Classic Cars : Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing

Wednesday, August 26, 2020

Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing



Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell (tested on Kali Linux and Cyanogenmod 10.2) and uses aircrack-ng to scan for clients that are currently connected to access points (AP). Those clients are then deauthenticated in order to capture the handshake when attempting to reconnect to the AP. Verification of a captured handshake is done using aircrack-ng. If one or more handshakes are captured, they are entered into an SQLite3 database, along with the time of capture and current GPS data (if properly configured).
After capture, the database can be tested for vulnerable router models using crackdefault.sh. It will search for entries that match the implemented modules, which currently include algorithms to compute default keys for Speedport 500-700 series, Thomson/SpeedTouch and UPC 7 digits (UPC1234567) routers.

Requirements
WiFi interface in monitor mode aircrack-ng SQLite3 openssl for compilation of modules (optional) wlanhc2hcx from hcxtools
In order to log GPS coordinates of handshakes, configure your coordinate logging software to log to .loc/*.txt (the filename can be chosen as desired). Airbash will always use the output of cat "$path$loc"*.txt 2>/dev/null | awk 'NR==0; END{print}', which equals to reading all .txt files in .loc/ and picking the second line. The reason for this way of implementation is the functionality of GPSLogger, which was used on the development device.

Calculating default keys
After capturing a new handshake, the database can be queried for vulnerable router models. If a module applies, the default keys for this router series are calculated and used as input for aircrack-ng to try and recover the passphrase.

Compiling Modules
The modules for calculating Thomson/SpeedTouch and UPC1234567 (7 random digits) default keys are included in src/
Credits for the code go to the authors Kevin Devine and [peter@haxx.in].
On Linux:
gcc -fomit-frame-pointer -O3 -funroll-all-loops -o modules/st modules/stkeys.c -lcrypto
gcc -O2 -o modules/upckeys modules/upc_keys.c -lcrypto
If on Android, you may need to copy the binaries to /system/xbin/ or to another directory where binary execution is allowed.

Usage
Running install.sh will create the database, prepare the folder structure and create shortlinks to both scripts which can be moved to a directory that is on $PATH to allow execution from any location.
After installation, you may need to manually adjust INTERFACE on line 46 in airba.sh. This will later be determined automatically, but for now the default is set to wlan0, to allow out of the box compatibility with bcmon on Android.
./airba.sh starts the script, automatically scanning and attacking targets that are not found in the database. ./crackdefault.sh attempts to break known default key algorithms.
To view the database contents, run sqlite3 .db.sqlite3 "SELECT * FROM hs" in the main directory.

Update (Linux only ... for now):
Airbash can be updated by executing update.sh. This will clone the master branch into /tmp/ and overwrite the local files.

Output
_n: number of access points found
__c/m: represents client number and maximum number of clients found, respectively
-: access point is blacklisted
x: access point already in database
?: access point out of range (not visible to airodump anymore)

The Database
The database contains a table called hs with seven columns.
id: incrementing counter of table entries
lat and lon: GPS coordinates of the handshake (if available)
bssid: MAC address of the access point
essid: Name identifier
psk: WPA Passphrase, if known
prcsd: Flag that gets set by crackdefault.sh to prevent duplicate calculation of default keys if a custom passphrase was used.
Currently, the SQLite3 database is not password-protected.


Related posts
  1. Install Pentest Tools Ubuntu
  2. Hack Tool Apk
  3. Hacker Tools Apk
  4. Hackrf Tools
  5. Hack Tool Apk No Root
  6. Pentest Tools Bluekeep
  7. How To Install Pentest Tools In Ubuntu
  8. Hacking Tools Kit
  9. Beginner Hacker Tools
  10. Hacking Tools Kit
  11. Usb Pentest Tools
  12. Pentest Tools Website Vulnerability
  13. Pentest Tools Free
  14. Hack And Tools
  15. Top Pentest Tools
  16. Android Hack Tools Github
  17. Hacking Tools Free Download
  18. Github Hacking Tools
  19. Hacking Tools For Windows 7
  20. Tools For Hacker
  21. Hacker Tools For Pc
  22. Hacker Tools List
  23. Hack Tools 2019
  24. Hack Tools For Mac
  25. Hacker Search Tools
  26. Hackers Toolbox
  27. Pentest Tools For Ubuntu
  28. Hack Tools Github
  29. How To Install Pentest Tools In Ubuntu
  30. Hacks And Tools
  31. Hacks And Tools
  32. Hacking Tools Pc
  33. Hacking Tools And Software
  34. New Hacker Tools
  35. Bluetooth Hacking Tools Kali
  36. Pentest Box Tools Download
  37. Pentest Tools Android
  38. Hacker Tools For Pc
  39. Underground Hacker Sites
  40. Beginner Hacker Tools
  41. Pentest Tools Review
  42. Hacking Tools Windows 10
  43. Hacking Tools Windows 10
  44. Pentest Tools
  45. Hacker Security Tools
  46. Pentest Tools Find Subdomains
  47. Hacker Security Tools
  48. Hacker Tools Mac
  49. Bluetooth Hacking Tools Kali
  50. Pentest Tools Windows
  51. Hacker Tools Mac
  52. Hacker Tools
  53. Pentest Tools Tcp Port Scanner
  54. Termux Hacking Tools 2019
  55. Hack Tools For Windows
  56. Best Hacking Tools 2019
  57. Hacking Tools Software
  58. Hacker Tools 2020
  59. Hacker Tools Linux
  60. Pentest Tools Free
  61. Pentest Tools Android
  62. Pentest Tools Kali Linux
  63. Pentest Tools For Mac
  64. What Are Hacking Tools
  65. Hacking Tools Name
  66. Hacking Tools For Beginners
  67. Pentest Automation Tools
  68. Hacking App
  69. Hacker Security Tools
  70. Pentest Tools Online
  71. Pentest Tools Url Fuzzer
  72. Hacking Tools Name
  73. Pentest Tools Bluekeep
  74. Nsa Hack Tools
  75. Hacker Techniques Tools And Incident Handling
  76. Hak5 Tools
  77. Pentest Tools Subdomain
  78. Hacking Tools For Beginners
  79. Game Hacking
  80. Hacker Tools
  81. Pentest Box Tools Download
  82. Hacker Tools For Windows
  83. Wifi Hacker Tools For Windows
  84. Usb Pentest Tools
  85. Hacking Tools For Windows 7
  86. Pentest Tools Bluekeep
  87. Hacking Tools Software
  88. Hacking Tools For Windows
  89. Hacking Tools Free Download
  90. Kik Hack Tools
  91. Pentest Tools Github
  92. Hack Apps
  93. Hacker Tools 2020
  94. Hacker Tools Free Download
  95. Hacking Apps
  96. Pentest Tools Tcp Port Scanner
  97. Hacker Tools Free
  98. Hacker Tools Mac
  99. Hacking Tools Download
  100. Pentest Tools Online
  101. Hackrf Tools
  102. Hacker Tools
  103. How To Hack
  104. Pentest Tools
  105. Hacker Tools Linux
  106. Hacking Tools Free Download
  107. Hack Tools For Windows
  108. Hacking Tools
  109. Pentest Tools Open Source
  110. Nsa Hack Tools Download
  111. Pentest Tools Download
  112. Hacker Security Tools
  113. Black Hat Hacker Tools
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)