Hacking Wireless Networks (2015)

Part V

Appendixes

27_597302_pt05.qxd 8/4/05 7:07 PM Page 326

In this part . . .

We feel that this book is just the start of your jour-

ney. If you want to hone your proficiency in ethical

hacking, then you’ll need to use this book as a launch

pad — and keep up with the field over the longer term.

By the time this book comes to press, for example, it’s

a good bet someone will have released the next big cracker tool. You’ll need to come up with a means of keeping

abreast of the latest technology and tools.

To this end, we thought you would benefit from some links to organizations that specialize in wireless standards and some references to wireless user groups (WUGs). Find a

group in your neighborhood and get involved. And, should you not know all the intricacies of wireless geek-speak, we have provided a list of acronyms and initialisms.

28_597302_appa.qxd 8/4/05 7:07 PM Page 327

Appendix A

Wireless Hacking Resources

In This Appendix

ᮣ Making contact with wireless organizations

ᮣ Finding local wireless user groups

ᮣ Shopping for wireless tools

Wireless networking is evolving extremely fast. To keep your company and yourself current, you will need to keep up to date on developing standards and tools. This book gets you started, but learning is a life-long experience. We have listed some organizations and tools to help.

Certifications

We covered a lot about wireless and ethical hacking in this book. You may want to find out how knowledgeable you now are. The best way to do that is to take a certification test. Following are two organizations that certify individuals on this material.

ߜ Certified Ethical Hacker: www.eccouncil.org/CEH.htm ߜ Certified Wireless Network Professional Program: www.cwnp.com General Resources

The Internet is a valuable resource. However, using it is like trying to get a sip of water from a fire hose. So you need to damper the flow of information. We have found that the following sites provide useful information on wireless on a recurring basis. They also have free subscription mailing lists.

ߜ SearchMobileComputing.com: www.searchmobilecomputing.com ߜ SearchNetworking.com: www.searchnetworking.com

ߜ SearchSecurity.com: www.searchsecurity.com

28_597302_appa.qxd 8/4/05 7:07 PM Page 328

328 Part V: Appendixes

Hacker Stuff

Sun Tzu in the “Art of War” writes that you must understand your enemy to defeat your enemy. Learning about your enemy is a good tactic. When you can put yourself in the mindset of your enemy then you can truly understand your enemy. There are many good “hacker” sites available to you. Following are several sites that will help you understand crackers.

ߜ 2600 — The Hacker Quarterly magazine: www.2600.com ߜ Computer Underground Digest: www.soci.niu.edu/~cudigest ߜ Hacker t-shirts, equipment, and other trinkets: www.thinkgeek.com ߜ Honeypots: Tracking Hackers: www.tracking-hackers.com ߜ The Online Hacker Jargon File: www.jargon.8hz.com ߜ PHRACK: www.phrack.org

Wireless Organizations

There are two wireless organizations that you need to acquaint yourself with.

These are the IEEE and the Wi-Fi Alliance. The former concerns itself with setting standards for wireless, and the latter certifies that WLAN equipment meets the standards set by the former.

Institute of Electrical and Electronics

Engineers (IEEE): www.ieee.org

In this book we mention the pertinent wireless standards: 802.11, 802.11a, 802.11b, 802.11g, and 802.11i. These standards are all the creations of the Institute of Electrical and Electronic Engineers (IEEE). The IEEE leads the way in developing open standards for Wireless Local Area Networks (Wireless LANs), Wireless Personal Area Networks (Wireless PANs), and Wireless Metropolitan Area Networks (Wireless MANs). You can compare and contrast the 802.11 wireless standards for “over the air” to the 802.3

Ethernet standards for “over the wire.”

28_597302_appa.qxd 8/4/05 7:07 PM Page 329

Appendix A: Wireless Hacking Resources

329

Wi-Fi Alliance (formerly WECA):

www.wifialliance.com

Formed in 1999, the Wi-Fi Alliance is a nonprofit association that certifies the interoperability of wireless Local Area Network products that are based on IEEE 802.11 specifications. The Wi-Fi Alliance has over 200 member companies from around the world — and has certified over 1,000 devices. All the equipment used in the making of this book (for example) was tested and certified by the Wi-Fi Alliance — and without animal testing!

