├── .gitignore ├── Dockerfile ├── EVILTWIN.md ├── LICENSE ├── MANIFEST.in ├── PMKID.md ├── README.md ├── TODO.md ├── Wifite.py ├── bin └── wifite ├── runtests.sh ├── setup.cfg ├── setup.py ├── tests ├── __init__.py ├── files │ ├── airmon.output │ ├── airodump-weird-ssids.csv │ ├── airodump.csv │ ├── contains_wps_network.cap │ ├── handshake_exists.cap │ ├── handshake_exists.cap.stripped.tshark │ ├── handshake_has_1234.cap │ ├── handshake_not_exists.cap │ ├── wep-crackable.ivs │ └── wep-uncrackable.ivs ├── test_Airmon.py ├── test_Airodump.py ├── test_Handshake.py └── test_Target.py ├── wifite ├── __init__.py ├── __main__.py ├── args.py ├── attack │ ├── __init__.py │ ├── all.py │ ├── pmkid.py │ ├── wep.py │ ├── wpa.py │ └── wps.py ├── config.py ├── model │ ├── __init__.py │ ├── attack.py │ ├── client.py │ ├── handshake.py │ ├── pmkid_result.py │ ├── result.py │ ├── target.py │ ├── wep_result.py │ ├── wpa_result.py │ └── wps_result.py ├── tools │ ├── __init__.py │ ├── aircrack.py │ ├── aireplay.py │ ├── airmon.py │ ├── airodump.py │ ├── bully.py │ ├── cowpatty.py │ ├── dependency.py │ ├── hashcat.py │ ├── ifconfig.py │ ├── iwconfig.py │ ├── john.py │ ├── macchanger.py │ ├── pyrit.py │ ├── reaver.py │ ├── tshark.py │ └── wash.py └── util │ ├── __init__.py │ ├── color.py │ ├── crack.py │ ├── input.py │ ├── process.py │ ├── scanner.py │ └── timer.py └── wordlist-top4800-probable.txt /.gitignore: -------------------------------------------------------------------------------- 1 | *.swp 2 | *.pyc 3 | py/hs/ 4 | hs/ 5 | *.bak 6 | .idea/ 7 | cracked.txt 8 | MANIFEST 9 | dist/ 10 | build/ 11 | files.txt 12 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM python:2.7.14-jessie 2 | 3 | ENV DEBIAN_FRONTEND noninteractive 4 | ENV HASHCAT_VERSION hashcat-3.6.0 5 | 6 | # Install requirements 7 | RUN echo "deb-src http://deb.debian.org/debian jessie main" >> /etc/apt/sources.list 8 | RUN apt-get update && apt-get upgrade -y 9 | RUN apt-get install ca-certificates gcc openssl make kmod nano wget p7zip build-essential libsqlite3-dev libpcap0.8-dev libpcap-dev sqlite3 pkg-config libnl-genl-3-dev libssl-dev net-tools iw ethtool usbutils pciutils wireless-tools git curl wget unzip macchanger pyrit tshark -y 10 | RUN apt-get build-dep aircrack-ng -y 11 | 12 | 13 | 14 | #Install Aircrack from Source 15 | RUN wget http://download.aircrack-ng.org/aircrack-ng-1.2-rc4.tar.gz 16 | RUN tar xzvf aircrack-ng-1.2-rc4.tar.gz 17 | WORKDIR /aircrack-ng-1.2-rc4/ 18 | RUN make 19 | RUN make install 20 | RUN airodump-ng-oui-update 21 | 22 | # Workdir / 23 | WORKDIR / 24 | 25 | # Install wps-pixie 26 | RUN git clone https://github.com/wiire/pixiewps 27 | WORKDIR /pixiewps/ 28 | RUN make 29 | RUN make install 30 | 31 | 32 | # Workdir / 33 | WORKDIR / 34 | 35 | 36 | # Install bully 37 | RUN git clone https://github.com/aanarchyy/bully 38 | WORKDIR /bully/src/ 39 | RUN make 40 | RUN make install 41 | 42 | 43 | 44 | # Workdir / 45 | WORKDIR / 46 | 47 | #Install and configure hashcat 48 | RUN mkdir hashcat && \ 49 | cd hashcat && \ 50 | wget https://hashcat.net/files_legacy/${HASHCAT_VERSION}.7z && \ 51 | 7zr e ${HASHCAT_VERSION}.7z 52 | 53 | 54 | #Add link for binary 55 | RUN ln -s /hashcat/hashcat-cli64.bin /usr/bin/hashcat 56 | 57 | 58 | # Install reaver 59 | RUN git clone