https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=Lstrobl 2026-09-10T18:06:28Z User contributions MediaWiki 1.41.5 https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1345 2019-03-28T15:37:41Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP-32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> Press the RST button on your device.<br /> <br /> === Step 6 - First Interaction with ESP-32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[ESP-32 NodeMCU Development Board]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1344 2019-03-28T15:30:27Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP-32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP-32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[ESP-32 NodeMCU Development Board]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1343 2019-03-28T15:29:29Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP-32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP-32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[https://wiki.elvis.science/index.php?title=ESP-32_NodeMCU_Development_Board]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1342 2019-03-28T15:29:12Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP-32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP-32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[https://wiki.elvis.science/index.php?title=ESP-32_NodeMCU_Development_Board|ESP-32]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1341 2019-03-28T15:27:45Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP-32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP-32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[https://wiki.elvis.science/index.php?title=ESP-32_NodeMCU_Development_Board| ESP-32]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1340 2019-03-28T15:26:23Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[https://wiki.elvis.science/index.php?title=ESP-32_NodeMCU_Development_Board, test]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1339 2019-03-28T15:26:06Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the changes effective.<br /> <br /> Verify if the variable has been set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[https://wiki.elvis.science/index.php?title=ESP-32_NodeMCU_Development_Board test]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1338 2019-03-28T15:22:30Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. Add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. Add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the change effective.<br /> <br /> Verify if set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure your device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug your device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Unplug your device.<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug your device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - First Interaction with ESP32 via BLE ===<br /> <br /> Discover the MAC address of your device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> === Step 7 - Upload your first flag ===<br /> <br /> Run (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n &quot;12345678901234567890&quot;|xxd -ps)<br /> <br /> Display the score (replace the x's with your MAC address):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The output should now display:<br /> <br /> Score:1 /20<br /> <br /> Congratulations!! You successfully setup your ESP32 and successfully uploaded the first flag! :)<br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * [[https://wiki.elvis.science/index.php?title=ESP-32_NodeMCU_Development_Board]]<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1337 2019-03-28T14:59:44Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. Add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. Add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the change effective.<br /> <br /> Verify if set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure the device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug the device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug the device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - ===<br /> <br /> Discover the MAC address of the device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> == Used Hardware ==<br /> <br /> * Ubuntu host computer<br /> * ESP32<br /> * Micro USB cable<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1336 2019-03-28T14:57:30Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> * Packages: git emacs<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download ESP32 toolchain for Linux and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. Add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. Add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the change effective.<br /> <br /> Verify if set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure the device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug the device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug the device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - ===<br /> <br /> Discover the MAC address of the device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> == Used Hardware ==<br /> <br /> [[Device to be used with this documentation]]<br /> [[Maybe another device to be used with this documentation]]<br /> <br /> == References ==<br /> <br /> * http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1335 2019-03-28T14:56:01Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> * Packages: git emacs<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download ESP32 toolchain for Linux and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. Add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> The output should contain (userName gets replaced by your user name):<br /> <br /> /home/userName/esp/xtensa-esp32-elf/bin<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. Add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the change effective.<br /> <br /> Verify if set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> The output should display the previously entered path (replace userName with your user name):<br /> <br /> /home/userName/esp/esp-idf<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure the device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug the device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 4. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug the device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - ===<br /> <br /> Discover the MAC address of the device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> == Used Hardware ==<br /> <br /> [[Device to be used with this documentation]]<br /> [[Maybe another device to be used with this documentation]]<br /> <br /> == Courses ==<br /> <br /> * [[A course where this documentation was used]] (2017, 2018)<br /> * [[Another one]] (2018)<br /> <br /> == References ==<br /> <br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=BLE_CTF&diff=1334 2019-03-28T14:50:23Z