Local Wireless Groups

Should you really want to get serious about wireless ethical hacking, you’ll need to immerse yourself in the culture. Hook up with other wireless aficiona-dos, who can turn you on to new tools and point you to useful whitepapers and other resources. Wireless grassroots organizations are springing up like crabgrass across the world. You can meet like-minded wireless buffs and do some networking — the social kind. Here is a sampling of wireless user groups:

ߜ Air-Stream, Adelaide, SA, AU: www.air-stream.org/tiki-custom_

home.php

ߜ AirShare, San Diego, CA, US: www.airshare.org/

ߜ Albany Wireless User Group, Albany, NY, US: http://community.

albanywifi.com/index.php

ߜ Austin Wireless, Austin, TX, US: www.austinwireless.net ߜ Barcelona Wireless, Barcelona, Cataluña, ES: http://barcelona wireless.net/

ߜ Bay Area Wireless Users Group (BAWUG), Bay Area, CA, US: www.

bawug.org

ߜ BC Wireless, Vancouver, Vancouver Island and Prince Rupert, BC, CA: http://bcwireless.net/

ߜ Capital Area Wireless Network, Northern Virginia, VA, US: www.

cawnet.org/

ߜ Consume, London, England, UK: www.consume.net/

28_597302_appa.qxd 8/4/05 7:07 PM Page 330

330 Part V: Appendixes

ߜ Corkwireless, Cork, Cork County, IE: www.corkwireless.com/

ߜ Georgia Wireless User Group, Atlanta, GA, US: www.gawug.com ߜ Green Bay Professional Packet Radio, Green Bay, WI, US: www.qsl.

net/n9zia/

ߜ Houston Wireless, Houston, TX, US: www.houstonwireless.org ߜ IrishWAN, IE: www.irishwan.org/

ߜ Longmount Community Wireless Project, Longmount, CO, US: http://

long-wire.net/

ߜ Madrid Wireless, Madrid, Madrid, ES: http://madridwireless.net/

ߜ Marin Unwired, Marin County, CA, US: www.digiville.com/

wifi-marin/index.htm

ߜ NoCatNet, Sonoma County, CA, US: http://nocat.net ߜ NYCWireless, New York City, NY, US: http://nycwireless.net ߜ NZ Wireless, Auckland, NZ: www.nzwireless.org/

ߜ Orange County California Wireless Users Group, Brea, CA, US: www.occalwug.org/

ߜ Personal Telco, Portland, OR, US: www.personaltelco.net ߜ Rooftops, Boston/Cambridge, MA, US: http://rooftops.media.

mit.edu/

ߜ Salt Lake Area Wireless Users Group (SLWUG), Salt Lake City, UT, US: www.saltlakewireless.net/

ߜ San Diego Wireless Users Group, San Diego, CA, US: www.sdwug.org ߜ Seattle Wireless, Seattle, WA, US: www.seattlewireless.net ߜ Southern California Wireless Users Group, Southern California, CA, US: www.socalwug.org

ߜ StockholmOpen.net, Stockholm, SE: www.stockholmopen.net/

index.php

ߜ The Toronto Wireless User Group (TorWUG), Toronto, ON, CA: www.torwug.org/

ߜ Tri-Valley Wireless Users Group, US: www.tvwug.org ߜ Xnet Wireless, Mornington, AU: www.x.net.au/

ߜ WiFi Ecademy, London, England, UK: www.wifi.ecademy.com/

ߜ Wireless Technology Forum, Atlanta, GA, US: www.wireless technologyforum.com

ߜ Wireless France, FR: www.wireless-fr.org/spip/

28_597302_appa.qxd 8/4/05 7:07 PM Page 331

Appendix A: Wireless Hacking Resources

331

If you can’t find your location from this list, then try the following sites to find a user group near you:

ߜ www.practicallynetworked.com/tools/wireless_articles_

community.htm

ߜ www.wirelessanarchy.com/#Community%20Groups

ߜ www.personaltelco.net/index.cgi/WirelessCommunities

Security Awareness and Training

You may find that getting management and staff to pay attention to information security is at best a difficult task. You are not alone. Fortunately the following companies can help you get the message across in your organization.