https://github.com/gabrielrcouto/reaver-wps.git 60 | WORKDIR /reaver-wps/src/ 61 | RUN ./configure 62 | RUN make 63 | RUN make install 64 | 65 | # Workdir / 66 | WORKDIR / 67 | 68 | # Install cowpatty 69 | RUN git clone https://github.com/roobixx/cowpatty.git 70 | WORKDIR /cowpatty/ 71 | RUN make 72 | 73 | # Workdir / 74 | WORKDIR / 75 | 76 | # Install wifite 77 | RUN git clone https://github.com/derv82/wifite2.git 78 | WORKDIR /wifite2/ 79 | ENTRYPOINT ["/bin/bash"] 80 | 81 | 82 | -------------------------------------------------------------------------------- /EVILTWIN.md: -------------------------------------------------------------------------------- 1 | An idea from Sandman: Include "Evil Twin" attack in Wifite. 2 | 3 | This page tracks the requirements for such a feature. 4 | 5 | Evil Twin 6 | ========= 7 | 8 | [Fluxion](https://github.com/FluxionNetwork/fluxion) is a popular example of this attack. 9 | 10 | The attack requires multiple wireless cards: 11 | 12 | 1. Hosts the twin. 13 | 2. Deauthenticates clients. 14 | 15 | As clients connect to the Evil Twin, they are redirected to a fake router login page. 16 | 17 | Clients enter the password to the target AP. The Evil Twin then: 18 | 19 | 1. Captures the Wifi password, 20 | 2. Verifies Wifi password against the target AP, 21 | 3. If valid, all clients are deauthed from Evil Twin so they re-join the target AP. 22 | 4. Otherwise, tell the user the password is invalid and to "try again". GOTO step #1. 23 | 24 | Below are all of the requirements/components that Wifite would need for this feature. 25 | 26 | 27 | DHCP 28 | ==== 29 | We need to auto-assign IP addresses to clients as they connect (via DHCP?). 30 | 31 | 32 | DNS Redirects 33 | ============= 34 | All DNS requests need to redirect to the webserver: 35 | 36 | 1. So we clients are encouraged to login. 37 | 2. So we can intercept health-checks by Apple/Google 38 | 39 | 40 | Rogue AP, Server IP Address, etc 41 | ================================ 42 | Probably a few ways to do this in Linux; should use the most reliable & supported method. 43 | 44 | Mainly we need to: 45 | 46 | 1. Spin up the Webserver on some port (8000) 47 | 2. Start the Rogue AP 48 | 3. Assign localhost on port 8000 to some subnet IP (192.168.1.254) 49 | 4. Start DNS-redirecting all hostnames to 192.168.1.254. 50 | 5. Start DHCP to auto-assign IPs to incoming clients. 51 | 6. Start deauthing clients of the real AP. 52 | 53 | I think steps 3-5 can be applied to a specific wireless card (interface). 54 | 55 | * TODO: More details on how to start the fake AP, assign IPs, DHCP, DNS, etc. 56 | * Fluxion using `hostapd`: [code](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/lib/ap/hostapd.sh#L59-L64) 57 | * Kali "Evil Wireless AP" (uses `hostapd`): [article](https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/) 58 | * Fluxion using `airbase-ng`: [code](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/lib/ap/airbase-ng.sh#L76-L77) 59 | * TODO: Should the Evil Twin spoof the real AP's hardware MAC address? 60 | * Yes, looks like that's what Fluxion does ([code](https://github.com/FluxionNetwork/fluxion/blob/16965ec192eb87ae40c211d18bf11bb37951b155/lib/ap/hostapd.sh#L66-L74)). 