How to Map Networks & Connect to Discovered Devices Using Your Phone « Null Byte :: WonderHowTo

Sharing your Wi-Fi password is like giving an unlimited pass to snoop around your network, allowing direct access even to LAN-connected devices like printers, routers, and security cameras. Most networks allow users to scan and attempt to log in to these connected devices. And if you haven't changed the default password on these devices, an attacker can simply try plugging them in.Networks scanners arerecon toolsfor finding vulnerabilities and are often seen as the first stage in an attack. While primarily an information gathering tool, theFing network scanneractually allows us to connect directly to a wide range of devices by guessing the password. In an advanced attack, Fing can be used to rapidly obtain targeting information to guide powerful,Hydra passwordcracking attempts.Don't Miss:The Principles & Technologies Needed for Cracking PasswordsScanning a network with Fing can lead to many exciting discoveries because often the people who set up the network do so in ways that don't make any sense. In some setups, the "Guest" Wi-Fi network can even show you a page with the password to the second "Secure" Wi-Fi network in plain text, just by navigating to the router's IP address.Sure, there are many fancier setups for exploiting access, but when physical access is limited, flexibly using your existing tools can be a lifesaver.The essential things that Fing accomplishes are:Mapping a network by discovering all devices connected to it.Scanning discovered devices for OS information and open ports.Connecting directly to devices on the network with open ports by guessing or cracking the default password.The first two bullets above provide the information to support an educated attempt to own devices on a network, or for targeting the router with a more advanced attack against the device, such asRoutersploit. If you're interested in stumbling into security cameras, printer servers, wireless routers, and other random devices you'll find on networks, read on to learn what you need.Don't Miss:Exploit Routers on an Unrooted Android Phone with RoutersploitSystem Compatibility & RequirementsIn this use-case, we will use the disclosure of a Wi-Fi password to quickly scan and fingerprint the network, identify and fingerprint a machine with an open HTTP port, and guess the model-specific default username and password to log in to the device. To do this, you will need any current iPhone or Android device.While you can access any device with HTTP ports like 80 or 8080 open on your phone's browser, you will need an app to open SSH, FTP, and Telnet connections. Today, we will talk about HTTP, but I recommendJuice SSH, for connecting to other ports on Android, orShelly, for use on the iPhone.Using the Fing mobile app to explore new networks (1), to create list of devices to probe (2), and to scan an individual device (3).Images by SADMIN/Null ByteStep 1: Install Fing on iOS or Android PhoneThere are many network scanners for Windows, macOS, and Linux, but the best tool to use is often the one you know you'll have with you. Anything too big, specialized, or expensive you'll probably have left at home when you really need it.That's why we're using the Fing mobile app here. When you have a moment of access to a target, or when you're given a Wi-Fi password unexpectedly, it can be trivial to gain access to many devices on a network with only a smartphone.Fing works on bothAndroidandiPhoneand allows anyone to get started with mapping a network and connecting to devices on it. So use those links to install it on your device, and once you've connected to a Wi-Fi network, Fing will scan the entire network and give a detailed breakdown of each device connected to it.Play Store Link:Fing - Network Tools(free)App Store Link:Fing - Network Scanner(free)Step 2: Join the Wi-Fi Network on Your PhonePolitely ask for the Wi-Fi password of the network you want to scan. It's rare nowadays for someone not to give you this information. Once you have it, connect to the network on your smartphone, then launch the Fing app you just installed.Fing can't scan a network it hasn't joined. For recon on networks you don't have the password to, check outour article on Wardriving.Don't Miss:Wardrive on an Android Phone to Map Vulnerable NetworksStep 3: Scan the Entire Wi-Fi NetworkIn the Fing app, start a new network scan by tapping the round arrow icon in the top right to identify all devices on the current network.Fing performs a scan against a range of all potential IP addresses based on the IP of the network you are connected to. While doing so, it compares the information found against device fingerprints and displays the result in an easy to understand graphical display of all attached devices.Look for important devices like routers, servers, and desktop computers.Most public wireless networks will not assign you to an isolated subnet, allowing you to interact with sometimes hundred of devices.Step 4: Port Scan a Targeted DeviceSelecting a specific device allows you to scan it and find open ports. Just tap on the "Scan Services" option to start the scan. It will probably take longer than the main network scan performed in the previous step.Scanning a device can tell you a lot about the services it offers. Below, we see a scan of aRaspberry Piwith SSH and a web server with port 80 enabled. Ports 22, 80, and 443 are open.Scan of a Raspberry Pi computer. Of course, using