<p>Lstrobl: Created page with &quot;== Summary == This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges. == Requirements == * Operating system: Ubuntu 18.04 bionic amd6...&quot;</p> <hr /> <div>== Summary == <br /> <br /> This tutorial explains how to setup an ESP32 device for solving 20 flag based BLE challenges.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> * Packages: git emacs<br /> <br /> == Description ==<br /> <br /> === Step 1 - Standard Setup of Toolchain for Linux ===<br /> <br /> Install prerequisites:<br /> <br /> sudo apt-get install gcc git wget make libncurses-dev flex bison gperf python python-pip python-setuptools python-serial python-cryptography python-future python-pyparsing<br /> <br /> Download ESP32 toolchain for Linux and extract it in ~/esp directory:<br /> <br /> mkdir -p ~/esp<br /> cd ~/esp<br /> tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz<br /> <br /> Update your PATH environment variable in ~/.profile to use the toolchain. Add the following line to your ~/.profile file:<br /> <br /> export PATH=&quot;$HOME/esp/xtensa-esp32-elf/bin:$PATH&quot;<br /> <br /> Log off and log back in to make the changes effective. Run the following command to verify if PATH is correctly set:<br /> <br /> printenv PATH<br /> <br /> === Step 2 - Install ESP-IDF ===<br /> <br /> Go to ~/esp and clone the repository:<br /> <br /> cd ~/esp<br /> git clone --recursive https://github.com/espressif/esp-idf.git<br /> <br /> Set the IDF_PATH environment variable. Add the following line to ~/.profile:<br /> <br /> export IDF_PATH=~/esp/esp-idf<br /> <br /> Log off and log back in to make the change effective.<br /> <br /> Verify if set correctly:<br /> <br /> printenv IDF_PATH<br /> <br /> === Step 3 - Install Python packages ===<br /> <br /> Run:<br /> <br /> python -m pip install --user -r $IDF_PATH/requirements.txt<br /> <br /> === Step 4 - Connect the device ===<br /> <br /> Make sure the device is unplugged, then run:<br /> <br /> ls /dev/tty*<br /> <br /> Plug the device into the host computer and run again:<br /> <br /> ls /dev/tty*<br /> <br /> The port that appears the second time is the one needed.<br /> <br /> === Step 5 - CTF Setup ===<br /> <br /> Change into your ~/esp directory and execute the following commands:<br /> <br /> cd ~/esp<br /> git clone https://github.com/hackgnar/ble_ctf.git<br /> cd ble_ctf<br /> make menuconfig<br /> <br /> A window appears. Navigate to &quot;Serial flasher config&quot; &gt; &quot;Default Serial port&quot; and enter the port you found out in step 5. Confirm, save and exit.<br /> <br /> make<br /> <br /> Plug the device into your host computer.<br /> <br /> make flash<br /> <br /> === Step 6 - ===<br /> <br /> Discover the MAC address of the device:<br /> <br /> sudo hcitool lescan<br /> <br /> The device with the description &quot;BLECTF&quot; is your device.<br /> <br /> Display current score (replace the x's with the MAC address discovered before):<br /> <br /> gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n' <br /> <br /> The terminal should display:<br /> <br /> Score: 0/20<br /> <br /> == Used Hardware ==<br /> <br /> [[Device to be used with this documentation]]<br /> [[Maybe another device to be used with this documentation]]<br /> <br /> == Courses ==<br /> <br /> * [[A course where this documentation was used]] (2017, 2018)<br /> * [[Another one]] (2018)<br /> <br /> == References ==<br /> <br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html<br /> * https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html<br /> * https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1317 2019-03-13T11:20:39Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) Test if the adapter supports injection:<br /> <br /> aireplay-ng -9 wlan1mon<br /> <br /> Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].<br /> <br /> (**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> <br /> == Results ==<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Browser !! urlsnarf !! driftnet<br /> |-<br /> | Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Samsung Internet (Android host) || URLs captured || images captured<br /> |-<br /> |}<br /> <br /> == Used Hardware ==<br /> <br /> * Windows 10 host<br /> * Kali Linux host<br /> * Samsung Galaxy A8<br /> * [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]<br /> * [[Panda 300 Mbps Wireless N USB Adapter PAU05]]<br /> * [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]<br /> * [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=File:WiFiAdapter.zip&diff=1316 2019-03-13T11:20:11Z

<p>Lstrobl: </p> <hr /> <div></div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1315 2019-03-13T07:27:31Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) Test if the adapter supports injection:<br /> <br /> aireplay-ng -9 wlan1mon<br /> <br /> Detailed information about wireless adapters available in ELVIS can be found [[:File:Wi-Fi Adapters Overview.zip|here]].<br /> <br /> (**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> <br /> == Results ==<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Browser !! urlsnarf !! driftnet<br /> |-<br /> | Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Samsung Internet (Android host) || URLs captured || images captured<br /> |-<br /> |}<br /> <br /> == Used Hardware ==<br /> <br /> * Windows 10 host<br /> * Kali Linux host<br /> * Samsung Galaxy A8<br /> * [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]<br /> * [[Panda 300 Mbps Wireless N USB Adapter PAU05]]<br /> * [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]<br /> * [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1314 2019-03-12T13:15:05Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a [https://en.wikipedia.org/wiki/Zigbee ZigBee] network as described in [[ZigBee Sniffing]] the next step is to conduct a [https://en.wikipedia.org/wiki/Replay_attack replay attack] by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> ** Version 2018.2<br /> * Packages: [https://github.com/riverloopsec/killerbee KillerBee]<br /> * Operating system of Raspberry Pi: [https://www.dresden-elektronik.de/funktechnik/solutions/wireless-light-control/raspbee-gw-sd-card-image/?L=1 RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)]<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * &lt;code&gt;zbreplay&lt;/code&gt; does not work due to counter queries<br /> * [https://en.wikipedia.org/wiki/Python_(programming_language) Python] script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the [https://en.wikipedia.org/wiki/Frame_check_sequence FCS] and [https://de.wikipedia.org/wiki/Message_Integrity_Check MIC] are wrong<br /> ** Packet is not constructed<br /> * [[:File:ZigBeeReplay.pdf|Documentation]] of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the [[AVR RZUSBSTICK|Atmel RZ Raven USB stick]].<br /> The solution would be a [https://en.wikipedia.org/wiki/Software-defined_radio Software Defined Radio (SDR)].<br /> The drivers of scapy were only written for the [https://www.ettus.com/ Ettus USRP] but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * [[Raspberry Pi 3, Model B+, WLAN, BT]]<br /> * [[Kingston 8GB micro SD-HC class 4]]<br /> * [[RaspBee premium, Erweiterungsplatine mit Funkmodul für Raspberry Pi]]<br /> * [[Philips Hue White and Color Ambiance Single LED-Bulb E27 10W]]<br /> * [[AVR RZUSBSTICK]]<br /> * [https://www.kali.org/downloads/12/ Kali Linux] host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1313 2019-03-12T13:10:38Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]] with a [[RaspBee premium, Erweiterungsplatine mit Funkmodul für Raspberry Pi|Raspbee module]] and a [[Philips Hue White and Color Ambiance Single LED-Bulb E27 10W|Philips Hue light bulb]] was sniffed with the [[AVR RZUSBSTICK|Atmel RZ Raven USB stick]]. The Transport Key was obtained and therefore the on/off commands sent from the [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]] to the light bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** [https://www.sdcard.org/downloads/formatter_4/ SD Card Formatter 5.0 for SD/SDHC/SDXC]<br /> *** [https://sourceforge.net/projects/win32diskimager/ Win32 Disk Imager]<br /> * Operating system of attacking host: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> ** Version 2018.2<br /> * Packages: [https://github.com/riverloopsec/killerbee KillerBee]<br /> * Operating system of Raspberry Pi: [https://www.dresden-elektronik.de/funktechnik/solutions/wireless-light-control/raspbee-gw-sd-card-image/?L=1 RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)]<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[:File:ZigBeeSniffing.pdf|documentation]] about the [https://en.wikipedia.org/wiki/Zigbee ZigBee protocol] and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * [[Raspberry Pi 3, Model B+, WLAN, BT]]<br /> * [[Kingston 8GB micro SD-HC class 4]]<br /> * [[RaspBee premium, Erweiterungsplatine mit Funkmodul für Raspberry Pi]]<br /> * [[Philips Hue White and Color Ambiance Single LED-Bulb E27 10W]]<br /> * [[AVR RZUSBSTICK]]<br /> * [https://www.microchip.com/Developmenttools/ProductDetails/ATAVRDRAGON AVR Dragon programming board]<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * [https://www.kali.org/downloads/12/ Kali Linux] host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1312 2019-03-12T13:00:07Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Create a [https://en.wikipedia.org/wiki/Rogue_access_point rogue Wi-Fi access point] on [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]].