Friday, August 21, 2020

Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing



Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell (tested on Kali Linux and Cyanogenmod 10.2) and uses aircrack-ng to scan for clients that are currently connected to access points (AP). Those clients are then deauthenticated in order to capture the handshake when attempting to reconnect to the AP. Verification of a captured handshake is done using aircrack-ng. If one or more handshakes are captured, they are entered into an SQLite3 database, along with the time of capture and current GPS data (if properly configured).
After capture, the database can be tested for vulnerable router models using crackdefault.sh. It will search for entries that match the implemented modules, which currently include algorithms to compute default keys for Speedport 500-700 series, Thomson/SpeedTouch and UPC 7 digits (UPC1234567) routers.

Requirements
WiFi interface in monitor mode aircrack-ng SQLite3 openssl for compilation of modules (optional) wlanhc2hcx from hcxtools
In order to log GPS coordinates of handshakes, configure your coordinate logging software to log to .loc/*.txt (the filename can be chosen as desired). Airbash will always use the output of cat "$path$loc"*.txt 2>/dev/null | awk 'NR==0; END{print}', which equals to reading all .txt files in .loc/ and picking the second line. The reason for this way of implementation is the functionality of GPSLogger, which was used on the development device.

Calculating default keys
After capturing a new handshake, the database can be queried for vulnerable router models. If a module applies, the default keys for this router series are calculated and used as input for aircrack-ng to try and recover the passphrase.

Compiling Modules
The modules for calculating Thomson/SpeedTouch and UPC1234567 (7 random digits) default keys are included in src/
Credits for the code go to the authors Kevin Devine and [peter@haxx.in].
On Linux:
gcc -fomit-frame-pointer -O3 -funroll-all-loops -o modules/st modules/stkeys.c -lcrypto
gcc -O2 -o modules/upckeys modules/upc_keys.c -lcrypto
If on Android, you may need to copy the binaries to /system/xbin/ or to another directory where binary execution is allowed.

Usage
Running install.sh will create the database, prepare the folder structure and create shortlinks to both scripts which can be moved to a directory that is on $PATH to allow execution from any location.
After installation, you may need to manually adjust INTERFACE on line 46 in airba.sh. This will later be determined automatically, but for now the default is set to wlan0, to allow out of the box compatibility with bcmon on Android.
./airba.sh starts the script, automatically scanning and attacking targets that are not found in the database. ./crackdefault.sh attempts to break known default key algorithms.
To view the database contents, run sqlite3 .db.sqlite3 "SELECT * FROM hs" in the main directory.

Update (Linux only ... for now):
Airbash can be updated by executing update.sh. This will clone the master branch into /tmp/ and overwrite the local files.

Output
_n: number of access points found
__c/m: represents client number and maximum number of clients found, respectively
-: access point is blacklisted
x: access point already in database
?: access point out of range (not visible to airodump anymore)

The Database
The database contains a table called hs with seven columns.
id: incrementing counter of table entries
lat and lon: GPS coordinates of the handshake (if available)
bssid: MAC address of the access point
essid: Name identifier
psk: WPA Passphrase, if known
prcsd: Flag that gets set by crackdefault.sh to prevent duplicate calculation of default keys if a custom passphrase was used.
Currently, the SQLite3 database is not password-protected.


Related word


  1. Hack Tools Pc
  2. Hacker Tools List
  3. Hacking Tools
  4. Android Hack Tools Github
  5. Hacker Tools For Windows
  6. Hack Tools Github
  7. Wifi Hacker Tools For Windows
  8. Hacker Search Tools
  9. Hacking Tools 2019
  10. Hack Tools For Windows
  11. Hacker Tools Free Download
  12. Install Pentest Tools Ubuntu
  13. Hack Apps
  14. Hacking Tools Hardware
  15. Hacker Tools Free
  16. Hacking Tools 2020
  17. Android Hack Tools Github
  18. Hacking App
  19. Hacker Search Tools
  20. Hack Tools Online
  21. Pentest Tools Website Vulnerability
  22. Nsa Hack Tools Download
  23. World No 1 Hacker Software
  24. Pentest Tools For Windows
  25. Pentest Tools Port Scanner
  26. Hacking Tools And Software
  27. Beginner Hacker Tools
  28. Hack Tools For Windows
  29. Pentest Recon Tools
  30. Pentest Tools Port Scanner
  31. Growth Hacker Tools
  32. Hacking Tools Github
  33. Best Hacking Tools 2020
  34. Best Hacking Tools 2019
  35. Hacking Tools Windows
  36. Hacking Tools For Games
  37. What Are Hacking Tools
  38. Hacker Techniques Tools And Incident Handling
  39. Hacking Tools Github
  40. Pentest Automation Tools
  41. Install Pentest Tools Ubuntu
  42. Underground Hacker Sites
  43. Hacker Hardware Tools
  44. Hacking Tools
  45. Pentest Tools Port Scanner
  46. Pentest Tools Url Fuzzer
  47. Hacking Tools Pc
  48. Pentest Tools Github
  49. Best Hacking Tools 2020
  50. Hacking Tools Kit
  51. Hacker Tools Software
  52. Easy Hack Tools
  53. Hack Tools
  54. Hack Tools
  55. Hacking Tools And Software
  56. Hacker Tools
  57. Hacking Tools
  58. Nsa Hack Tools Download
  59. Hacking Tools And Software
  60. Termux Hacking Tools 2019
  61. Hacker Tools List
  62. Hacker Tools 2020
  63. Pentest Tools For Ubuntu
  64. Hack Tool Apk No Root
  65. Hacking Tools For Kali Linux
  66. Hacking Tools And Software
  67. Bluetooth Hacking Tools Kali
  68. Hacker Tools Mac
  69. Hacking Tools Free Download
  70. Hack Tools 2019
  71. Pentest Tools Online
  72. Free Pentest Tools For Windows
  73. Hacking Tools Name
  74. Hack Tools Mac
  75. Hacking Tools Software
  76. Pentest Tools Windows
  77. Hack Tools Mac
  78. Hack Tools Mac
  79. Hack Apps
  80. Pentest Tools Framework
  81. Pentest Tools Website Vulnerability
  82. Hacking Tools Windows
  83. Hacker Tools For Pc
  84. Hacker Tools Free
  85. Pentest Tools List
  86. Pentest Tools Url Fuzzer
  87. Pentest Tools For Windows
  88. Wifi Hacker Tools For Windows
  89. Hacker Tools Github
  90. Hack Tools For Games
  91. Pentest Tools Kali Linux
  92. Hacking Tools Hardware
  93. Pentest Tools Free
  94. Github Hacking Tools
  95. Hacking Tools 2020
  96. Hack Tool Apk No Root
  97. Hacking Tools For Windows Free Download
  98. Hack Tools
  99. Hacking Tools Pc
  100. Computer Hacker
  101. Hack Tools Pc

No comments:

Post a Comment