default passwords.Any port you find open means an opportunity to probe further into the device. Once you see a device with port 80, 8080, or 443 open,you can tap on itto open it in your browser.Good Beginner Pi Setup:CanaKit Raspberry Pi 3 B+ Starter Kit— $80Step 5: Identify the DeviceLogin pages, combined with the information from our Fing scan, can give detailed information on the device manufacturer and often the model number. If you've ever run an "advanced" Google search, you know this is a bad idea, since you can just look up the default password (which we'll talk about in the next step).Don't Miss:How to Find Vulnerable Targets Using the Shodan Search EngineIn one of my scans, I found an Arris router. On its login page, the default username is quickly shown (as "admin"). Plus, the "HSD" tab shows us the model number and even serial number.Device configuration pages often give away way too much information, as this Arris router helpfully provides us the default username.Step 6: Find the Default Username & Password for the DeviceA simple Google search will give you the default credentials for that particular model. Enter the default username and password to test if the device has been properly configured. It probably hasn't.Unless your device is one specific model of router, odds are the password is password. Creative thinking, Arris!By far the most common logins across all devices are:Username:root, admin, user, and super.Password:password, (blank), toor, super, admin, user, and root.Some Warnings on FingingOne thing you'll learn about life is not everyone likes being Finged. Some organizations with IT departments or IDS systems can get quite upset about being Finged by surprise and without permission. As a result, it's wise to not go around Finging every open port if you don't know who might get upset about it, just as in life in general.In particular, counter-cybercrime training provided to technology companies by the US government targets employees for heightened scrutiny and potential reporting to federal agencies if they become concerned about your behavior on company networks. Port scanning company networks is seen as suspicious and indicative of either espionage or crime. If you work at a company like this, and you're using your phone, keep your Fingers to yourself at work.Accessing a device without permission is a crime, so while you may have permission to use the internet, "using" typically does not cover logging into the router and changing settings. Like any port scan, Fing will leave traces in the router logs and may trigger a firewall or IDS to block you.You can ask me questions here or @sadmin2001 onTwitterorInstagram.Don't Miss:How to Create Stronger Passwords (Advice from a Real Hacker)Follow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by SADMIN/Null ByteRelatedHow To:Tactical Nmap for Beginner Network ReconnaissanceHow To:Find & Share Local Wi-Fi Passwords for Free Internet Everywhere You GoHow To:Spy on Network Relationships with Airgraph-NgHow To:Automatically Connect to Free Wi-Fi Hotspots (That Are Actually Free) on Your Samsung Galaxy Note 2How To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Wardrive on an Android Phone to Map Vulnerable NetworksHow To:Connect to Protected Wi-Fi Hotspots for Free Without Any PasswordsHow To:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterHow To:Protect Yourself from the KRACK Attacks WPA2 Wi-Fi VulnerabilityHow To:Hack a Hard Drive into a Hidden Flash Drive, Cell Phone Charger & More!How To:Use & Abuse the Address Resolution Protocol (ARP) to Locate Hosts on a NetworkAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Prepare Your Phone for a Trip Abroad with These TipsYouTube 101:How to Cast Videos to Your TVHow To:See Who's Clogging Up Your Wi-Fi Network with These Free Mobile AppsHow To:Speed Test Your Chromecast or Android TVHulu 101:How to Cast Shows & Movies to Your TVHow To:Connect Your iPhone to Your Mac Like Never Before with PushbulletHow To:Track Wi-Fi Devices & Connect to Them Using ProbequestHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:Google Maps vs. Google Maps Go — Which App Is Right for You?How To:Hack Open Hotel, Airplane & Coffee Shop Wi-Fi with MAC Address SpoofingHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How To:Connect to a nearby WiFi network on a BlackBerry Pearl 3G phoneHow To:Force Your iPhone to Switch Cell Towers for a Stronger SignalHow To:Sync Your Galaxy S3's Music with Any Android Device Without Using Group PlayHow To:Play Your Favorite Xbox One Games on iPhone or AndroidHow To:Use an ESP8266 Beacon Spammer to Track Smartphone UsersHow To:Download Entire Maps for Offline Use in Google MapsHow To:Log Wi-Fi Probe Requests from Smartphones & Laptops with ProbemonHow To:Fix Google Now Bluetooth Problems on Your Samsung Galaxy Note 2 or Other Android DeviceHow To:USB Tether Your Android Device to Your Mac—Without RootingHow To:Easily Share Your Wi-Fi Password with a QR Code on Your Android PhoneHow To:Use Kismet to Watch Wi-Fi User Activity Through WallsHow To:Save Battery Life & Never Get Lost Again with Offline Maps & Directions on Your Samsung Galaxy S3How To:Use Google Maps to Share Your Location with Friends & FamilyNews:Nextdoor Brings Private Social Networks to a Neighborhood Near YouHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Bypass a Local Network Proxy for Free InternetSUBMIT:Self Portrait Cell Phone Photo by January 16th. WIN: Portable USB Power Supply