<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3]<br /> ** Version 2019.1<br /> * Packages: Dependencies [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== [[Raspberry Pi 7&quot; Display Touch Screen LCD|Touchscreen]] ====<br /> <br /> * Connect the small ribbon cable to the connector on the top of the board<br /> * Fix the board to the screen with the four spacers<br /> * Connect the white ribbon cable to the connector on the board<br /> * Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> * Mount your [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]] onto the four spacers<br /> * Connect the white ribbon to the Display Connector of the [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]]<br /> * Connect the jumper wires (assuming your [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]] is in front of you with the [https://en.wikipedia.org/wiki/General-purpose_input/output GPIO] on the right side):<br /> ** GND to the third pin down on the right hand side<br /> ** 5V to the second pin down on the right<br /> ** SCL to the third pin down on the left hand side<br /> ** SDA to the second pin down on the left hand side<br /> ** Click [https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide here] for more detailed information of the assembly<br /> * Connect your keyboard and mouse to the [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]]<br /> * Connect the [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA]] wireless interface to the [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]]<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3] (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]] and connect it with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ----<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate [https://en.wikipedia.org/wiki/Secure_Shell SSH] keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the [https://en.wikipedia.org/wiki/Ext4 ext4] partition to use the rest of the unused space<br /> <br /> ----<br /> <br /> * Install [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the [[Raspberry Pi 3, Model B+, WLAN, BT|Raspberry Pi]] (either wired or wireless)<br /> * Identify the name of [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA]] wireless interface (wlan1 in my case):<br /> <br /> iwconfig<br /> <br /> * Set the [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA]] wireless interface to [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] of your target network (1 in my case)<br /> * Set your [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA]] to the appropriate [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel]:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;[https://en.wikipedia.org/wiki/Service_set_(802.11_network)#Service_set_identifier_(SSID) SSID]&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;[https://en.wikipedia.org/wiki/List_of_WLAN_channels Channel]&quot; to the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA]'s name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;[https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/TCP-PProxy TCP Proxy]&quot;<br /> ** Select &quot;[https://github.com/LeonardoNve/sslstrip2 SSLStrip]+[https://github.com/LeonardoNve/dns2proxy DNS2Proxy]&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * [[Raspberry Pi 3, Model B+, WLAN, BT]]<br /> * [[Kingston 8GB micro SD-HC class 4]]<br /> * [[Raspberry Pi 7&quot; Display Touch Screen LCD]]<br /> * [[Goobay micro-USB Netzteil 2.5A for Raspberry Pi]]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1311 2019-03-12T12:52:06Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection].<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (*):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> <br /> == Results ==<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Browser !! urlsnarf !! driftnet<br /> |-<br /> | Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file<br /> |-<br /> | Samsung Internet (Android host) || URLs captured || images captured<br /> |-<br /> |}<br /> <br /> == Used Hardware ==<br /> <br /> * Windows 10 host<br /> * Kali Linux host<br /> * Samsung Galaxy A8<br /> * [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]<br /> * [[Panda 300 Mbps Wireless N USB Adapter PAU05]]<br /> * [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]<br /> * [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1310 2019-03-12T12:40:23Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection].<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (*):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> ----<br /> <br /> == Results ==<br /> <br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Windows 10 host<br /> * Kali Linux host<br /> * Samsung Galaxy A8<br /> * [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]<br /> * [[Panda 300 Mbps Wireless N USB Adapter PAU05]]<br /> * [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]<br /> * [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1309 2019-03-12T12:20:47Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting monitor mode and packet injection.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start monitor mode on the external adapter (*):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable monitor mode:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) This command did not work with ALFA NETWORK AWUS036ACH. The following commands are an alternative way to start monitor mode on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> ----<br /> <br /> == Results ==<br /> <br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Windows 10 host<br /> * Kali Linux host<br /> * [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon Nexus]]<br /> * [http://www.pandawireless.com/panda300mbps.htm Panda PAU05 300Mbps Wireless N USB Adapter]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036EAC]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1308 2019-03-12T12:19:39Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting monitor mode and packet injection.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start monitor mode on the external adapter (*):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable monitor mode:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) This command did not work with ALFA NETWORK AWUS036ACH. The following commands are an alternative way to start monitor mode on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> ----<br /> <br /> == Results ==<br /> <br /> <br /> <br /> == Used Hardware ==<br /> <br /> * Windows 10 host<br /> * Kali Linux host<br /> * [LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon Nexus]<br /> * [http://www.pandawireless.com/panda300mbps.htm Panda PAU05 300Mbps Wireless N USB Adapter]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036EAC]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1307 2019-03-12T12:13:50Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting monitor mode and packet injection.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> === Step 1 ===<br /> <br /> Open a terminal.<br /> <br /> Display your wireless interfaces:<br /> <br /> iwconfig<br /> <br /> Connect the external Wi-Fi adapter to your host computer.<br /> <br /> iwconfig<br /> <br /> The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.<br /> <br /> Start monitor mode on the external adapter (*):<br /> <br /> airmon-ng start wlan1<br /> <br /> The previous command creates a new interface called 'wlan1mon'. Verify with:<br /> <br /> iwconfig<br /> <br /> Display active Wi-Fi networks:<br /> <br /> airodump-ng wlan1mon<br /> <br /> Remember the channel of the network you want to attack. In my case it was channel 11.<br /> <br /> Set your adapter to the appropriate channel:<br /> <br /> iwconfig wlan1mon channel 11<br /> <br /> Verify the frequency:<br /> <br /> iwconfig wlan1mon<br /> iwlist channel<br /> <br /> Start capturing data:<br /> <br /> airodump-ng --channel 11 -w alfa wlan1mon<br /> <br /> Filter URLs from captured traffic:<br /> <br /> urlsnarf -p alfa-01.cap<br /> <br /> Filter pictures from captured traffic:<br /> <br /> driftnet -f alfa-01.cap -a -d Pictures/<br /> <br /> Disable monitor mode:<br /> <br /> airmon-ng stop wlan1mon<br /> <br /> ----<br /> (*) This command did not work with ALFA NETWORK AWUS036ACH. The following commands are an alternative way to start monitor mode on the adapter:<br /> <br /> ifconfig wlan1 down<br /> iwconfig wlan1 mode monitor<br /> ifconfig wlan1 up<br /> ----<br /> <br /> === Results ===<br /> <br /> <br /> <br /> == Used Hardware ==<br /> <br /> * [http://www.pandawireless.com/panda300mbps.htm Panda PAU05 300Mbps Wireless N USB Adapter]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036EAC]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi_Sniffing&diff=1287 2019-03-11T15:57:23Z