ߜ Greenidea, Inc. Visible Statement: www.greenidea.com ߜ The Security Awareness Company: www.thesecurityawareness company.com

ߜ Security Awareness, Inc. Awareness Resources: www.security awareness.com

ߜ U.S. Security Awareness: www.ussecurityawareness.org Wireless Tools

Throughout the book, we have described many tools — showing where to get them, classifying, and summarizing them. If you are just starting out, the tools listed here make a nice shopping list. If you are getting married, you can register at hackersrus.com. Ethical-hacking tools also make great anniversary gifts for those two-hacker households.

General tools

We have grouped tools into specific categories. But some of them defied categorization. But rather than lose these excellent tools you can use, we offer the following list:

ߜ BLADE Software IDS Informer: www.bladesoftware.net ߜ Foundstone SiteDigger Google query tool: www.foundstone.com/

resources/freetools.htm

28_597302_appa.qxd 8/4/05 7:07 PM Page 332

332 Part V: Appendixes

ߜ MAC-address-vendor lookup: http://coffer.com/mac_find ߜ SMAC MAC-address editor for Windows: www.klcconsulting.net/

smac/

ߜ WiGLE database: www.wigle.net/gps/gps/GPSDB/query/

ߜ WiFimaps: www.wifimaps.com

Vulnerability databases

You will need to understand the vulnerabilities associated with your particular hardware and software. During the planning process, you will use this information to determine the exact tests to perform. Following are some well-known vulnerability database sites.

ߜ US-CERT Vulnerability Notes Database: www.kb.cert.org/vuls ߜ NIST ICAT Metabase: http://icat.nist.gov/icat.cfm ߜ Common Vulnerabilities and Exposures: http://cve.mitre.org/cve Linux distributions

Since many wireless testing tools only run on UNIX, Linux or BSD, you will need to become familiar with one of these platforms. You can purchase a commercial product like SuSe or Red Hat Linux, but this is overkill for our purposes. So instead use one of the following freeware Linux distributions.

ߜ Auditor: http://new.remote-exploit.org/index.php/Auditor_

main

ߜ Cool Linux CD: http://sourceforge.net/project/showfiles.php?

group_id=55396&release_id=123430

ߜ DSL (Damn Small Linux): www.damnsmalllinux.org/

ߜ GNU/Debian Linux: www.debian.org/

ߜ KNOPPIX: www.knoppix.net/get.php

ߜ SLAX: http://slax.linux-live.org/

ߜ WarLinux: http://sourceforge.net/projects/warlinux/

28_597302_appa.qxd 8/4/05 7:07 PM Page 333

Appendix A: Wireless Hacking Resources

333

Software emulators

If you want to run more than one operating system at a time on the same hardware or want to paste from one operating system to another, then you will want to consider a software emulation product. Following are some of the better-known products.

ߜ Bochs: http://bochs.sourceforge.net/

ߜ Cygwin: http://cygwin.com/

ߜ DOSEMU: www.dosemu.org/

ߜ Microsoft Virtual PC: www.microsoft.com/mac/products/

virtualpc/virtualpc.aspx?pid=virtualpc

ߜ Plex86: http://savannah.nongnu.org/projects/plex86/

ߜ Vmware: www.vmware.com/

ߜ WINE: www.winehq.com/

ߜ Win4lin: www.netraverse.com/

RF prediction software

RF prediction software helps you simulate the radiation pattern of an access point without having to physically install one. So as a tester you use the same software to predict where you may find a signal. Following are three such software programs.

ߜ Airespace: www.airespace.com/products/AS_ACS_location_

tracking.php

ߜ Alcatel: www.ind.alcatel.com/products/index.cfm?cnt=

omnivista_acs_locationtrack

ߜ Radioplan: www.electronicstalk.com/news/rop/rop100.html RF monitoring

You can use software to monitor signal strength and bit error rate. Of course, tools like Kismet or NetStumbler give you signal strength, but they don’t do it as well as the following tools.

