How to Enable Monitor Mode & Packet Injection on the Raspberry Pi « Null Byte :: WonderHowTo

TheRaspberry Pi Zero WandPi 3 Model B+include integrated Wi-Fi, Bluetooth Low Energy, and more than enough power to runKali Linux. They sound like perfect all-in-one penetration testing devices, but the lack of support for monitor mode and packet injection usually meantbuying a supported Wi-Fi adapter. Now, it's possible to use monitor mode on the built-in Wi-Fi chip with Nexmon.The Need for Packet Injection & Monitor ModeThere areplenty of reasonswhy the ability to put a wireless card in monitor mode would be useful. The wireless card in a Raspberry Pi isn't very good at doing much other than what's needed to establish a basic Wi-Fi connection.While some tools in Kali Linux may work with a card not supporting monitor mode, it's more common to find that a tool you want to run won't work without it. As a result, most hackers choose topurchase an external, USB-connected wireless network adapterthat allows more flexibility.Don't Miss:Check if Your Wireless Network Adapter Supports Monitor ModeImage by SADMIN/Null ByteIn the example above, the tiny Pi Zero W is controlling anAlfa AWUS036NHAantenna that's nearly twice its size. While impressive to control such a burly antenna with a tiny device, this huge footprint nearly defeats the purpose of using a Pi Zero W, unless you're trying to hide the Pi inside the antenna.The Pi Zero W Wireless CardTheRaspberry Pi Zero Wcontains the same Broadcom BCM43438 wireless chipset used by other Raspberry Pi models. The small chip contains a Wi-Fi radio, Bluetooth radio, and even has the ability to receive FM radio. In spite of these powerful abilities, the chip is incredibly small, allowing the one-inch Raspberry Pi Zero W to access Wi-Fi networks and use Bluetooth peripherals like keyboards or mice.Don't Miss:Buy the Best Wireless Network Adapter for Wi-Fi HackingImage by SADMIN/Null ByteDue to how widespread the Broadcom BCM43438 is used, community interest in supporting monitor mode has been steadily growing since its introduction. In spite of this, the manufacturer never got around to officially supporting monitor mode, limiting the usefulness of the wireless cards inRaspberry Pidevices.What this means for a hacker is that if Wi-Fi hacking is involved, the Raspberry Pi as a platform must be considered as only one part of a complete system, including a secondary adapter that supports monitor mode and packet injection. In general, this is not too much of a trade-off, as the Pi's internal antenna is usually used as a "command and control" antenna that allows control of the more powerful "offensive" network adapter.Nexmon Community SupportWhile Broadcom never released a patch to enable monitor mode, the community eventually came through with one. TheNexmonproject is a firmware patch based in C for the Broadcom/Cypress chips in use within Raspberry Pi devices. One important note before using this patch is that because it's developed by the community, it doesn't come with the same kinds of assurances an official patch would as denoted by the warning on the Nexmon GitHub repo.WARNING: Our software may damage your hardware and may void your hardware's warranty! You use our tools at your own risk and responsibility! If you don't like these terms, don't use nexmon!—Nexmon GitHubIn spite of the stated warnings, Nexmon generally works very well on the cards that are supported. Nexmon goes beyond just supporting the chipset inside the Raspberry Pi and can be used to enable monitor mode in a variety of other wireless chips used in smartphones.Don't Miss:Stealing Wi-Fi Passwords with an Evil Twin AttackA list of chipsets supported by Nexmon.Image viaNexmon GitHubStep 1: Set Up Your Raspberry Pi with NexmonTo get started, you'll need a Raspberry Pi running Kali Linux with a chipset that's supported by Nexmon. Because all chipsets are supported as of this writing, this should work on any Raspberry Pi model. While we'll be covering the Raspberry Pi Zero W in this guide, you can follow along with any model of Pi.Don't Miss:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+Image by SADMIN/Null ByteOption 1: On a New Raspberry PiIn the first scenario, we'll set up a Pi Zero W that doesn't yet have Kali Linux installed. This is perfect if it's your first time setting up a Pi or otherwise working with a device that doesn't have data on it you want to save. If you have an existing Pi setup you want to add Nexmon to, I'll cover those instructions in the next option.On Amazon:CanaKit Raspberry Pi Zero W Complete Starter KitThe easiest way to enable monitor mode is to simply load a Kali image that already has Nexmon installed. One of my favorites is the Sticky Finger's Kali-Pi image, which can be installed on any kind of Raspberry Pi. To download the Sticky Finger's Kali-Pi image, select from the version that matches your model of Raspberry Pi:For ARMHF (Pi 2/3 B/B+)ARMEL (Pi 1/0/0W)When the image is downloaded, flash the image to the SD card of the Pi usingEtcher, one of the simplest ways of preparing your SD card. However, if you're running Windows, you can useWin32 Disk Imagerto put your image on the card. On a Mac, you can also write a bootable SD image via a terminal using the below instructions.Before plugging in your SD card, run the following in a terminal, which will display a list of all the disks attached to your system.df -hAttach your SD card and run the command again, and note the filesystem name of your SD card (it's the one that wasn't there before). It should look like /dev/disk2s1, and you should