Re: FakeAP

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

captgoodnight captgoodnight wrote:

> Here's some other trickery to spark the imagination,
>
> kismet | gpsd | snort for wireless/rfmon ids
>

I'm using kismet to monitor the APs I'm creating (I have it working,
sorta)

>
> ettercap, add this tool to any of the above methods and control
> your wireless world ;)
>
For the gui version, see 'ethereal'. However, note issues below.

>
> http://www.blackalchemy.to/project/fakeap/
>
> Requires hostap modules and a prism card. You'll find nearly all
> wifi trickery depends on hostap/prism and some orinoco here and
> there (aircrack, kismet...) orinoco cards are really good for
> chop-chop (see aircrack). Defeating fakeap with recon; no
> associated radios in kismet.
>

Orinoco cards aren't all that good. Well, they are useful, but when it
comes to 'trickery', they don't always work. For example, the Orinoco
in one of the dells I have here will do everything BUT set mac
addresses. Another Orinoco I have won't go into monitor mode. You
can go to www.nongnu.org/orinoco and upgrade your drivers, but you're
still at the mercy of your firmware. Firmware 6.x works best
(6.14?). My one NIC is 6.x, and the other (that does virtually
nothing) is 8.x . (Remember: no monitor mode, no promiscuous mode, no
really good sniffing)

I have one wireless NIC (ipw?) that works with fakeap - except I can't
set the channel. At the moment, I have a few thousand APs wandering
around here, but they're all on the same channel. Name, MAC, power,
etc are all different, but the frequency is the same. Bummer.

> Now what about a wireless honey pot, say hostap in master mode with
> dhcpd and honeyd and of course snort...Add some unpatched servers
> and a default iis install for entertainment.-- oh dear trouble is
> brewing.

I'm not sure if one can actually 'connect' to the APs. If you could,
you'd have to finagle how DHCPd would work with that - but it'd be a
lot of fun.

Adam
>
> thanks, --eddie
>
>
>> From: Adam bultman <adamb@glaven.org> To: aklug@aklug.org
>> Subject: FakeAP Date: Wed, 19 Apr 2006 12:51:19 -0800
>>

> I can't remember if I have posted this to aklug yet or not, but
> here goes:
>
> http://www.blackalchemy.to/project/fakeap/
>
> If installed and run, it'll create a ton of APs around on various
> channels, MAC addresses, etc and pretty much make wardriving
> impossible. Give it a dictionary of words, and it'll use those to
> create the ESSIDs - although it comes with it's own (which isn't
> very clever.)
>
> I've been trying to get it to run, but I'm not sure my wireless
> cards are the right type. The kernel doesn't identify any of them
> as Prism2 (One is an intel nic, another an orinoco, and the final
> is some random Dell one).
>
> If I get it working, I'll bring it on friday, and we'll see what
> kind of a mess we can make.
>
> Adam

- ---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.

> --------- To unsubscribe, send email to <aklug-request@aklug.org>
> with 'unsubscribe' in the message body.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFERtKekZb3NX+IDMsRAmFyAJ4t+7J2NqoWgSVBofvjuhK6LTDWgwCdHxqW
0HzggZjp1fMeTWS2VfalHx4=
=6Vm+
-----END PGP SIGNATURE-----

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Wed Apr 19 16:15:48 2006