<p>Lstrobl: Created page with &quot;== Summary == Sniff Wi-Fi traffic using wireless interfaces supporting monitor mode and packet injection. == Requirements == * Operating system: [https://www.kali.org/down...&quot;</p> <hr /> <div>== Summary == <br /> <br /> Sniff Wi-Fi traffic using wireless interfaces supporting monitor mode and packet injection.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> <br /> == Description ==<br /> <br /> === Step 1 ===<br /> <br /> Enter these commands in the shell<br /> <br /> echo foo<br /> echo bar<br /> <br /> === Step 2 ===<br /> <br /> Make sure to read<br /> <br /> * War and Peace<br /> * Lord of the Rings<br /> * The Baroque Cycle<br /> <br /> == Used Hardware ==<br /> <br /> * [http://www.pandawireless.com/panda300mbps.htm Panda PAU05 300Mbps Wireless N USB Adapter]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036EAC]<br /> <br /> == References ==<br /> <br /> * https://www.androidauthority.com/capture-data-open-wi-fi-726356/<br /> * https://www.aircrack-ng.org/doku.php?id=airmon-ng<br /> * https://www.aircrack-ng.org/doku.php?id=airodump-ng<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1286 2019-03-11T15:37:24Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Create a [https://en.wikipedia.org/wiki/Rogue_access_point rogue Wi-Fi access point] on [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi].<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3]<br /> ** Version 2019.1<br /> * Packages: Dependencies [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== Touchscreen ====<br /> <br /> * Connect the small ribbon cable to the connector on the top of the board<br /> * Fix the board to the screen with the four spacers<br /> * Connect the white ribbon cable to the connector on the board<br /> * Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> * Mount your [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] onto the four spacers<br /> * Connect the white ribbon to the Display Connector of the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Connect the jumper wires (assuming your [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] is in front of you with the [https://en.wikipedia.org/wiki/General-purpose_input/output GPIO] on the right side):<br /> ** GND to the third pin down on the right hand side<br /> ** 5V to the second pin down on the right<br /> ** SCL to the third pin down on the left hand side<br /> ** SDA to the second pin down on the left hand side<br /> ** Click [https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide here] for more detailed information of the assembly<br /> * Connect your keyboard and mouse to the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Connect the [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface to the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3] (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] and connect it with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ----<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate [https://en.wikipedia.org/wiki/Secure_Shell SSH] keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the [https://en.wikipedia.org/wiki/Ext4 ext4] partition to use the rest of the unused space<br /> <br /> ----<br /> <br /> * Install [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] (either wired or wireless)<br /> * Identify the name of [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface (wlan1 in my case):<br /> <br /> iwconfig<br /> <br /> * Set [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface to [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] of your target network (1 in my case)<br /> * Set your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] to the appropriate [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel]:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;[https://en.wikipedia.org/wiki/Service_set_(802.11_network)#Service_set_identifier_(SSID) SSID]&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;[https://en.wikipedia.org/wiki/List_of_WLAN_channels Channel]&quot; to the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA]'s name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;[https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/TCP-PProxy TCP Proxy]&quot;<br /> ** Select &quot;[https://github.com/LeonardoNve/sslstrip2 SSLStrip]+[https://github.com/LeonardoNve/dns2proxy DNS2Proxy]&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B]<br /> * Micro SD Card 8GB + adapter<br /> * [https://www.raspberrypi.org/products/raspberry-pi-touch-display/ Raspberry Pi 7&quot; Touchscreen Display]<br /> * Micro USB charger 2.5 A for Raspberry Pi<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1285 2019-03-11T15:37:12Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Create a [https://en.wikipedia.org/wiki/Rogue_access_point rogue Wi-Fi access point] on [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi].<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3]<br /> ** Version 2019.1<br /> * Packages: Dependencies [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== Touchscreen ====<br /> <br /> * Connect the small ribbon cable to the connector on the top of the board<br /> * Fix the board to the screen with the four spacers<br /> * Connect the white ribbon cable to the connector on the board<br /> * Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> * Mount your [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] onto the four spacers<br /> * Connect the white ribbon to the Display Connector of the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Connect the jumper wires (assuming your [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] is in front of you with the [https://en.wikipedia.org/wiki/General-purpose_input/output GPIO] on the right side):<br /> ** GND to the third pin down on the right hand side<br /> ** 5V to the second pin down on the right<br /> ** SCL to the third pin down on the left hand side<br /> ** SDA to the second pin down on the left hand side<br /> ** Click [https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide here] for more detailed information of the assembly<br /> * Connect your keyboard and mouse to the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Connect the [[https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface to the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3] (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] and connect it with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ----<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate [https://en.wikipedia.org/wiki/Secure_Shell SSH] keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the [https://en.wikipedia.org/wiki/Ext4 ext4] partition to use the rest of the unused space<br /> <br /> ----<br /> <br /> * Install [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] (either wired or wireless)<br /> * Identify