Hak5 Signal Owl - Revision history

NKirnbauer: fixed link

2024-10-14T13:51:34Z

fixed link

← Older revision		Revision as of 13:51, 14 October 2024
Line 142:		Line 142:
	== Payload Development ==		== Payload Development ==

	Payloads for the Signal Owl are written in bash with [https://github.com/~~hak5darren~~/~~USB~~-~~Rubber-Ducky/wiki/Duckyscript~~ Ducky Script] and can be created with any standard text editor. All payloads should begin with an interpreter directive, like the shebang <code>#!/bin/bash</code> for bash payloads and payloads must be named either <code>payload.txt</code> or <code>payload.sh</code>. In order to create effective payloads, the Signal Owl comes with several preinstalled penetration testing tools. These are as follows: [https://nmap.org/ Nmap], [https://www.aircrack-ng.org/ Aircrack-ng], [https://github.com/aircrack-ng/mdk4 MDK4] and [https://www.kismetwireless.net/ Kismet].		Payloads for the Signal Owl are written in bash with [https://github.com/hak5/usbrubberducky-payloads Ducky Script] and can be created with any standard text editor. All payloads should begin with an interpreter directive, like the shebang <code>#!/bin/bash</code> for bash payloads and payloads must be named either <code>payload.txt</code> or <code>payload.sh</code>. In order to create effective payloads, the Signal Owl comes with several preinstalled penetration testing tools. These are as follows: [https://nmap.org/ Nmap], [https://www.aircrack-ng.org/ Aircrack-ng], [https://github.com/aircrack-ng/mdk4 MDK4] and [https://www.kismetwireless.net/ Kismet].

	'''Tools'''		'''Tools'''

JDittmoser: /* Use Cases */

2024-01-01T09:39:22Z

Use Cases

← Older revision		Revision as of 09:39, 1 January 2024
Line 280:		Line 280:

	If the SSH server is enabled, any SSH-enabled device can connect to the Signal Owl over the network, even though Attack Mode is enabled. The [[#Default Settings\|default settings]] of the device can be used again for the connection, if they have not been changed yet. However, the IP address in this case is the IP address of the Signal Owl in this network.		If the SSH server is enabled, any SSH-enabled device can connect to the Signal Owl over the network, even though Attack Mode is enabled. The [[#Default Settings\|default settings]] of the device can be used again for the connection, if they have not been changed yet. However, the IP address in this case is the IP address of the Signal Owl in this network.

			== Delayed Access Point Attack Mine ==

			For using this payload, an external WiFi adapter is required. By using Besside-ng, the Signal Owl attacks networks to obtain a hash that will be cracked afterward. If the network is secured by WEP it will be cracked instantly. Unlike the other payloads, this one isn't starting immediately or running endlessly. It has timers implemented which can be adapted to fit the use case. Also by setting <code>Target_BSSID</code> the target can be specified.
			<syntaxhighlight lang="bash">
			# Short fuse: starting in 5 minutes
			START_IN=300
			# Gather for 2 minutes
			GATHER_FOR=120
			# Leave blank if you want to attack all APs
			TARGET_BSSID=""
			</syntaxhighlight>
			This payload is very aggressive, so users must ensure a safe environment for using this attack without leaving legal ground.

	= Used Hardware =		= Used Hardware =

MMayer: /* WiFi Connect */

2023-01-08T22:08:58Z

WiFi Connect

← Older revision		Revision as of 22:08, 8 January 2023
Line 245:		Line 245:
	== WiFi Connect ==		== WiFi Connect ==

	With the WiFi Connect payload, which can be seen in the following ~~Listing~~, and the wificonnect.sh Payload extension, the Signal Owl can be connected to a nearby network. The SSID and password of the network to which the Signal Owl should connect must be specified in the code. Optionally, the SSH server of the device can be started by removing the hash sign in the code before the corresponding command.		With the WiFi Connect payload, which can be seen in the following listing, and the wificonnect.sh Payload extension, the Signal Owl can be connected to a nearby network. The SSID and password of the network to which the Signal Owl should connect must be specified in the code. Optionally, the SSH server of the device can be started by removing the hash sign in the code before the corresponding command.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">

MMayer: /* Directory Structure */

2023-01-08T15:32:18Z

Directory Structure

← Older revision		Revision as of 15:32, 8 January 2023
Line 117:		Line 117:
	#Now you can change the files and directories on the Signal Owl to view results, transfer payloads and extensions or to make further changes.		#Now you can change the files and directories on the Signal Owl to view results, transfer payloads and extensions or to make further changes.

