NETATTACK 2 is a python script that scans and attacks local and wireless networks. Everything is super easy because of the GUI that makes it unnecessary to remember commands and parameters. FUNCTIONS
SCAN-FUNCTIONS
Scan for Wi-Fi networks
Scan for local hosts in your network
ATTACK-FUNCTIONS
Deauthing ONE / MULTIPLE targets
Deauthing every AP in your area
Kicking (ALL) user/s off your internet ( ARP-Poisoning )
WiFi-Pumpkin is a very complete framework for auditing Wi-Fi security. The main feature is the ability to create a fake AP and make Man In The Middle attack, but the list of features is quite broad. Installation
Python 2.7
git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git cd WiFi-Pumpkin ./installer.sh --install
Responder an LLMNR, NBT-NS and MDNS poisoner. Author: Laurent Gaffie
Transparent Proxy
Transparent proxies(mitmproxy) that you can use to intercept and manipulate HTTP traffic modifying requests and responses, that allow to inject javascripts into the targets visited. You can easily implement a module to inject data into pages creating a python file in directory "plugins/extension/" automatically will be listed on Pumpkin-Proxy tab.
Plugins Example Dev
from mitmproxy.models import decoded # for decode content html from plugins.extension.plugin import PluginTemplate
class Nameplugin(PluginTemplate): meta = { 'Name' : 'Nameplugin', 'Version' : '1.0', 'Description' : 'Brief description of the new plugin', 'Author' : 'by dev' } def __init__(self): for key,value in self.meta.items(): self.__dict__[key] = value # if you want set arguments check refer wiki more info. self.ConfigParser = False # No require arguments
def request(self, flow): print flow.__dict__ print flow.request.__dict__ print flow.request.headers.__dict__ # request headers host = flow.request.pretty_host # get domain on the fly requests versionH = flow.request.http_version # get http version
# get redirect domains example # pretty_host takes the "Host" header of the request into account, if flow.request.pretty_host == "example.org": flow.request.host = "mitmproxy.org"
# get all request Header example self.send_output.emit("\n[{}][HTTP REQUEST HEADERS]".format(self.Name)) for name, valur in flow.request.headers.iteritems(): self.send_output.emit('{}: {}'.format(name,valur))
print flow.request.method # show method request # the model printer data self.send_output.emit('[NamePlugin]:: this is model for save data logging')
def response(self, flow): print flow.__dict__ print flow.response.__dict__ print flow.response.headers.__dict__ #convert headers for python dict print flow.response.headers['Content-Type'] # get content type
#every HTTP response before it is returned to the client with decoded(flow.response): print flow.response.content # content html flow.response.content.replace('</body>','<h1>injected</h1></body>') # replace content tag
del flow.response.headers["X-XSS-Protection"] # remove protection Header
flow.response.headers["newheader"] = "foo" # adds a new header #and the new header will be added to all responses passing through the proxy
TCP-Proxy Server A proxy that you can place between in a TCP stream. It filters the request and response streams with (scapy module) and actively modify packets of a TCP protocol that gets intercepted by WiFi-Pumpkin. this plugin uses modules to view or modify the intercepted data that possibly easiest implementation of a module, just add your custom module on "plugins/analyzers/" automatically will be listed on TCP/UDP Proxy tab.
from scapy.all import * from scapy_http import http # for layer HTTP from default import PSniffer # base plugin class
class ExamplePlugin(PSniffer): _activated = False _instance = None meta = { 'Name' : 'Example', 'Version' : '1.0', 'Description' : 'Brief description of the new plugin', 'Author' : 'your name', } def __init__(self): for key,value in self.meta.items(): self.__dict__[key] = value
@staticmethod def getInstance(): if ExamplePlugin._instance is None: ExamplePlugin._instance = ExamplePlugin() return ExamplePlugin._instance
def filterPackets(self,pkt): # (pkt) object in order to modify the data on the fly if pkt.haslayer(http.HTTPRequest): # filter only http request
http_layer = pkt.getlayer(http.HTTPRequest) # get http fields as dict type ip_layer = pkt.getlayer(IP)# get ip headers fields as dict type
print http_layer.fields['Method'] # show method http request # show all item in Header request http for item in http_layer.fields['Headers']: print('{} : {}'.format(item,http_layer.fields['Headers'][item]))
print ip_layer.fields['src'] # show source ip address print ip_layer.fields['dst'] # show destiny ip address
print http_layer # show item type dict print ip_layer # show item type dict
return self.output.emit({'name_module':'send output to tab TCP-Proxy'})
EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on providing an easy-to-use interface that can be leveraged to execute powerful wireless attacks with minimal manual configuration. To illustrate how fast this tool is, here's an example of how to setup and execute a credential stealing evil twin attack against a WPA2-TTLS network in just two commands:
Next run the kali-setup.py file as shown below to complete the eaphammer setup process. This will install dependencies and compile hostapd.