the name of [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface (wlan1 in my case):<br /> <br /> iwconfig<br /> <br /> * Set [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface to [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] of your target network (1 in my case)<br /> * Set your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] to the appropriate [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel]:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;[https://en.wikipedia.org/wiki/Service_set_(802.11_network)#Service_set_identifier_(SSID) SSID]&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;[https://en.wikipedia.org/wiki/List_of_WLAN_channels Channel]&quot; to the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA]'s name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;[https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/TCP-PProxy TCP Proxy]&quot;<br /> ** Select &quot;[https://github.com/LeonardoNve/sslstrip2 SSLStrip]+[https://github.com/LeonardoNve/dns2proxy DNS2Proxy]&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B]<br /> * Micro SD Card 8GB + adapter<br /> * [https://www.raspberrypi.org/products/raspberry-pi-touch-display/ Raspberry Pi 7&quot; Touchscreen Display]<br /> * Micro USB charger 2.5 A for Raspberry Pi<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1284 2019-03-11T15:33:13Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Create a [https://en.wikipedia.org/wiki/Rogue_access_point rogue Wi-Fi access point] on [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi].<br /> <br /> == Requirements ==<br /> <br /> * Operating system: [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3]<br /> ** Version 2019.1<br /> * Packages: Dependencies [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== Touchscreen ====<br /> <br /> * Connect the small ribbon cable to the connector on the top of the board<br /> * Fix the board to the screen with the four spacers<br /> * Connect the white ribbon cable to the connector on the board<br /> * Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> * Mount your [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] onto the four spacers<br /> * Connect the white ribbon to the Display Connector of the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Connect the jumper wires (assuming your [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] is in front of you with the GPIO on the right side):<br /> ** GND to the third pin down on the right hand side<br /> ** 5V to the second pin down on the right<br /> ** SCL to the third pin down on the left hand side<br /> ** SDA to the second pin down on the left hand side<br /> * Connect your keyboard and mouse to the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Connect the [[https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] ALFA] wireless interface to the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi]<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install [https://www.offensive-security.com/kali-linux-arm-images/ Kali Linux RaspberryPi 2 and 3] (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] and connect it with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ----<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate [https://en.wikipedia.org/wiki/Secure_Shell SSH] keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the [https://en.wikipedia.org/wiki/Ext4 ext4] partition to use the rest of the unused space<br /> <br /> ----<br /> <br /> * Install [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] (either wired or wireless)<br /> * Identify the name of [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface (wlan1 in my case):<br /> <br /> iwconfig<br /> <br /> * Set [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] wireless interface to [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] of your target network (1 in my case)<br /> * Set your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA] to the appropriate [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel]:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start [https://github.com/P0cL4bs/WiFi-Pumpkin WiFi-Pumpkin]:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;[https://en.wikipedia.org/wiki/Service_set_(802.11_network)#Service_set_identifier_(SSID) SSID]&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;[https://en.wikipedia.org/wiki/List_of_WLAN_channels Channel]&quot; to the [https://en.wikipedia.org/wiki/List_of_WLAN_channels channel] you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA]'s name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;[https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/TCP-PProxy TCP Proxy]&quot;<br /> ** Select &quot;[https://github.com/LeonardoNve/sslstrip2 SSLStrip]+[https://github.com/LeonardoNve/dns2proxy DNS2Proxy]&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B]<br /> * Micro SD Card 8GB + adapter<br /> * [https://www.raspberrypi.org/products/raspberry-pi-touch-display/ Raspberry Pi 7&quot; Touchscreen Display]<br /> * Micro USB charger 2.5 A for Raspberry Pi<br /> * [https://www.alfa.com.tw/WiFi%20USB%20Antenna.html ALFA NETWORK AWUS036ACH]<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1283 2019-03-11T15:04:24Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Create a rogue Wi-Fi access point on Raspberry Pi.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Kali Linux RaspberryPi 2 and 3<br /> ** Version 2019.1<br /> * Packages: Dependencies WiFi-Pumpkin<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== Touchscreen ====<br /> <br /> * Connect the small ribbon cable to the connector on the top of the board<br /> * Fix the board to the screen with the four spacers<br /> * Connect the white ribbon cable to the connector on the board<br /> * Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> * Mount your Raspberry Pi onto the four spacers<br /> * Connect the white ribbon to the Display Connector of the Raspberry Pi<br /> * Connect the jumper wires (assuming your Pi is in front of you with the GPIO on the right side):<br /> ** GND to the third pin down on the right hand side<br /> ** 5V to the second pin down on the right<br /> ** SCL to the third pin down on the left hand side<br /> ** SDA to the second pin down on the left hand side<br /> * Connect your keyboard and mouse to the Pi<br /> * Connect the ALFA wireless interface to the Pi<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install Kali Linux RaspberryPi 2 and 3 (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the Pi and connect the Pi with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ----<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate SSH keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the ext4 partition to use the rest of the unused space<br /> <br /> ----<br /> <br /> * Install WiFi-Pumpkin:<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the Pi (either wired or wireless)<br /> * Identify the name of ALFA wireless interface (wlan1 in my case): # iwconfig<br /> * Put ALFA wireless interface in monitor mode:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the channel of your target network (1 in my case)<br /> * Put your ALFA in the appropriate channel:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start WiFi-Pumpkin:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;SSID&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;Channel&quot; to the channel you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your ALFA's name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;TCP Proxy&quot;<br /> ** Select &quot;SSLStrip+DNS2Proxy&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B<br /> * Micro SD Card 8GB + adapter<br /> * Raspberry Pi 7&quot; Touchscreen Display<br /> * Micro USB charger 2.5 A for Raspberry Pi<br /> * ALFA NETWORK AWUS036ACH<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1282 2019-03-11T15:01:19Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> Create a rogue Wi-Fi access point on Raspberry Pi.