RE: reinj attack
"Joseph Dell" <[email protected]> Fri, 9 May 2003 20:03:36 -0400
| Newsgroups | gmane.network.wireless.bsd.airtools |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============77807989463884719== content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C31687.9A971143" This is a multi-part message in MIME format. ------_=_NextPart_001_01C31687.9A971143 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable > I've been fighting with this on OpenBSD 3.3 and now OpenBSD 3.2... > 3.3 never tried to inject traffic. OpenBSD 3.2 tries to inject > traffic and even says "got possible tcp-ack packet, reinjecting to > test..." but then it will send an attempt and say "no reply! Looking > for a better packet..." >=20 > Did you have any more luck with this? =20 >=20 > Tried with 2 linksys cards... the WPC11 version 3.0 doesn't work at > all (That's a prism3), where the version 2.5 (Prism2 card) at least > _tries_ to inject... =20 >=20 > Joseph >=20 >=20 > ---------------------- > I am trying to use h1kari's reinj tool to reinject SYN and ARP packets > back on to a WEPd network. Has anyone played around with this tool? > I > am running Open BSD 3.2 with a SMC2632W v.1 (firmware 7.6). In > h1kari's > instructions, he says to put the WiFi card in injection mode by > typing: > $ sudo wicontrol wi0 -p 5 -f 7 (the -f 7 makes the > card > listen on Channel 7) > =20 > Once the card in injection mode, you are supposed to fire up the reinj > tool which will scan for arp and or syn packets. > =20 > $ sudo reinj wi0 00:34:87:53:db:fa 1000000 2 > =20 > Once reinj finds an arp packet, the tool is supposed to display a > message that the packet will be reinjected in the network. > =20 > My problem is that I don't believe that my SMC2632W is catching any > network packets when it is in injection mode. I can run prism2dump > and > will not see any valid packets that I know I am sending. I only see > the > beacon packets. However, when I put the card into monitor mode > (prism2ctl wi0 -m), I can then run prism2dump and see all the packets > that I am supposed to. I am trying to figure out how to put the card > into injection mode and still capture all packets. =20 > =20 > Any help would be much appreciated. Thank you in advance. > =20 > -Brad Martin > nixhex at bellsouth.net > -------------- next part -------------- ------_=_NextPart_001_01C31687.9A971143 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.0.6249.1"> <TITLE>RE: [BAT] reinj attack</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <BR> <BR> <P><FONT SIZE=3D2 FACE=3D"Arial">I've been fighting with this on OpenBSD = 3.3 and now OpenBSD 3.2… 3.3 never tried to inject = traffic. OpenBSD 3.2 tries to inject traffic and even says = "got possible tcp-ack packet, reinjecting to test…" but = then it will send an attempt and say "no reply! Looking for a = better packet…"</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">Did you have any more luck with = this? </FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">Tried with 2 linksys cards… the = WPC11 version 3.0 doesn't work at all (That's a prism3), where the = version 2.5 (Prism2 card) at least _tries_ to inject… = </FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">Joseph</FONT> </P> <BR> <P><FONT SIZE=3D2 FACE=3D"Arial">----------------------</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">I am trying to use h1kari's reinj tool = to reinject SYN and ARP packets</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">back on to a WEPd network. Has = anyone played around with this tool? I</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">am running Open BSD 3.2 with a = SMC2632W v.1 (firmware 7.6). In h1kari's</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">instructions, he says to put the WiFi = card in injection mode by typing:</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">$ sudo wicontrol wi0 -p 5 -f = 7 = (the -f 7 makes the card</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">listen on Channel 7)</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Once the card in injection mode, you = are supposed to fire up the reinj</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">tool which will scan for arp and or = syn packets.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">$ sudo reinj wi0 00:34:87:53:db:fa = 1000000 2</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Once reinj finds an arp packet, the = tool is supposed to display a</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">message that the packet will be = reinjected in the network.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">My problem is that I don't believe = that my SMC2632W is catching any</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">network packets when it is in = injection mode. I can run prism2dump and</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">will not see any valid packets that I = know I am sending. I only see the</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">beacon packets. However, when I = put the card into monitor mode</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">(prism2ctl wi0 -m), I can then run = prism2dump and see all the packets</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">that I am supposed to. I am = trying to figure out how to put the card</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">into injection mode and still capture = all packets. </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Any help would be much = appreciated. Thank you in advance.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">-Brad Martin</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">nixhex at bellsouth.net</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">-------------- next part = --------------</FONT> </P> </BODY> </HTML> ------_=_NextPart_001_01C31687.9A971143-- --===============77807989463884719== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Bat mailing list [email protected] http://lists.dachb0den.com/mailman/listinfo/bat --===============77807989463884719==--