reinj attack
"Joseph Dell" <[email protected]> Fri, 9 May 2003 20:00:53 -0400
| Newsgroups | gmane.network.wireless.bsd.airtools |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============8019784350310144== content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C31687.39902499" This is a multi-part message in MIME format. ------_=_NextPart_001_01C31687.39902499 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I've been fighting with this on OpenBSD 3.3 and now OpenBSD 3.2... 3.3 never tried to inject traffic. OpenBSD 3.2 tries to inject traffic and even says "got possible tcp-ack packet, reinjecting to test..." but then it will send an attempt and say "no reply! Looking for a better packet..." Did you have any more luck with this? =20 Tried with 2 linksys cards... the WPC11 version 3.0 doesn't work at all (That's a prism3), where the version 2.5 (Prism2 card) at least _tries_ to inject... =20 Joseph ---------------------- I am trying to use h1kari's reinj tool to reinject SYN and ARP packets back on to a WEPd network. Has anyone played around with this tool? I am running Open BSD 3.2 with a SMC2632W v.1 (firmware 7.6). In h1kari's instructions, he says to put the WiFi card in injection mode by typing: $ sudo wicontrol wi0 -p 5 -f 7 (the -f 7 makes the card listen on Channel 7) =20 Once the card in injection mode, you are supposed to fire up the reinj tool which will scan for arp and or syn packets. =20 $ sudo reinj wi0 00:34:87:53:db:fa 1000000 2 =20 Once reinj finds an arp packet, the tool is supposed to display a message that the packet will be reinjected in the network. =20 My problem is that I don't believe that my SMC2632W is catching any network packets when it is in injection mode. I can run prism2dump and will not see any valid packets that I know I am sending. I only see the beacon packets. However, when I put the card into monitor mode (prism2ctl wi0 -m), I can then run prism2dump and see all the packets that I am supposed to. I am trying to figure out how to put the card into injection mode and still capture all packets. =20 =20 Any help would be much appreciated. Thank you in advance. =20 -Brad Martin nixhex at bellsouth.net -------------- next part -------------- ------_=_NextPart_001_01C31687.39902499 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.0.6249.1"> <TITLE>[BAT] reinj attack</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <P><FONT SIZE=3D2 FACE=3D"Arial">I've been fighting with this on OpenBSD = 3.3 and now OpenBSD 3.2… 3.3 never tried to inject = traffic. OpenBSD 3.2 tries to inject traffic and even says = "got possible tcp-ack packet, reinjecting to test…" but = then it will send an attempt and say "no reply! Looking for a = better packet…"</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">Did you have any more luck with = this? </FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">Tried with 2 linksys cards… the = WPC11 version 3.0 doesn't work at all (That's a prism3), where the = version 2.5 (Prism2 card) at least _tries_ to inject… = </FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">Joseph</FONT> </P> <BR> <P><FONT SIZE=3D2 FACE=3D"Arial">----------------------</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">I am trying to use h1kari's reinj tool = to reinject SYN and ARP packets</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">back on to a WEPd network. Has = anyone played around with this tool? I</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">am running Open BSD 3.2 with a = SMC2632W v.1 (firmware 7.6). In h1kari's</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">instructions, he says to put the WiFi = card in injection mode by typing:</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">$ sudo wicontrol wi0 -p 5 -f = 7 = (the -f 7 makes the card</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">listen on Channel 7)</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Once the card in injection mode, you = are supposed to fire up the reinj</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">tool which will scan for arp and or = syn packets.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">$ sudo reinj wi0 00:34:87:53:db:fa = 1000000 2</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Once reinj finds an arp packet, the = tool is supposed to display a</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">message that the packet will be = reinjected in the network.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">My problem is that I don't believe = that my SMC2632W is catching any</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">network packets when it is in = injection mode. I can run prism2dump and</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">will not see any valid packets that I = know I am sending. I only see the</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">beacon packets. However, when I = put the card into monitor mode</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">(prism2ctl wi0 -m), I can then run = prism2dump and see all the packets</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">that I am supposed to. I am = trying to figure out how to put the card</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">into injection mode and still capture = all packets. </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Any help would be much = appreciated. Thank you in advance.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial"> </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">-Brad Martin</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">nixhex at bellsouth.net</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">-------------- next part = --------------</FONT> </P> </BODY> </HTML> ------_=_NextPart_001_01C31687.39902499-- --===============8019784350310144== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Bat mailing list [email protected] http://lists.dachb0den.com/mailman/listinfo/bat --===============8019784350310144==--