How to Hack Wi-Fi: Evading an Authentication Proxy Using ICMPTX « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!In previousWi-Fi hacking tutorials, I have shown you ways tocreate an Evil Twin, toDoS a wireless AP, and tocrack WEPandWPA2passwords, but in this tutorial, I will show you something a little bit different.In many restaurants, hotels, airports, airplanes, and cafes, they have open authentication on the wireless AP, but once you connect to the AP, you are sent to a proxy that asks you for your credentials. This is very common in many commercial establishments around the world. To obtain the necessary credentials, there is usually charge associated with it.What if you didn't have a credit card, or forgot your credit card, and needed to access the internet? You still may be able to, if the server accepts ICMP (ping) and you are patient.In addition, imagine a scenario where you need to stealthily retrieve a file, send a message, or retrieve a message, in say, a cyber espionage or cyber warfare situation, while barely leaving a trace of your activity. This may be your method of choice.Note: This is a more advanced technique, so if you are new to hacking, work on some of the more basic techniques before trying this.ICMP: The Internet Control Message ProtocolAs you know, ICMP is a protocol that is used detect the presence of a active host. We can determine if a host is active (pay attention, newbies) by simply typing:kali > ping <IPaddress>There are multiple types of ICMP messages, but this one isecho request(Type 0) andecho reply(Type 8). Although nearly all of us usepingone time or another, keep in mind that there are other types of ICMP that can come in handy when scanning or hacking systems that may block or drop ICMP Type 0.If a server accepts ICMP (many won't as a security precaution), you can use ICMP to bypass the need for authentication via the proxy (that webpage that asks you for credentials). Because it is very slow, I don't recommend this for daily use, but in a pinch, this can be a very innovative way to get your email when you don't want to buy access to the service, or—you want to access the web without leaving a trace.Step 1: Fire Up Kali & Download IcmptxTo begin, let's fire upKali Linuxand downloadicmptx. Since icmptx is in the Kali repository, all we need to do is:kali > apt-get install icmptxThis will install icmptx to your Kali operating system.Step 2: Getting HelpNext, let's take a look at the help file for icmptx. Simply type:kali > icmptxThis help screen will appear. As you can see, the syntax is very straightforward and simple. Unfortunately, the implementation is not.When we downloaded icmptx, it installed a manual page, so let's take a look at it by typing:kali > man icmptxThe manual page doesn't offer much more information than the help page.Step 3: Server Side ProxyThe way icmptx works is that you need to set up a proxy/server between you, the client, and the intended target on the web. First, let's set up the proxy/server.To set up the up the proxy/server, the syntax is simple:kali > icmptx -s 10.0.0.1This points the server/proxy at the IP address 10.0.0.1. This is only an example; you will need to replace this IP with whatever the target IP address you are trying to connect to.Step 4: TunnelingNext, we need to set up a tunnel. A tunnel provides a packet transmission and reception place for user-based applications. Since icmptx is a user-based application, we need to set up a tunnel to send and receive packets, in this case, ICMP packets.We can check to see whether our kernel supports tunneling by typing:kali > ifconfig tun0This response indicates that our Debian operating system (that Kali is built on) supports tunneling. Let's set up a tunnel on the server now.Step 5: IP ForwardingNext, we need to set up this server to first, ignore ICMP requests and second, forward IP traffic. If we didn't tell the kernel to ignore ICMP requests, it would respond with a echo reply (Type 8), which is the normal response. We don't want that. We want the ICMP traffic to enter the server and pass right through it.We can tell the kernel to ignore ICMP traffic by typing:kali > echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_allThen we need to forward IP traffic, by typing:kali > echo 1 > /proc/sys/net/ipv4/ip_forwardStep 6: Set Up the ClientNow, let's set up our client. This is the system we will be using to access the Internet from. We need to install icmptx on this system as well, but here we will be using the client and not the server setup.To do so, type:kali > icmptx -c <IP address of the proxy/server>Then we need to establish a tunnel on this system as well.Next, we need to set up a route to the proxy.Lastly, we need to set a route through the tunnel we created (tun0) to the server on the web we want to access.Now, when you want to access that site on the web, you can do so without authenticating and be almost totally invisible!Although using icmptx is probably not a practical means of accessing the web on a daily basis, in a pinch or under severely clandestine circumstances, it will get you past web-based authentication and leave almost no trail. Few, if any, security administrators will be looking for ICMP traffic to trace your activities and, since you did not have to authenticate, your trail is almost invisible. In addition, if you set up the server on a zombie system, the only trail will lead back to the server/zombie without a highly skilled forensic investigation.For more ways to hack wireless networks, make sure to check outmy Wi-Fi Hacking seriesof guides and, as always, stayed tuned toNull Bytefor more hacking fun.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaTSARelatedHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHack Like a Pro:How to Hack Web Apps, Part 3 (Web-Based Authentication)Android Basics:How to Connect to a Wi-Fi NetworkHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:Skip Ads When Listening to iTunes Radio on Your Mac or iOS DeviceHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Your iPhone's Using More Data Than It Needs, but This Could Stop ItHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiWiFi Prank:Use the iOS Exploit to Keep iPhone Users Off the InternetHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow To:Share Your Wi-Fi Password with a QR Code in Android 10How To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHow To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidNews:What to Expect from Null Byte in 2015How To:Fix the Wi-Fi Roaming Bug on Your Samsung Galaxy S3Hack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)News:iOS 11.2 Beta 3 Released, Includes Pop-Up Alerts for Wi-Fi & Bluetooth Controls, New Control Center BarHow To:Recover a Lost WiFi Password from Any DeviceHow To:Hide Your IP Address with a Proxy ServerHow to Hack Wi-Fi:DoSing a Wireless AP ContinuouslyHow To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How To:Quickly Encrypt Your Web Browsing Traffic When Connected to Public WiFiHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateHow To:Chain Proxies to Mask Your IP Address and Remain Anonymous on the WebHow To:Hack Wireless Router Passwords & Networks Using HydraHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:You No Longer Have to Open Settings to Switch & Connect to Wi-Fi on Your iPhone (FINALLY!)Levitation Challenge:Evading ArrestHow To:Adjust WiFi Video Quality on Your iPhone in iOS 10