28_597302_appa.qxd 8/4/05 7:07 PM Page 334

334 Part V: Appendixes

ߜ aphunter: www.math.ucla.edu/~jimc/mathnet_d/download.html ߜ E-Wireless: www.bitshift.org/wireless.shtml

ߜ Gkrellm wireless plug-in: http://gkrellm.luon.net/gkrellm wireless.phtml

ߜ Gnome Wireless Applet: http://freshmeat.net/projects/

gwifiapplet/

ߜ Gtk-Womitor: www.zevv.nl/wmifinfo/

ߜ GWireless: http://gwifiapplet.sourceforge.net/

ߜ Kifi: http://kifi.staticmethod.net/

ߜ KOrinoco: http://korinoco.sourceforge.net/

ߜ KWaveControl: http://kwavecontrol.sourceforge.net/

ߜ KWiFiManager: http://kwifimanager.sourceforge.net/

ߜ Linux Wireless Extensions: http://pcmciacs.sourceforge.net/

ftp/contrib/

ߜ Mobydik.tk: www.cavone.com/services/mobydik_tk.aspx ߜ NetworkControl: www.arachnoid.com/NetworkControl/index.html ߜ NetworkManager: http://people.redhat.com/dcbw/Network Manager/

ߜ Qwireless: www.uv-ac.de/qwireless/

ߜ Wavemon: www.janmorgenstern.de/wavemon-current.tar.gz ߜ WaveSelect: www.kde-apps.org/content/show.php?content=19152

ߜ Wimon: http://imil.net/wimon/

ߜ Wmap: www.datenspuren.org/wmap

ߜ wmifinfo: www.zevv.nl/wmifinfo/

ߜ WMWave: www.schuermann.org/~dockapps/

ߜ WmWiFi: http://wmwifi.digitalssg.net/?sec=1

ߜ Wscan: www.handhelds.org/download/packages/wscan/

ߜ wvlanmon: http://file.wankota.org/program/linux/wavelan/

ߜ XNetworkStrength: http://gabriel.bigdam.net/home/

xnetstrength/

ߜ xosview: http://open-linux.de/index.html.en

28_597302_appa.qxd 8/4/05 7:07 PM Page 335

Appendix A: Wireless Hacking Resources

335

Antennae

You can spend a lot of money on an antenna. However, you need not spend all that money. You can build one yourself or acquire one for a pretty reasonable sum. Following are three sites to help you acquire an economical antenna for your ethical-hacking work.

ߜ Cantenna: www.cantenna.com

ߜ Hugh Pepper’s cantennas, pigtails, and supplies: http://home.

comast.net/~hughpep

ߜ Making a wireless antenna from a Pringles can: www.oreilly net.com/cs/weblog/view/wlg/448

You can find a very good reference page for antennae at www.wardrive.net/

general/antenna.

Wardriving

A very useful tool for your wireless ethical-hacking kit is a wardriving or network discovery program. Fortunately for you, there is an overabundance of tools as the following list shows.

ߜ Aerosol: www.sec33.com/sniph/aerosol.php

ߜ AirMagnet: www.airmagnet.com/products/index.htm ߜ AiroPeek: www.wildpackets.com/products/airopeek ߜ Airscanner: www.snapfiles.com/get/pocketpc/airscanner.html ߜ AP Scanner: www.macupdate.com/info.php/id/5726

ߜ AP Radar: http://apradar.sourceforge.net

ߜ Apsniff: www.monolith81.de/mirrors/index.php?path=apsniff/

ߜ BSD-Airtools: www.dachb0den.com/projects/bsd-air tools.html

ߜ dstumbler: www.dachb0den.com/projects/dstumbler.html ߜ gtk-scanner: http://sourceforge.net/projects/wavelan-tools ߜ gWireless: http://gwifiapplet.sourceforge.net/

ߜ iStumbler: http://istumbler.net/

ߜ KisMAC: www.binaervarianz.de/projekte/programmieren/

kismac/

28_597302_appa.qxd 8/4/05 7:07 PM Page 336

336 Part V: Appendixes

ߜ Kismet: www.kismetwireless.net

ߜ MacStumbler: www.macstumbler.com/

ߜ MiniStumbler: www.netstumbler.com/downloads/

ߜ Mognet: www.l0t3k.net/tools/Wireless/Mognet-1.16.tar.gz ߜ NetChaser: www.bitsnbolts.com

ߜ Network Stumbler: www.netstumbler.com/downloads ߜ perlskan: http://sourceforge.net/projects/wavelan-tools ߜ PocketWarrior: www.pocketwarrior.org/