61 | 62 | 63 | ROGUE AP 64 | ======== 65 | Gleaned this info from: 66 | 67 | * ["Setting up wireless access point in Kali"](https://www.psattack.com/articles/20160410/setting-up-a-wireless-access-point-in-kali/) by PSAttack 68 | * ["Kali Linux Evil Wireless Access Point"](https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/) by OffensiveSecurity 69 | * ["SniffAir" hostapd script](https://github.com/Tylous/SniffAir/blob/master/module/hostapd.py) 70 | 71 | 72 | HOSTAPD 73 | ------- 74 | * Starts access point. 75 | * Not included in Kali by-default. 76 | * Installable via `apt-get install hostapd`. 77 | * [Docs](https://wireless.wiki.kernel.org/en/users/documentation/hostapd) 78 | 79 | Config file format (e.g. `~/hostapd.conf`): 80 | 81 | ``` 82 | driver=nl80211 # 'nl80211' appears in all hostapd tutorials I've found. 83 | ssid=$EVIL_SSID # SSID/name of Evil Twin (should match target's) 84 | hw_mode=$BAND # Wifi Band, e.g. "g" or "g+n" 85 | channel=$CHANNEL # Numeric, e.g. "6' 86 | ``` 87 | 88 | Run: 89 | 90 | ``` 91 | hostapd ~/hostapd.conf -i wlan0 92 | ``` 93 | 94 | 95 | DNSMASQ 96 | ------- 97 | 98 | * Included in Kali. 99 | * Installable via `apt-get install dnsmasq` 100 | * Handles DNS and DHCP. 101 | * [Install & Overview](http://www.thekelleys.org.uk/dnsmasq/doc.html), [Manpage](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) 102 | 103 | Config file format (e.g. `~/dnsmasq.conf`): 104 | 105 | ``` 106 | interface=wlan0 107 | dhcp-range=10.0.0.10,10.0.0.250,12h 108 | dhcp-option=3,10.0.0.1 109 | dhcp-option=6,10.0.0.1 110 | #no-resolv 111 | server=8.8.8.8 112 | log-queries 113 | log-dhcp 114 | 115 | # Redirect all requests (# is wildcard) to IP of evil web server: 116 | # TODO: We should rely on iptables, right? Otherwise this redirects traffic from all ports... 117 | #address=/#/192.168.1.254 118 | ``` 119 | 120 | "DNS Entries" file format (`~/dns_entries`): 121 | 122 | ``` 123 | [DNS Name] [IP Address] 124 | # TODO: Are wildcards are supported? 125 | * 192.168.1.254 # IP of web server 126 | ``` 127 | 128 | Run: 129 | 130 | ``` 131 | dnsmasq -C ~/dnsmasq.conf -H ~/dns_entries 132 | ``` 133 | 134 | IPTABLES 135 | -------- 136 | From [this thread on raspberrypi.org](https://www.raspberrypi.org/forums/viewtopic.php?p=288263&sid=b6dd830c0c241a15ac0fe6930a4726c9#p288263) 137 | 138 | > *Use iptables to redirect all traffic directed at port 80 to the http server on the Pi* 139 | > `sudo iptables -t nat -A PREROUTING -d 0/0 -p tcp –dport 80 -j DNAT –to 192.168.1.254:80` 140 | 141 | And from Andreas Wiese on [UnixExchange](https://unix.stackexchange.com/a/125300) 142 | 143 | > *You could get this with a small set of iptables rules redirecting all traffic to port 80 and 443 your AP's address:* 144 | > `# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination localhost:80` 145 | > `# iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination localhost:80` 146 | 147 | TODO: 148 | 149 | * What about HTTPS traffic (port 443)? 150 | * We want to avoid browser warnings (scary in Chrome & Firefox). 151 | * Don't think we can send a 302 redirect to port 80 without triggering the invalid certificate issue. 152 | * sslstrip may get around this... 153 | 154 | 155 | DEAUTHING 156 | ========= 157 | While hosting the Evil Twin + Web Server, we need to deauthenticate clients from the target AP so they join the Evil Twin. 158 | 159 | Listening 160 | --------- 161 | We need to listen for more clients and automatically start deauthing new clients as they appear. 