How to Wardrive with the Kali Raspberry Pi to Map Wi-Fi Devices « Null Byte :: WonderHowTo

Surveying a target's Wi-Fi infrastructure is the first step to understanding the wireless attack surface you have to work with.Wardriving has been around since the '90s and combines GPS data and Wi-Fi signal data to create accurate, in-depth maps of any nearby Wi-Fi networks you come within range of. Today, you'll learn to launch this stealthy, impossible-to-detect recon technique fromour Kali Pito map targets of opportunity with the addition of a GPS dongle andwireless network adapter.Even though wardriving has been around for decades, the science of wardriving has kept up with the times. Big data, plummeting hardware costs, and new ideas have brought wardriving back into the news, with wardriving techniques being deployed in Seattle by studentsto locate and identify government mass surveillance Stingray devicesbeing used in the city. With low-cost distributed detection networks, a handful of ridesharing drivers can conduct mass surveillance of wireless users across a city or monitor where tools the government uses to secretly spy on people are being deployed.IoT Devices Are Fun New TargetsIoT devices have also fallen victim to wardrivers, with purchasers of afancy internet-connected sex toy finding themselves put publically on the mapby wardriving of the device's internal hotspot. The easy geolocation of these devices lead to the eventual penetration of the penetration device's already weak Wi-Fi security and hardcoded admin passwords.Horrifyingly, anyone hacking into the devicewould find themselves staring at a web-connected endoscope, which is further evidence that it's not always wise to hack into a vulnerable computer when you're not sure what it is (or where it's going). Nevertheless, the location and exploitation of IoT devices through wardriving should be considered in your approach to examining a target's wireless attack surfaces.More on Hacking IoT Devices:How to Find Vulnerable Targets Using ShodanWardriving Tactics for 2017In my article describing theKali Linux build, one of the things I mentioned being powerful about Kali Linux on a Raspberry Pi is the flexibility to add components to enable a variety of unique use-cases. Wardriving is a hobby of mine, and I've been able to log millions of unique Wi-Fi networks in my personal database using the Kali Pi when the opportunity to present itself. This includes tens of thousands of vulnerable WEP, open, or misconfigured routers, and required less than $100 in hardware to build.Wardriving with Kismet on the Raspberry Pi.Image by SADMIN/Null ByteThe Raspberry Pi is the base of our system. Depending on the mission, we can create modular payloads to serve our purpose. Whether you want a short-range antenna to only record traffic within a few feet or a highly directional antenna to record all Wi-Fi APs in a high-rise building, the Pi lets you customize your payload as easily as plugging in a USB component.A Raspberry Pi 2 B board plugged into a GPS receiver and Wi-Fi adapter to run a wardriving tool called Kismet.Image by SADMIN/Null ByteSometimes, you will need to conduct an extremely detailed assessment of a target, with information including wireless clients and traffic as well as just broadcast beacons. For your use-case, you have a range of options in the way you configure your Pi. For vehicle surveillance, a high-gain antenna that is exposed to the outside is recommended. For fixed high-rise building surveillance, a cantenna or directional antenna is your best bet. For walkthrough surveillance, a Pi connected to a large omnidirectional antenna in a backpack is the preferred method.If you want to limit the collection of unrelated data or confine it to a certain room, thePanda Wireless dongleis a perfect (and powerful) mid-range choice. This technique will apply to all versions of the Raspberry Pi running our Kali build, so aPi Zero Wcan also be used with the right wireless adapter. Keep in mind the Pi Zero W and the Pi 3 cannot use their internal adapter for this since it can't be put into monitor mode.High-gain directional antennas scanning on separate channels can give you a highly detailed picture of a local area even at relatively high speeds.Image by popovaphoto/123RFAfter selecting your hardware load-out, you will need to gain some degree of physical proximity to your target. Take a tour, pretend you're there for an interview, sit in the lobby for as long as you can and move around the building. Driving or biking is also acceptable, but the longer you're physically nearby, the more intel you will collect. This article will detail my personal "SSH Scramble" recon technique to quickly turn our Kali Pi into a signals intelligence collections device.A wardriving recon kit.Image by SADMIN/Null BytePassive Recon vs. Active ReconKismetis a wireless network logger that is completely