python setup.py
Other Distros If you are not using Kali, you can still compile eaphammer. I just haven't written a setup script for your distro yet, which means you'll have to do it manually. Ask yourself whether you understand the following:
python-devel vs python-dev
service vs systemctl
network-manager vs NetworkManager
httpd vs apache2
If you looked at this list and immediately realized that each pair of items was to some extent equivalent (well, except for service vs systemctl, but you catch my drift), you'll probably have no problems getting this package to work on the distro of your choice. If not, please just stick with Kali until support is added for other distros. With that out of the way, here are the generic setup instructions: Use your package manager to install each of the dependencies listed in kali-dependencies.txt. Package names can vary slightly from distro to distro, so you may get a "package not found" error or similar. If this occurs, just use Google to find out what the equivalent package is for your distro and install that instead. Once you have installed each of the dependencies listed in kali-dependencies.txt, you'll need to install some additional packages that ship with Kali by default. These packages are listed below. If you're on a distro that uses httpd instead of apache2, install that instead.
dsniff
apache2
Compile hostapd using the following commands:
cd hostapd-eaphammer make
Open config.py in the text editor of your choice and edit the following lines so that to values that work for your distro:
# change this to False if you cannot/will not use systemd use_systemd = True
# change this to 'NetworkManager' if necessary network_manager = 'network-manager'
# change this 'httpd' if necessary httpd = 'apache2'
Usage Guide
x.509 Certificate Generation Eaphammer provides an easy-to-use wizard for generating x.509 certificates. To launch eaphammer's certificate wizard, just use the command shown below.
./eaphammer --cert-wizard
Stealing RADIUS Credentials From EAP Networks To steal RADIUS credentials by executing an evil twin attack against an EAP network, use the --creds flag as shown below.
The flags shown above are self explanatory. For more granular control over the attack, you can use the --wpa flag to specify WPA vs WPA2 and the --auth flag to specify the eap type. Note that for cred reaping attacks, you should always specify an auth type manually since the the --auth flag defaults to "open" when omitted.
Please refer to the options described in Additional Options section of this document for additional details about these flags.
Stealing AD Credentials Using Hostile Portal Attacks Eaphammer can perform hostile portal attacks that can force LLMNR/NBT-NS enabled Windows clients into surrendering password hashes. The attack works by forcing associations using an evil twin attack, then forcing associated clients to attempt NetBIOS named resolution using a Redirect To SMB attack. While this occurs, eaphammer runs Responder in the background to perform a nearly instantaneous LLMNR/NBT-NS poisoning attack against the affected wireless clients. The result is an attack that causes affected devices to not only connect to the rogue access point, but send NTLM hashes to the rogue access point as well. The --hostile-portal flag can be used to execute a hostile portal attack, as shown in the examples below.
./eaphammer --interface wlan0 --essid TotallyLegit --channel 1 --auth open --hostile-portal
Performing Indirect Wireless Pivots Using Hostile Portal Attacks The hostile portal attack described in Stealing AD Credentials Using Hostile Portal Attacks can be used to perform an SMB relay attack against the affected devices. An attacker can use hostile portal attack to perform an SMB relay attack that places timed reverse shell on an authorized wireless devices. The attacker can then disengage the attack to allow the authorized device to reconnect to the targetted network. When the attacker receives the reverse shell, he or she will have the same level of authorization as the attacker.
Performing Captive Portal Attacks To perform a captive portal attack using eaphammer, use the --captive-portal flag as shown below.