162 | 163 | This might be supported by existing tools... 164 | 165 | MDK 166 | --- 167 | Deauthing & DoS is easy to do using [MDK](https://tools.kali.org/wireless-attacks/mdk3) or `aireplay-ng`. 168 | 169 | I think MDK is a better tool for this job, but Wifite already requires the `aircrack` suite, so we should support both. 170 | 171 | TODO: Require MDK if it is miles-ahead of `aireplay-ng` 172 | TODO: Figure out MDK commands for persistent deauths; if we can provide a list of client MAC addresses & BSSIDs. 173 | 174 | 175 | Website 176 | ======= 177 | 178 | Router Login Pages 179 | ------------------ 180 | These are different for every vendor. 181 | 182 | Fluxion has a repo with fake login pages for a lot of popular router vendors ([FluxionNetwork/sites](https://github.com/FluxionNetwork/sites)). That repo includes sites in various languages. 183 | 184 | We need just the base router page HTML (Title/logo) and CSS (colors/font) for popular vendors. 185 | 186 | We also need a "generic" login page in case we don't have the page for a vendor. 187 | 188 | 1. Web server to host HTML, images, fonts, and CSS that the vendor uses. 189 | 3. Javascript to send the password to the webserver 190 | 191 | 192 | Language Support 193 | ---------------- 194 | Note: Users should choose the language to host; they know better than any script detection. 195 | 196 | Each router page will have a warning message telling the client they need to enter the Wifi password: 197 | * "Password is required after a router firmware update" 198 | 199 | The Login page content (HTML/images/css) could be reduced to just the logo and warning message. No navbars/sidebars/links to anything else. 200 | 201 | Then only the warning message needs to be templatized by-language (we only need one sentence per language). 202 | 203 | That would avoid the need for separate "sites" for each Vendor *and* language. 204 | 205 | But we probably need other labels to be translated as well: 206 | 207 | * Title of page ("Router Login Page") 208 | * "Password:" 209 | * "Re-enter Password:" 210 | * "Reconnect" or "Login" 211 | 212 | ...So 5 sentences per language. Not bad. 213 | 214 | The web server could send a Javascript file containing the language variable values: 215 | 216 | ```javascript 217 | document.title = 'Router Login'; 218 | document.querySelector('#warn').textContent('You need to login after router firmware upgrade.'); 219 | document.querySelector('#pass').textContent('Password:'); 220 | // ... 221 | ``` 222 | 223 | 224 | One HTML File 225 | ------------- 226 | We can compact everything into a single HTML file: 227 | 228 | 1. Inline CSS 229 | 2. Inline images (base64 image/jpg) 230 | 3. Some placeholders for the warning message, password label, login button. 231 | 232 | This would avoid the "lots of folders" problem; one folder for all .html files. 233 | 234 | E.g. `ASUS.html` can be chosen when the target MAC vendor contains `ASUS`. 235 | 236 | 237 | AJAX Password Submission 238 | ------------------------ 239 | The website needs to send the password to the webserver, likely through some endpoint (e.g. `./login.cgi?password1=...&password2=...`). 240 | 241 | Easy to do in Javascript (via a simple `