	== Directory ~~structure~~ ==		== Directory Structure ==

	The following directory tree shows the directory structure of the Signal Owl.		The following directory tree shows the directory structure of the Signal Owl.

MMayer: /* Basic Bluetooth Scanner */

2023-01-08T15:08:32Z

Basic Bluetooth Scanner

← Older revision		Revision as of 15:08, 8 January 2023
Line 240:		Line 240:
	** 1 - Detected devices are interrogated		** 1 - Detected devices are interrogated
	** 0 - Detected devices are not interrogated		** 0 - Detected devices are not interrogated

			After a successful scan, all detected devices are listed with their names and MAC addresses in the file specified by <code>BT_OUTFILE</code>. If <code>INTERROGATE</code> has been set to 1, a <code>.info</code> file is generated that lists additional details about each scanned device.

	== WiFi Connect ==		== WiFi Connect ==

MMayer: /* Fake Beacon Flooding Attack */

2023-01-07T02:33:34Z

Fake Beacon Flooding Attack

← Older revision		Revision as of 02:33, 7 January 2023
Line 193:		Line 193:
	The results as seen from a victim running a Windows 10 system are pictured in the figure below.		The results as seen from a victim running a Windows 10 system are pictured in the figure below.

	[[File:FakeBeaconFloodingSignalOwl.png~~\|none~~\|Random SSIDs as seen from a victim Windows 10 client \|]][Eigene Darstellung]		[[File:FakeBeaconFloodingSignalOwl.png\|Random SSIDs as seen from a victim Windows 10 client]][Eigene Darstellung]

	== Open AP Nmap Scanner ==		== Open AP Nmap Scanner ==

MMayer: /* Open AP Nmap Scanner */

2023-01-07T02:32:53Z

Open AP Nmap Scanner

← Older revision		Revision as of 02:32, 7 January 2023
Line 215:		Line 215:
	The results of a scan with this payload can be seen in the figure below.		The results of a scan with this payload can be seen in the figure below.

	[[File:OpenAPNmapScannerResult.png\|750px]]		[[File:OpenAPNmapScannerResult.png\|750px]][Eigene Darstellung]

	== Basic Bluetooth Scanner ==		== Basic Bluetooth Scanner ==

MMayer: /* Open AP Nmap Scanner */

2023-01-07T02:32:07Z

Open AP Nmap Scanner

← Older revision		Revision as of 02:32, 7 January 2023
Line 212:		Line 212:
	** 1 - Debug information is saved.		** 1 - Debug information is saved.
	** 0 - Debug information is not saved.		** 0 - Debug information is not saved.

			The results of a scan with this payload can be seen in the figure below.

	[[File:OpenAPNmapScannerResult.png\|750px]]		[[File:OpenAPNmapScannerResult.png\|750px]]

MMayer: /* Open AP Nmap Scanner */

2023-01-07T02:31:47Z

Open AP Nmap Scanner

← Older revision		Revision as of 02:31, 7 January 2023
Line 213:		Line 213:
	** 0 - Debug information is not saved.		** 0 - Debug information is not saved.

	[[File:OpenAPNmapScannerResult.png]]		[[File:OpenAPNmapScannerResult.png\|750px]]

	== Basic Bluetooth Scanner ==		== Basic Bluetooth Scanner ==

MMayer: /* Open AP Nmap Scanner */

2023-01-07T02:27:01Z

Open AP Nmap Scanner

← Older revision		Revision as of 02:27, 7 January 2023
Line 212:		Line 212:
	** 1 - Debug information is saved.		** 1 - Debug information is saved.
	** 0 - Debug information is not saved.		** 0 - Debug information is not saved.

			[[File:OpenAPNmapScannerResult.png]]

	== Basic Bluetooth Scanner ==		== Basic Bluetooth Scanner ==