be very careful not to mix this up in the next steps since doing so could overwrite your hard drive.Now, you'll use theddcommand to load the Kali image onto the card. First, use the following command to unmount the partition so you can write to it, withXbeing the correct disk number.sudo diskutil unmount /dev/diskXNext, run the following command to load the image onto the SD card. If there is an "s" after the initial disk number (like rdisk2s1), do not include the "s" or following number. So, "rdisk2s1" should look like "rdisk2." Here's what it should look like all together:sudo dd bs=1m if=LocationOfKaliImage of=/dev/rdiskXPressenterto begin the process and note thatdddoes not provide any on-screen information unless there is an error or it finishes. To view the progress during the transfer, you can hitCtrl-T. Wait for the process to complete. You'll know the process is complete when you see a readout of bytes transferred over and the time the process ran.Once it's complete, load up your Pi with the SD card and make sure to follow our guide onsetting up your new Kali Linux installationand thetop 10 things to do after installing Kali Linux.Option 2: On an Existing Raspberry PiTo set up an existing Raspberry Pi, you'll need to eitherlog in via SSH, connect a monitor and keyboard to log in with, oruse a connected computer. Make sure your Pi is connected to a Wi-Fi network, and then open a terminal window.First, make sure you're root andchange directoryto the right place:sudo su
cd /usr/local/srcAfter changing directory, download the current version of the Re4son kernel into the directory.wget  -O re4son-kernel_current.tar.xz https://re4son-kernel.com/download/re4son-kernel-current/Next, extract the file downloaded with thetarcommand.tar -xJf re4son-kernel_current.tar.xzAfter the file is extracted, change directories into the directory just decompressed with:cd re4son-kernel_4*Finally, install the firmware patch by running theinstall.shprogram located inside../install.shAfter the installation process is complete, the Wi-Fi card on your Raspberry Pi should support monitor mode.Step 2: Test for Monitor Mode & Packet InjectionNow, try putting your card in to monitor mode. The Re4son kernel comes with its own utility for doing so, and you can use the following command to put the card into monitor mode.sudo mon0 upWhen this is complete, your mon0 interface should now be up and allow you to listen in on other Wi-Fi conversations as well as inject packets. You can confirm the card is in monitor mode by running the following command. You can pressCtrl-Cto stop the scan once you've seen the card is able to scan.airodump-ng mon0Next up, useAireplay-ngto test the ability of the Pi to inject packets. To do so, make sure you're in proximity to a Wi-Fi network to attempt packet injection on, then run the following command.Don't Miss:Detect Script-Kiddie Wi-Fi Jamming with Wiresharkaireplay-ng --test mon0If you see a result like below, then it means your Pi can support packet injection.aireplay-ng --test mon0
12:47:05  Waiting for beacon frame (BSSID: AA:BB:CC:DD:EE) on channel 7
12:47:05  Trying broadcast probe requests...
12:47:06  Injection is working!
12:47:07  Found 1 AP

12:47:07  Trying directed probe requests...
12:47:07  AA:BB:CC:DD:EE - channel: 7 - 'Dobis'
12:47:08  Ping (min/avg/max): 0.891ms/15.899ms/32.832ms Power: -21.72
12:47:08  29/30:  96%An All-in-One Wi-Fi Hacking PackageThe Raspberry Pi Zero W set the bar for a low-cost, ultra versatile single board computer, but the community support added by Nexmon allows a Pi Zero W to act as an all-in-one Wi-Fi hacking computer. While only having one card on the board means that you can't both control a Pi and attack using the same Wi-Fi card, there are plenty of other clever ways of connecting to a Pi, either by serial cable or Bluetooth, that can allow this configuration to be extremely useful.I hope you enjoyed this guide to adding monitor mode to the Raspberry Pi Zero W! If you have any questions about this tutorial on the Raspberry Pi Zero W or you have an issue about Raspberry Pis in general, feel free to comment below or reach me on Twitter@KodyKinzie.Don't Miss:Disable Security Cameras on Any Wireless Network with Aireplay-ngFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo bySADMIN/Null ByteRelatedHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationHow To:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019How To:Select a Field-Tested Kali Linux Compatible Wireless AdapterHow To:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterHow To:Build a Pumpkin Pi — The Rogue AP & MITM Framework That Fits in Your PocketHow To:Hack WiFi Using a WPS Pixie Dust AttackHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyHow To:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxHow To:Set Up Kali Linux on the New $10 Raspberry Pi Zero WHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionRaspberry Pi:WiFi AnalyzerHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Log into Your Raspberry Pi Using a USB-to-TTL Serial CableHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+How To:Share Wi-Fi Adapters Across a Network with Airserv-NgThe Hacks of Mr. Robot:How to Build a Hacking Raspberry PiHow To:Lock Down Your DNS with a Pi-Hole to Avoid Trackers, Phishing Sites & MoreNews:Smart Home Proof of Concept Uses a Raspberry Pi to Control Air Conditioner with HoloLensHow To:Get Free Wi-Fi from Hotels & MoreHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Get Packet Injection Capable Drivers in LinuxHow To:Bypass a Local Network Proxy for Free Internet