reinj attack
"Brad Martin" <[email protected]> Sat, 3 May 2003 11:18:37 -0400
| Newsgroups | gmane.network.wireless.bsd.airtools |
|---|---|
| Message-ID | <000001c31187$48088180$0800a8c0@martin> |
This is a multi-part message in MIME format. --===============76288174762898175== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C31165.C0F6E180" This is a multi-part message in MIME format. ------=_NextPart_000_0001_01C31165.C0F6E180 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I am trying to use h1kari's reinj tool to reinject SYN and ARP packets back on to a WEPd network. Has anyone played around with this tool? I am running Open BSD 3.2 with a SMC2632W v.1 (firmware 7.6). In h1kari's instructions, he says to put the WiFi card in injection mode by typing: $ sudo wicontrol wi0 -p 5 -f 7 (the -f 7 makes the card listen on Channel 7) Once the card in injection mode, you are supposed to fire up the reinj tool which will scan for arp and or syn packets. $ sudo reinj wi0 00:34:87:53:db:fa 1000000 2 Once reinj finds an arp packet, the tool is supposed to display a message that the packet will be reinjected in the network. My problem is that I don't believe that my SMC2632W is catching any network packets when it is in injection mode. I can run prism2dump and will not see any valid packets that I know I am sending. I only see the beacon packets. However, when I put the card into monitor mode (prism2ctl wi0 -m), I can then run prism2dump and see all the packets that I am supposed to. I am trying to figure out how to put the card into injection mode and still capture all packets. Any help would be much appreciated. Thank you in advance. -Brad Martin [email protected] ------=_NextPart_000_0001_01C31165.C0F6E180 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <meta name=3DProgId content=3DWord.Document> <meta name=3DGenerator content=3D"Microsoft Word 10"> <meta name=3DOriginator content=3D"Microsoft Word 10"> <link rel=3DFile-List href=3D"cid:[email protected]"> <!--[if gte mso 9]><xml> <o:OfficeDocumentSettings> <o:DoNotRelyOnCSS/> </o:OfficeDocumentSettings> </xml><![endif]--><!--[if gte mso 9]><xml> <w:WordDocument> <w:SpellingState>Clean</w:SpellingState> <w:GrammarState>Clean</w:GrammarState> <w:DocumentKind>DocumentEmail</w:DocumentKind> <w:EnvelopeVis/> <w:Compatibility> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--> <style> <!-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-parent:""; margin:0in; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline; text-underline:single;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline; text-underline:single;} span.EmailStyle17 {mso-style-type:personal-compose; mso-style-noshow:yes; mso-ansi-font-size:10.0pt; mso-bidi-font-size:10.0pt; font-family:Arial; mso-ascii-font-family:Arial; mso-hansi-font-family:Arial; mso-bidi-font-family:Arial; color:windowtext;} span.SpellE {mso-style-name:""; mso-spl-e:yes;} span.GramE {mso-style-name:""; mso-gram-e:yes;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in; mso-header-margin:.5in; mso-footer-margin:.5in; mso-paper-source:0;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 10]> <style> /* Style Definitions */=20 table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman";} </style> <![endif]--> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple = style=3D'tab-interval:.5in'> <div class=3DSection1> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>I am trying to use h1kari’s <span = class=3DSpellE>reinj</span> tool to <span class=3DSpellE>reinject</span> SYN and ARP packets back on = to a <span class=3DSpellE>WEPd</span> network.<span = style=3D'mso-spacerun:yes'> </span>Has anyone played around with this tool?<span style=3D'mso-spacerun:yes'> </span>I am running Open BSD 3.2 with = a SMC2632W v.1 (firmware 7.6).<span style=3D'mso-spacerun:yes'> = </span>In h1kari’s instructions, he says to put the <span = class=3DSpellE>WiFi</span> card in injection mode by typing:<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>$ <span class=3DSpellE><span = class=3DGramE>sudo</span></span> <span class=3DSpellE>wicontrol</span> wi0 –p 5 –f 7<span = style=3D'mso-tab-count: 2'> &nbs= p; </span>(the –f 7 makes the card listen on Channel = 7)<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>Once the card in injection mode, you are supposed to = fire up the <span class=3DSpellE>reinj</span> tool which will scan for <span class=3DSpellE><span class=3DGramE>arp</span></span> and or <span = class=3DSpellE>syn</span> packets.<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>$ <span class=3DSpellE><span = class=3DGramE>sudo</span></span> <span class=3DSpellE>reinj</span> wi0 00:34:87:53:db:fa 1000000 = 2<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>Once <span class=3DSpellE>reinj</span> finds an <span class=3DSpellE><span class=3DGramE>arp</span></span> packet, the tool is = supposed to display a message that the packet will be <span = class=3DSpellE>reinjected</span> in the network.<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>My problem is that I don’t believe that my = SMC2632W is catching any network packets when it is in injection mode.<span style=3D'mso-spacerun:yes'> </span>I can run prism2dump and will = not see any valid packets that I know I am sending.<span style=3D'mso-spacerun:yes'> </span>I only see the beacon packets. = <span style=3D'mso-spacerun:yes'> </span>However, when I put the card = into monitor mode (prism2ctl wi0 –m), I can then run prism2dump and see all the packets that I am supposed to.<span style=3D'mso-spacerun:yes'> = </span>I am trying to figure out how to put the card into injection mode and still = capture all packets.<span style=3D'mso-spacerun:yes'> = </span><o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>Any help would be much appreciated.<span style=3D'mso-spacerun:yes'> </span>Thank you in = advance.<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>-Brad Martin<o:p></o:p></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>[email protected]<o:p></o:p></span></font></p> </div> </body> </html> ------=_NextPart_000_0001_01C31165.C0F6E180-- --===============76288174762898175== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Bat mailing list [email protected] http://lists.dachb0den.com/mailman/listinfo/bat --===============76288174762898175==--