passive, unlikeNetStumbleror other wardriving programs that send active probes for networks. This leaves no trace of ourreconnaissance. In spite of being a passive recon tool, Kismet is highly effective and yields detailed information on discovered networks, including MAC address, SSID, the level of encryption used, and even the manufacturer of the hardware.SSH Scramble Recon ProcessIn this tutorial, we will cover how to begin a wardriving scan on the Raspberry Pi running Kali Rolling via SSH using Kismet. This assumes you only want to wardrive occasionally and not have a dedicated Pi configuration for only doing that. I want to keep wardriving easy to use and encourage you to find new ways of using the data. This method can also be automated on a USB Rubber Ducky to quick-start a run and take advantage of physical access by simply inserting the Ducky into the Pi's USB port to begin recording.Don't Miss:How to Automate Hacking on the Raspberry Pi with the USB Rubber DuckyRunning kismet via SSH on your phone.What You'll Needwireless network adapterRaspberry Pi running Kali Linux with power supplyGPS USB receiver unit (this one is highly recommended)smartphone or laptop to start attack, or appropriately programmedUSB Rubber DuckyKismetGPSD(a GPS data processor)The Raspberry Pi is modular and simple to connect.Image by SADMIN/Null ByteStep 1: Install Kismet & GPS DependenciesIn order to get everything working, we have two options. The version of Kismet in the Kali Rolling repo is not the newest, but if you're lazy and want to get right to it you can type the following to install the older Kali Rolling version.apt-get install kismetIf you'd like the newest version, it will require several dependencies to be updated beyond what they are in the Kali repo as well (such as libpcap). To try downloading the newest version, you can run the following in terminal.git clonehttps://github.com/kismetwireless/kismet.gitgit clonehttps://github.com/the-tcpdump-group/libpcap.gitsudo apt-get install screen gpsd ncurses-dev libpcap-dev tcpdump libmicrohttpd-dev flex byacccd libpcap./configuremakesudo make installcdcd kismet./configuremakesudo make installThe new version got stuck on a lot of dependencies for me, but I added everything my Kali Pi needed to update in the example above. If you get stuck on any dependencies, use theapt-getworkaround for now. Just typeapt-get installand then the name of any dependencies required to try installing them.Step 2: Acquire a Location Data FixPlug in your USB GPS dongle, then typelsusbto show a list of attached USB devices. You should see something like:Bus 001 Device 006: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial PortIf you see that, your GPS unit is being detected. To find the name of the GPS path, type:dmesg | grep ttyYou should see your device as something like "ttyUSB0." This is the name we'll use to start it in the next command. Let's start and test our GPS by typing:gpsd /dev/ttyUSB0cgpsIf you're successful, you should see a GPS fix in a few seconds.Data from a successful GPS connection.Step 3: Start Kismet & Confirm GPS SignalLog into your Kali Pi via SSH. If you need help with this, we cover it in my previous Kali Pi tutorial.More on Logging in via SSH:How to set up a Kali Pi on the Raspberry Pi 3When you are connected via SSH, runifconfigto take note of the name of your attack antenna, which is usually wlan1. The Raspberry Pi's internal antenna is usually wlan0, but this can sometimes change. Take note of the IP address you are connected to via SSH and make sure you're tethered through the Pi's internal antenna, otherwise you'll lose your link as soon as Kismet starts on the wrong antenna.Once you know your attack antenna's name, start GPSD and Kismet by typing:gpsd /dev/ttyUSB0kismetKismet should open and ask you some configuration questions. You can tab through the fields and ignore everything until the window pops up asking you to add an interface. When prompted, add your attack antenna name to the "interface" field.Kismet lets you customize the colors to whatever horrible configuration you want. Sorry.After adding the interface, press tab until you get to the "add" option and then press return. The console should show the main screen. Tab through until you reach the option to close the screen, and you'll be switched to the main overview seen below. You should see two critical things — networks being detected and GPS data being logged.Successful kismet launch.When you are done recording, pressCtrl-Cto shut down the Kismet server. Now, you should see a log in your root directory called "kismet" and then a timestamp. This is a log of the Wi-Fi and GPS data you collected.Step 4: Use in the FieldRunning GPSD and Kismet at the same time requires us to do two things at once — something difficult to do via SSH. To manage this, we will install screen to create separate "screen" sessions we can switch back