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Kali Linux RaspberryPi 2 and 3<br /> ** Version 2019.1<br /> * Packages: Dependencies WiFi-Pumpkin<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== Touchscreen ====<br /> <br /> * Connect the small ribbon cable to the connector on the top of the board<br /> * Fix the board to the screen with the four spacers<br /> * Connect the white ribbon cable to the connector on the board<br /> * Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> * Mount your Raspberry Pi onto the four spacers<br /> * Connect the white ribbon to the Display Connector of the Raspberry Pi<br /> * Connect the jumper wires (assuming your Pi is in front of you with the GPIO on the right side):<br /> ** GND to the third pin down on the right hand side<br /> ** 5V to the second pin down on the right<br /> ** SCL to the third pin down on the left hand side<br /> ** SDA to the second pin down on the left hand side<br /> * Connect your keyboard and mouse to the Pi<br /> * Connect the ALFA wireless interface to the Pi<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install Kali Linux RaspberryPi 2 and 3 (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the Pi and connect the Pi with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate SSH keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the ext4 partition to use the rest of the unused space<br /> * Install WiFi-Pumpkin<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the Pi (either wired or wireless)<br /> * Identify the name of ALFA wireless interface (wlan1 in my case): # iwconfig<br /> * Put ALFA wireless interface in monitor mode:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the channel of your target network (1 in my case)<br /> * Put your ALFA in the appropriate channel:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start WiFi-Pumpkin:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;SSID&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;Channel&quot; to the channel you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your ALFA's name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;TCP Proxy&quot;<br /> ** Select &quot;SSLStrip+DNS2Proxy&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B<br /> * Micro SD Card 8GB + adapter<br /> * Raspberry Pi 7&quot; Touchscreen Display<br /> * Micro USB charger 2.5 A for Raspberry Pi<br /> * ALFA NETWORK AWUS036ACH<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=WiFi-Pumpkin&diff=1281 2019-03-11T14:53:51Z

<p>Lstrobl: Created page with &quot;== Summary == Create a rogue Wi-Fi access point on Raspberry Pi. == Requirements == * Operating system: Kali Linux RaspberryPi 2 and 3 ** Version 2019.1 * Packages: Depend...&quot;</p> <hr /> <div>== Summary == <br /> <br /> Create a rogue Wi-Fi access point on Raspberry Pi.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Kali Linux RaspberryPi 2 and 3<br /> ** Version 2019.1<br /> * Packages: Dependencies WiFi-Pumpkin<br /> <br /> In order to complete these steps, you must have followed [[Some Other Documentation]] before.<br /> <br /> == Description ==<br /> <br /> === Setup ===<br /> <br /> ==== Touchscreen ====<br /> <br /> ** Connect the small ribbon cable to the connector on the top of the board<br /> ** Fix the board to the screen with the four spacers<br /> ** Connect the white ribbon cable to the connector on the board<br /> ** Connect the four jumper wires to the 5V, GND, SCL and SDA pins on the display driver board<br /> ** Mount your Raspberry Pi onto the four spacers<br /> ** Connect the white ribbon to the Display Connector of the Raspberry Pi<br /> ** Connect the jumper wires (assuming your Pi is in front of you with the GPIO on the right side):<br /> *** GND to the third pin down on the right hand side<br /> *** 5V to the second pin down on the right<br /> *** SCL to the third pin down on the left hand side<br /> *** SDA to the second pin down on the left hand side<br /> * Connect your keyboard and mouse to the Pi<br /> * Connect the ALFA wireless interface to the Pi<br /> * Do NOT power on yet<br /> <br /> === Installation ===<br /> <br /> * Download, unzip and install Kali Linux RaspberryPi 2 and 3 (version 2019.1) on your SD card with the PC<br /> * Insert the SD card into the Pi and connect the Pi with the power source<br /> * Login with username &quot;root&quot; and password &quot;toor&quot;<br /> * Open a terminal and update:<br /> <br /> apt-get update<br /> apt-get upgrade<br /> <br /> ==== Optional ====<br /> <br /> * Change the password:<br /> <br /> passwd<br /> <br /> * Regenerate SSH keys:<br /> <br /> dpkg-reconfigure openssh-server<br /> <br /> * Expand the image to use all SD card space:<br /> <br /> apt-get install gparted<br /> <br /> * Launch the tool and resize the ext4 partition to use the rest of the unused space<br /> * Install WiFi-Pumpkin<br /> <br /> git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git<br /> <br /> cd WiFi-Pumpkin<br /> <br /> chmod +x installer.sh<br /> <br /> sudo ./installer.sh --install<br /> <br /> * Install dependencies:<br /> <br /> pip install -r requirements.txt<br /> <br /> == Usage ==<br /> <br /> * Connect to the Internet with the internal interface of the Pi (either wired or wireless)<br /> * Identify the name of ALFA wireless interface (wlan1 in my case): # iwconfig<br /> * Put ALFA wireless interface in monitor mode:<br /> <br /> ifconfig wlan1 down<br /> <br /> iwconfig wlan1 mode monitor<br /> <br /> ifconfig wlan1 up<br /> <br /> * Start monitoring the networks:<br /> <br /> airodump-ng wlan1<br /> <br /> * Check the channel of your target network (1 in my case)<br /> * Put your ALFA in the appropriate channel:<br /> <br /> iwconfig wlan1 channel 1<br /> <br /> * Check the frequency:<br /> <br /> iwlist channel<br /> <br /> iwconfig wlan1<br /> <br /> * Start WiFi-Pumpkin:<br /> <br /> wifi-pumpkin<br /> <br /> * A GUI opens<br /> * Go to &quot;Settings&quot;:<br /> ** Change &quot;SSID&quot; to the same name as your target network (OpenHotSpot in my case)<br /> ** Change &quot;Channel&quot; to the channel you discovered before (1 in my case)<br /> ** Change &quot;Network Adapter&quot; to your ALFA's name (wlan1 in my case)<br /> ** My target network does not have any security, so I leave &quot;Wireless Security&quot; unchecked<br /> * Go to &quot;Plugins&quot;:<br /> ** Check &quot;Enable Proxy Server&quot;<br /> ** Check &quot;TCP Proxy&quot;<br /> ** Select &quot;SSLStrip+DNS2Proxy&quot;<br /> * Hit start and watch the clients connect to your rogue AP!!<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B<br /> * Micro SD Card 8GB + adapter<br /> * Raspberry Pi 7&quot; Touchscreen Display<br /> * Micro USB charger 2.5 A for Raspberry Pi<br /> * ALFA NETWORK AWUS036ACH<br /> * external mouse + keyboard<br /> * PC<br /> <br /> == References ==<br /> <br /> * https://lifehacker.com/how-to-build-a-portable-hacking-station-with-a-raspberr-1739297918<br /> * https://www.offensive-security.com/kali-linux-arm-images/<br /> * https://thepihut.com/blogs/raspberry-pi-tutorials/45295044-raspberry-pi-7-touch-screen-assembly-guide<br /> * http://pi4j.com/pins/model-3b-rev1.html<br /> * https://www.jamesachambers.com/2017/06/kali-linux-2017-1-raspberry-pi-3-official-raspberry-7-touchscreen-plug-and-play/<br /> * https://github.com/P0cL4bs/WiFi-Pumpkin/wiki/Installation<br /> * https://latesthackingnews.com/2018/09/13/wifi-pumpkin-wifi-security-audit-framework/<br /> * http://www.conzu.de/en/man-in-the-middle-pumpkin-pi-wifi-pumpkin/<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=File:RadioHackingI.pdf&diff=1267 2019-03-07T09:39:43Z

<p>Lstrobl: </p> <hr /> <div></div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=Radio_Hacking_I&diff=1266 2019-03-07T09:38:51Z

