (standard input), and instead of getting it to write decrypted WPA frames to a file, I used my raw socket networking library to send them out directly on the loop back interface. I got that working first separately on its own.

2) Next I altered the code of Airodump so that instead of writing the captured packets to a file, it would simply print them to "stdout" (standard output).

Then I just piped the output of Airodump into the input of Airdecap, like this:

./airodump-ng --bssid 00:01:02:03:04:05 --channel 8 -o pcap -w dummy wlan0 2> /dev/null | ./airdecap-ng -k 909be2c90072954126daf1927fa62733a5e31e103a47ce211cdcca03e1fb96d2 dummy

Then I sent a de-authentication frame to every host on the WPA wifi network so that they'd reconnect with the 4-way handshake, and Airodump would capture this and send it on to Airdecap on-the-fly.

Next I just opened up Wireshark and listened on the "lo" interface. Now I can see all the WPA traffic in realtime.

[terrafaux]

1) I altered the code of Airdecap to get it to read from "stdio" (standard input), and instead of getting it to write decrypted WPA frames to a file, I used my raw socket networking library to send them out directly on the loop back interface. I got that working first separately on its own.

2) Next I altered the code of Airodump so that instead of writing the captured packets to a file, it would simply print them to "stdout" (standard output).

Hi, can you help me please and give me more details where in the file to alter the code?

Thank you much