to, or even disconnect and reconnect to later. This lets us start a process, disconnect, and then return and reattach to it later, which is great if we are disconnected by accident or need to do more than one thing.To install screen, type:apt-get install screenTo use screen during an ssh session, type:screenA splash screen will explain the functions; press any key to go through. To disconnect from a screen session, you'll pressCtrl-Aand thenD. To list all available screen sessions, typescreen -list. To reconnect, just typescreen -r.Great! Now we'll combine all these things for our wireless recon command.From your phone or PC, SSH into your Kali Pi and start a screen session by typingscreen. In this session, we'll start GPSD and Kismet.screengpsd /dev/ttyUSB0ifconfigkismetOnce we enter our attack antenna into Kismet and we see the startup was successful, hittingCtrl-AthenDwill disconnect the screen session. You can rejoin it at any time by logging into the Pi and typing:screen -rReconnecting, you should see something like this:With Kismet running in a screen session, disconnect from the Pi and focus on getting as much access as possible while Kismet records wireless traffic. When you're done, reconnect to the Kali Pi and reconnect to the screen session withscreen -r. End the session by hittingCtrl-Cto shut down the server.Step 5: Upload & Convert DataWhen you're done with a run, there are two ways to interpret the data. To upload the data to Wigle Wi-Fi, simply go toWigle.net, sign up for an account or log in, and upload the .xml file Kismet createdto the "uploads" section. As soon as the data is done being converted, you can query and view your data run.To interpret the data yourself, you can convert it to a Google Maps-compatible .kml file with GISKismet. To do so, get GISKismet and create a .db file with:apt-get install giskismetgiskismet -x (the path of your kismet .xml file here)giskismet -q "select * from wireless" -o output_all.kmlThis should produce a KML file you can open in Google Earth.Battery pack, GPS receiver, Wi-Fi antenna, and Pi.Image by SADMIN/Null ByteSome WarningsUsing a hotspot to tether your device will pollute your results with that SSID showing up everywhere. Usingscreenand turning off your hotspot until you need to reconnect will avoid this. If your Pi dies while writing Kismet data to root, it will very likely corrupt the OS and need to goFsckitself before it can be used autonomously again. Make sure to shut down your Pi, or have a "safe kill" USB Rubber Ducky to properly shut down your Pi after a recon run if you can't log in via SSH.Stay tuned for tutorials on wireless recon and signals intelligence. You can ask me questions here or @sadmin2001 onTwitterorInstagram.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo, screenshots, and GIF by SADMIN/Null ByteRelatedHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+How To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationHow To:Enable Monitor Mode & Packet Injection on the Raspberry PiHow To:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxHow To:Build a Pumpkin Pi — The Rogue AP & MITM Framework That Fits in Your PocketHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow To:Set Up Kali Linux on the New $10 Raspberry Pi Zero WHow To:Set Up Network Implants with a Cheap SBC (Single-Board Computer)How To:Build an Off-Grid Wi-Fi Voice Communication System with Android & Raspberry PiHow To:Turn Any Phone into a Hacking Super Weapon with the SonicHow To:Automate Hacking on the Raspberry Pi with the USB Rubber DuckyHow To:Map Networks & Connect to Discovered Devices Using Your PhoneHow To:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterThe Hacks of Mr. Robot:How to Build a Hacking Raspberry PiHow To:Hack Wi-Fi Networks with BettercapHow To:Use VNC to Remotely Access Your Raspberry Pi from Other DevicesHow To:Map Wardriving Data with Jupyter NotebookHow To:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019How To:Lock Down Your DNS with a Pi-Hole to Avoid Trackers, Phishing Sites & MoreHow To:Log into Your Raspberry Pi Using a USB-to-TTL Serial CableHow To:Hack WPA WiFi Passwords by Cracking the WPS PINBuyer's Guide:Top 20 Hacker Holiday Gifts for Christmas 2017How To:Log Wi-Fi Probe Requests from Smartphones & Laptops with ProbemonRaspberry Pi Alternatives:10 Single-Board Computers Worthy of Hacking Projects Big & SmallHow To:Build a Portable Pen-Testing Pi BoxHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Use Kismet to Watch Wi-Fi User Activity Through WallsHow To:Wardrive on an Android Phone to Map Vulnerable NetworksHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow To:Hack WiFi Using a WPS Pixie Dust AttackHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow To:Boot Multiple Operating Systems on the Raspberry Pi with BerryBootHow To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsRaspberry Pi:Hacking Platform