ߜ pocketWinc: www.cirond.com/pocketwinc.php

ߜ Prismstumbler: http://prismstumbler.sourceforge.net ߜ Sniff-em: www.sniff-em.com

ߜ Sniffer Wireless: www.networkgeneral.com/

ߜ StumbVerter: www.michiganwireless.org/tools/Stumbverter/

ߜ THC-Scan: www.thc.org/releases.php?q=scan

ߜ THC-WarDrive: www.thc.org/releases.php?q=wardrive ߜ WarGlue: www.lostboxen.net/warglue/

ߜ WarKizniz: www.michiganwireless.org/tools/WarKizNiz/

ߜ Wellenreiter: www.wellenreiter.net/

ߜ Wi-Scan: www.michiganwireless.org/tools/wi-scan/

ߜ WiStumbler: www.gongon.com/persons/iseki/wistumbler/

index.html

ߜ Wireless Security Auditor: www.research.ibm.com/gsal/wsa/

ߜ Wlandump: www.guerrilla.net/gnet_linux_software.html Wireless IDS/IPS vendors

Wireless IDS/IPS products are necessary whether you support wireless networking or not in your organization. If you do support wireless, then you need a tool to protect your network. If you don’t have wireless, then you need a tool to ensure you don’t. Following are some IDS/IPS products.

ߜ AirDefense: www.airdefense.net

ߜ AirMagnet: www.airmagnet.com

28_597302_appa.qxd 8/4/05 7:07 PM Page 337

Appendix A: Wireless Hacking Resources

337

ߜ BlueSocket: www.bluesocket.com

ߜ ManageEngine: http://origin.manageengine.adventnet.com/

products/wifi-manager

ߜ NetMotion Wireless: www.netmotionwireless.com

ߜ Red-Detect: www.red-m.com/Products/Red-Detect

ߜ Senforce Wi-Fi Security: www.senforce.com/entwirelessecur.htm ߜ Vigilant Minds: www.vigilantminds.com

ߜ WiFi Manager: http://manageengine.adventnet.com/products/

wifi-manager/index.html

Wireless sniffers

You know that old saw: a picture is worth a thousand words. Well, the message from the saw applies to ethical hacking. Show someone his password that you captured because it wasn’t encrypted, and he gets it. Following are some packet capture tools.

ߜ AirMagnet: www.airmagnet.com/

ߜ AiroPeek: www.wildpackets.com/products/airopeek ߜ AirScanner Mobile Sniffer: http://airscanner.com/downloads/

sniffer/sniffer.html

ߜ AirTraf: http://airtraf.sourceforge.net/

ߜ Capsa: www.colasoft.com/products/capsa/index.php?id=75430g ߜ CENiffer: www.epiphan.com/products_ceniffer.html ߜ CommView for WiFi: www.tamos.com/products/commview/

ߜ ethereal: www.ethereal.com

ߜ Gulpit: www.crak.com/gulpit.htm

ߜ KisMAC: www.binaervarianz.de/projekte/programmieren/

kismac/

ߜ Kismet: www.kismetwireless.net/

ߜ LANfielder: www.wirelessvalley.com/

ߜ LinkFerret: www.baseband.com/

ߜ Mognet: www.l0t3k.net/tools/Wireless/Mognet-1.16.tar.gz 28_597302_appa.qxd 8/4/05 7:07 PM Page 338

338 Part V: Appendixes

ߜ ngrep: www.remoteassessment.com/?op=pub_archive_search& query=wireless

ߜ Observer: www.networkinstruments.com/

ߜ Packetyzer: www.networkchemistry.com/

ߜ Sniffer Netasyst: www.sniffer-netasyst.com/

ߜ Sniffer Wireless: www.networkgeneral.com/Products_details.

aspx?PrdId=20046178370181

WEP/WPA cracking

If we had a dollar for every time someone said she’s OK because she uses WEP or WPA, we would retire to a nice island in the Caribbean. The following tools should show them that they are not OK.