<p>Lstrobl: Created page with &quot;== Summary == In this bachelor&#039;s thesis I will give an introduction to electromagnetic waves, Software Defined Radios and signals. == Authors == * Luca Strobl == Results...&quot;</p> <hr /> <div>== Summary == <br /> <br /> In this bachelor's thesis I will give an introduction to electromagnetic waves, Software Defined Radios and signals.<br /> <br /> == Authors ==<br /> <br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * A bachelor's thesis with the following content:<br /> ** Elektromagnetische Wellen<br /> *** Elektrisches Feld<br /> *** Magnetisches Feld<br /> *** Elektrischer Schwingkreis<br /> **** Geschlossener Schwingkreis<br /> **** Resonanzfrequenz und Resonanzwiderstand<br /> *** Ausbreitung elektromagnetischer Wellen im Raum<br /> **** Längstwellen (&lt;30 kHz)<br /> **** Langwellen (30 kHz - 300 kHz)<br /> **** Mittelwellen (300 kHz - 3 MHz)<br /> **** Kurzwellen (3 MHz - 30 MHz)<br /> **** Ultrakurzwellen (30 MHz - 300 MHz)<br /> **** UHF-Bereich und Mikrowellen (300 MHz - 30 GHz)<br /> ** Software Defined Radio<br /> *** Field Programmable Gate Array (FPGA)<br /> *** Dezibel<br /> **** Absoluter Pegel<br /> *** Elektrische Filter<br /> *** Oszillatoren und Signalgeneratoren<br /> **** Grundschaltungen von Oszillatoren<br /> *** Antennen und Antennengewinn<br /> *** Elektronisches Rauschen<br /> ** Signale<br /> *** Signalformen<br /> *** Modulation und Demodulation analoger Signale<br /> *** Digitalisierung analoger Signale<br /> <br /> You can download the thesis [[:File:RadioHackingI.pdf|here]].<br /> <br /> == Courses ==<br /> <br /> * [[Bachelorarbeit 1]] (2018-2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1265 2019-03-07T09:22:51Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] with a [https://www.dresden-elektronik.de/raspbee/ Raspbee module] and a [https://www2.meethue.com/de-at/p/hue-white-einzellampe--e27/8718696449578 Philips Hue light bulb] was sniffed with the [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick]. The Transport Key was obtained and therefore the on/off commands sent from the [https://en.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] to the light bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** [https://www.sdcard.org/downloads/formatter_4/ SD Card Formatter 5.0 for SD/SDHC/SDXC]<br /> *** [https://sourceforge.net/projects/win32diskimager/ Win32 Disk Imager]<br /> * Operating system of attacking host: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> ** Version 2018.2<br /> * Packages: [https://github.com/riverloopsec/killerbee KillerBee]<br /> * Operating system of Raspberry Pi: [https://www.dresden-elektronik.de/funktechnik/solutions/wireless-light-control/raspbee-gw-sd-card-image/?L=1 RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)]<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[:File:ZigBeeSniffing.pdf|documentation]] about the [https://en.wikipedia.org/wiki/Zigbee ZigBee protocol] and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B+]<br /> * SD card with at least 8 gigabyte of memory<br /> * [https://www.dresden-elektronik.de/raspbee/ Raspbee module]<br /> * [https://www2.meethue.com/de-at/p/hue-white-einzellampe--e27/8718696449578 Philips Hue light bulb]<br /> * [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick]<br /> * [https://www.microchip.com/Developmenttools/ProductDetails/ATAVRDRAGON AVR Dragon programming board]<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * [https://www.kali.org/downloads/12/ Kali Linux] host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1264 2019-03-07T09:22:44Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a [https://en.wikipedia.org/wiki/Zigbee ZigBee] network as described in [[ZigBee Sniffing]] the next step is to conduct a [https://en.wikipedia.org/wiki/Replay_attack replay attack] by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> ** Version 2018.2<br /> * Packages: [https://github.com/riverloopsec/killerbee KillerBee]<br /> * Operating system of Raspberry Pi: [https://www.dresden-elektronik.de/funktechnik/solutions/wireless-light-control/raspbee-gw-sd-card-image/?L=1 RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)]<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * &lt;code&gt;zbreplay&lt;/code&gt; does not work due to counter queries<br /> * [https://en.wikipedia.org/wiki/Python_(programming_language) Python] script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the [https://en.wikipedia.org/wiki/Frame_check_sequence FCS] and [https://de.wikipedia.org/wiki/Message_Integrity_Check MIC] are wrong<br /> ** Packet is not constructed<br /> * [[:File:ZigBeeReplay.pdf|Documentation]] of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick].<br /> The solution would be a [https://en.wikipedia.org/wiki/Software-defined_radio Software Defined Radio (SDR)].<br /> The drivers of scapy were only written for the [https://www.ettus.com/ Ettus USRP] but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B+]<br /> * SD card with at least 8 gigabyte of memory<br /> * [https://www.dresden-elektronik.de/raspbee/ Raspbee module]<br /> * [https://www2.meethue.com/de-at/p/hue-white-einzellampe--e27/8718696449578 Philips Hue light bulb]<br /> * [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick]<br /> * [https://www.kali.org/downloads/12/ Kali Linux] host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1263 2019-03-07T09:21:57Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a [https://en.wikipedia.org/wiki/Zigbee ZigBee] network as described in [[ZigBee Sniffing]] the next step is to conduct a [https://en.wikipedia.org/wiki/Replay_attack replay attack] by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> ** Version 2018.2<br /> * Packages: [https://github.com/riverloopsec/killerbee KillerBee]<br /> * Operating system of Raspberry Pi: [https://www.dresden-elektronik.de/funktechnik/solutions/wireless-light-control/raspbee-gw-sd-card-image/?L=1 RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)]<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * &lt;code&gt;zbreplay&lt;/code&gt; does not work due to counter queries<br /> * [https://en.wikipedia.org/wiki/Python_(programming_language) Python] script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the [https://en.wikipedia.org/wiki/Frame_check_sequence FCS] and [https://de.wikipedia.org/wiki/Message_Integrity_Check MIC] are wrong<br /> ** Packet is not constructed<br /> * [[:File:ZigBeeReplay.pdf|Documentation]] of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the [[https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick].<br /> The solution would be a [https://en.wikipedia.org/wiki/Software-defined_radio Software Defined Radio (SDR)].<br /> The drivers of scapy were only written for the [https://www.ettus.com/ Ettus USRP] but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B+]<br /> * SD card with at least 8 gigabyte of memory<br /> * [https://www.dresden-elektronik.de/raspbee/ Raspbee module]<br /> * [https://www2.meethue.com/de-at/p/hue-white-einzellampe--e27/8718696449578 Philips Hue light bulb]<br /> * [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick]<br /> * [https://www.kali.org/downloads/12/ Kali Linux] host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1262 2019-03-07T09:09:38Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a [https://de.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] with a [https://www.dresden-elektronik.de/raspbee/ Raspbee module] and a [https://www2.meethue.com/de-at/p/hue-white-einzellampe--e27/8718696449578 Philips Hue light bulb] was sniffed with the [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick]. The Transport Key was obtained and therefore the on/off commands sent from the [https://de.wikipedia.org/wiki/Raspberry_Pi Raspberry Pi] to the light bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** [https://www.sdcard.org/downloads/formatter_4/ SD Card Formatter 5.0 for SD/SDHC/SDXC]<br /> *** [https://sourceforge.net/projects/win32diskimager/ Win32 Disk Imager]<br /> * Operating system of attacking host: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]<br /> ** Version 2018.2<br /> * Packages: [https://github.com/riverloopsec/killerbee KillerBee]<br /> * Operating system of Raspberry Pi: [https://www.dresden-elektronik.de/funktechnik/solutions/wireless-light-control/raspbee-gw-sd-card-image/?L=1 RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)]<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[:File:ZigBeeSniffing.pdf|documentation]] about the [https://de.wikipedia.org/wiki/ZigBee ZigBee protocol] and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B+]<br /> * SD card with at least 8 gigabyte of memory<br /> * [https://www.dresden-elektronik.de/raspbee/ Raspbee module]<br /> * [https://www2.meethue.com/de-at/p/hue-white-einzellampe--e27/8718696449578 Philips Hue light bulb]<br /> * [https://www.microchip.com/developmenttools/ProductDetails/ATAVRRZUSBSTICK Atmel RZ Raven USB stick]<br /> * [https://www.microchip.com/Developmenttools/ProductDetails/ATAVRDRAGON AVR Dragon programming board]<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1261 2019-03-07T08:55:10Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[:File:ZigBeeSniffing.pdf|documentation]] about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * [https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/ Raspberry Pi 3 Model B+]<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1260 2019-03-07T08:52:09Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a ZigBee network as described in [[ZigBee Sniffing]] the next step is to conduct a replay attack by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * &lt;code&gt;zbreplay&lt;/code&gt; does not work due to counter queries<br /> * Python script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the FCS and MIC are wrong<br /> ** Packet is not constructed<br /> * [[:File:ZigBeeReplay.pdf|Documentation]] of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the Atmel RZ Raven USB stick.<br /> The solution would be a Software Defined Radio (SDR).<br /> The drivers of scapy were only written for the Ettus USRP but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * Kali Linux host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=File:ZigBeeReplay.pdf&diff=1259 2019-03-07T08:50:55Z

<p>Lstrobl: </p> <hr /> <div></div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1258 2019-03-07T08:49:59Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[:File:ZigBeeSniffing.pdf|documentation]] about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1257 2019-03-07T08:49:22Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[File:ZigBeeSniffing.pdf|documentation]] about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1256 2019-03-07T08:48:18Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[File:ZigBeeSniffing.pdf]] about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1255 2019-03-07T08:47:56Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[Media:ZigBeeSniffing.pdf]] about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1254 2019-03-07T08:46:50Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed [[documentation:ZigBeeSniffing.pdf]] about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=File:ZigBeeSniffing.pdf&diff=1253 2019-03-07T08:45:59Z

<p>Lstrobl: </p> <hr /> <div></div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1252 2019-03-07T08:32:32Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a ZigBee network as described in [[ZigBee Sniffing]] the next step is to conduct a replay attack by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * &lt;code&gt;zbreplay&lt;/code&gt; does not work due to counter queries<br /> * Python script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the FCS and MIC are wrong<br /> ** Packet is not constructed<br /> * Documentation of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the Atmel RZ Raven USB stick.<br /> The solution would be a Software Defined Radio (SDR).<br /> The drivers of scapy were only written for the Ettus USRP but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * Kali Linux host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1251 2019-03-07T08:31:38Z

<p>Lstrobl: </p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a ZigBee network as described in [[ZigBee Sniffing]] the next step is to conduct a replay attack by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * &lt;zbreplay&gt; does not work due to counter queries<br /> * Python script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the FCS and MIC are wrong<br /> ** Packet is not constructed<br /> * Documentation of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the Atmel RZ Raven USB stick.<br /> The solution would be a Software Defined Radio (SDR).<br /> The drivers of scapy were only written for the Ettus USRP but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * Kali Linux host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Replay&diff=1250 2019-03-07T08:28:59Z

<p>Lstrobl: Created page with &quot;== Summary == After successfully sniffing the Network Key of a ZigBee network as described in ZigBee Sniffing the next step is to conduct a replay attack by resending th...&quot;</p> <hr /> <div>== Summary == <br /> <br /> After successfully sniffing the Network Key of a ZigBee network as described in [[ZigBee Sniffing]] the next step is to conduct a replay attack by resending the decrypted on/off commands with adjusted counters.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> <br /> == Results ==<br /> <br /> * zbreplay does not work due to counter queries<br /> * Python script to log the latest counters and create a packet with updated counters<br /> ** Data is misinterpreted and therefore the FCS and MIC are wrong<br /> ** Packet is not constructed<br /> * Documentation of the conducted project and source code of the python script<br /> <br /> The authors suppose that the misinterpretation of data results from the limited hardware capacities of the Atmel RZ Raven USB stick.<br /> The solution would be a Software Defined Radio (SDR).<br /> The drivers of scapy were only written for the Ettus USRP but the authors were not provided with this SDR.<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * Kali Linux host<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> == Courses ==<br /> <br /> * [[Vertiefendes Wahlfachprojekt]] (2019)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=Hacking_ZigBee&diff=1249 2019-03-07T08:07:27Z

<p>Lstrobl: Lstrobl moved page Hacking ZigBee to ZigBee Sniffing</p> <hr /> <div>#REDIRECT [[ZigBee Sniffing]]</div>

Lstrobl https://elvis.hcw.ac.at/wiki/index.php?title=ZigBee_Sniffing&diff=1248 2019-03-07T08:07:27Z

<p>Lstrobl: Lstrobl moved page Hacking ZigBee to ZigBee Sniffing</p> <hr /> <div>== Summary == <br /> <br /> In this project the communication between a Raspberry Pi with a Raspbee module and a Philips Hue light bulb was sniffed with the Atmel RZ Raven USB stick. The Transport Key was obtained and therefore the on/off commands sent from the Pi to the bulb could be decrypted.<br /> <br /> == Requirements ==<br /> <br /> * Operating system of host: Windows 10<br /> ** Software:<br /> *** SD Card Formatter 5.0 for SD/SDHC/SDXC<br /> *** Win32 Disk Imager<br /> * Operating system of attacking host: Kali Linux 64 Bit<br /> ** Version 2018.2<br /> * Packages: KillerBee<br /> * Operating system of Raspberry Pi: RaspBee Gateway SD card image Raspbian Jessi RaspBee (Stable)<br /> ** Version 01-2017<br /> <br /> == Authors ==<br /> <br /> * Daniel Tod<br /> * Luca Strobl<br /> * Dominik Mayer<br /> * Jean Castillo<br /> <br /> == Results ==<br /> <br /> * Sniffed Transport Key<br /> * Decrypted commands<br /> * Detailed documentation about the ZigBee protocol and the conducted project<br /> <br /> == Used Hardware ==<br /> <br /> * Raspberry Pi 3 Model B+<br /> * SD card with at least 8 gigabyte of memory<br /> * Raspbee module<br /> * Philips Hue light bulb<br /> * Atmel RZ Raven USB stick<br /> * AVR Dragon programming board<br /> * IDC cable<br /> * USB 2.0 cable a-male to b-male<br /> * Windows 10 host<br /> * Kali Linux host<br /> * USB stick with at least 4 gigabyte of memory<br /> * USB mouse and keyboard<br /> * external monitor<br /> * HDMI cable<br /> <br /> See the documentation for detailed information of the used hardware such as images and links.<br /> <br /> == Courses ==<br /> <br /> * [[Einführendes Wahlfachprojekt]] (2018)<br /> <br /> [[Category:Documentation]]</div>

Lstrobl