ߜ Aircrack: www.cr0.net:8040/code/network/

ߜ AirSnort: http://sourceforge.net/projects/airsnort/

ߜ Destumbler: http://sourceforge.net/projects/destumbler ߜ Dwepcrack: www.e.kth.se/~pvz/wifi/

ߜ jc-wepcracker: www.astalavista.com/?section=dir&cmd=file&id=

3316

ߜ Lucent Orinoco Registry Encryption/Decryption program: www.

cqure.net/tools.jsp?id=3

ߜ WepAttack: http://wepattack.sourceforge.net/

ߜ WEPcrack: http://sourceforge.net/projects/wepcrack/

ߜ WEPWedgie: http://sourceforge.net/projects/wepwedgie/

ߜ WepLab: http://weplab.sourceforge.net/

ߜ WinAirSnort: www.nwp.nevillon.org/attack.html

ߜ WPA Cracker: www.tinypeap.com/page8.html

Cracking passwords

There are tools that will grab packets, look for passwords, and provide them to you. Following are some of these very desirable tools.

ߜ Cain & Abel: www.oxid.it/cain.html

ߜ Dsniff: www.monkey.org/~dugsong/dsniff/

28_597302_appa.qxd 8/4/05 7:07 PM Page 339

Appendix A: Wireless Hacking Resources

339

ߜ Dsniff (Windows port): www.datanerds.net/~mike/dsniff.html ߜ Dsniff (MacOS X port): http://blafasel.org/~floh/ports/

dsniff-2.3.osx.tgz

Crack only passwords that you have the authority to crack. Cracking other passwords could end you up in jail.

Dictionary files and word lists

Most password crackers take a list of words or a dictionary and encrypt the words and then compare them to the password file. So you need to get different dictionaries or wordlists. Following are five good sources for dictionaries and wordlists.

ߜ CERIAS Dictionaries and Wordlists: ftp://ftp.cerias.purdue.edu/

pub/dict

ߜ Default vendor passwords: www.cirt.net/cgi-bin/passwd.pl ߜ Outpost9 Wordlists: www.outpost9.com/files/WordLists.html ߜ PacketStorm Wordlists: http://packetstormsecurity.nl/

Crackers/wordlists

ߜ University of Oxford Dictionaries and Wordlists: ftp://ftp.ox.ac.

uk/pub/wordlists

Gathering IP addresses and SSIDs

Many wireless security books recommend that you turn off SSID broadcasting as a control. However, you can use one of the following programs to get the SSID even when they do.

ߜ air-jack: http://sourceforge.net/projects/airjack/

ߜ Arping: www.habets.pp.se/synscan/programs.php?prog=arping ߜ essid_jack: http://sourceforge.net/projects/airjack/

ߜ pong: http://mobileaccess.de/wlan/index.html?go=

technik&sid=

ߜ SSIDsniff: www.bastard.net/~kos/wifi/ssidsniff-0.40.tar.gz 28_597302_appa.qxd 8/4/05 7:07 PM Page 340

340 Part V: Appendixes

LEAP crackers

EAP is touted as the solution to the WEP authentication problem. However EAP

has its own problems. Following are three tools you can use to crack LEAP.

ߜ anwrap: http://packetstormsecurity.nl/cisco/anwrap.pl ߜ asleap: http://asleap.sourceforge.net/

ߜ THC-LEAPcracker: http://thc.org/releases.php?s=4&q=&o=

Network mapping

After you connect to an access point, you will want to map the network.

You will want to know how many servers you can find and what operating system the server is running. Following are some tools to help you map your network.

ߜ Cheops: www.marko.net/cheops/

ߜ Cheops-ng: http://cheops-ng.sourceforge.net

ߜ SNMPUTIL.EXE: www.microsoft.com

ߜ Snmpwalk: www.trinux.org

ߜ Solarwinds Standard Edition Version: www.solarwinds.net ߜ WhatsUp Gold: www.ipswitch.com/products/network-management.html

Network scanners

Network scanners help you identify applications running on the systems on your network. You may find these applications on servers and network devices alike. Following are some that we have used.

ߜ fping: www.fping.com

ߜ GFI LANguard Network Security Scanner: www.gfi.com/lannetscan ߜ nessus: www.nessus.org

ߜ nmap: www.insecure.org/nmap

ߜ QualysGuard: www.qualys.com

ߜ SoftPerfect Network Scanner: www.softperfect.com/products/

networkscanner

ߜ SuperScan: www.foundstone.com/resources/proddesc/

superscan.htm

29_597302_appb.qxd 8/4/05 7:08 PM Page 341