This will cause eaphammer to execute an evil twin attack in which the HTTP(S) traffic of all affected wireless clients are redirected to a website you control. Eaphammer will leverage Apache2 to serve web content out of /var/www/html if used with the default Apache2 configuration. Future iterations of eaphammer will provide an integrated HTTP server and website cloner for attacks against captive portal login pages.
Additional Options
--cert-wizard - Use this flag to create a new RADIUS cert for your AP.
-h, --help - Display detailed help message and exit.
-i, --interface - Specify the a PHY interface on which to create your AP.
-e ESSID, --essid ESSID - Specify access point ESSID.
-b BSSID, --bssid BSSID - Specify access point BSSID.
--hw-mode HW-MODE - Specify access point hardware mode (default: g).
-c CHANNEL, --channel CHANNEL - Specify access point channel.
--wpa {1,2} - Specify WPA type (default: 2).
--auth {peap,ttls,open} - Specify auth type (default: open).
--creds - Harvest EAP creds using an evil twin attack.
--hostile-portal - Force clients to connect to hostile portal.
--captive-portal - Force clients to connect to a captive portal.
This is code extending the mousejack tools https://github.com/RFStorm/mousejack. Replay/transmit tools have been added to the original tools. POC packets based on a Logitech Wireless Combo MK220 which consists of a K220 wireless keyboard and an M150 wireless mouse are included in the logs folder. More details available here https://www.ckn.io/blog/2016/07/09/hijacking-wireless-mice-and-keyboards/ scanner Pseudo-promiscuous mode device discovery tool, which sweeps a list of channels and prints out decoded Enhanced Shockburst packets.
optional arguments: -h, --help show this help message and exit -c N [N ...], --channels N [N ...] RF channels -v, --verbose Enable verbose output -l, --lna Enable the LNA (for CrazyRadio PA dongles) -p PREFIX, --prefix PREFIX Promiscuous mode address prefix -d DWELL, --dwell DWELL Dwell time per channel, in milliseconds
Scan for devices on channels 1-5
./nrf24-scanner.py -c {1..5}
Scan for devices with an address starting in 0xA9 on all channels
./nrf24-scanner.py -p A9
sniffer Device following sniffer, which follows a specific nRF24 device as it hops, and prints out decoded Enhanced Shockburst packets from the device. This version has also been modified to log the packets to a log file
usage: ./nrf24-sniffer.py [-h] [-c N [N ...]] [-v] [-l] -a ADDRESS -o OUTPUT [-t TIMEOUT] [-k ACK_TIMEOUT] [-r RETRIES]
optional arguments: -h, --help show this help message and exit -c N [N ...], --channels N [N ...] RF channels -v, --verbose Enable verbose output -l, --lna Enable the LNA (for CrazyRadio PA dongles) -a ADDRESS, --address ADDRESS Address to sniff, following as it changes channels -o OUTPUT, --output OUTPUT Output file to log the packets -t TIMEOUT, --timeout TIMEOUT Channel timeout, in milliseconds -k ACK_TIMEOUT, --ack_timeout ACK_TIMEOUT ACK timeout in microseconds, accepts [250,4000], step 250 -r RETRIES, --retries RETRIES Auto retry limit, accepts [0,15]
Sniff packets from address 8C:D3:0F:3E:B4 on all channels and save them to output.log
./nrf24-sniffer.py -a 8C:D3:0F:3E:B4 -o logs/output.log
replay/transmit Replay captured packets or transmit generated ones. It follows a specific nRF24 device as it hops, and sends packets from a log file.
usage: ./nrf24-replay.py [-h] [-c N [N ...]] [-v] [-l] -a ADDRESS -i INPUT_FILE [-t TIMEOUT] [-k ACK_TIMEOUT] [-r RETRIES]
optional arguments: -h, --help show this help message and exit -c N [N ...], --channels N [N ...] RF channels -v, --verbose Enable verbose output -l, --lna Enable the LNA (for CrazyRadio PA dongles) -a ADDRESS, --address ADDRESS Address to sniff, following as it changes channels -o INPUT_FILE, --input INPUT_FILE Input file that has the packets to sned -t TIMEOUT, --timeout TIMEOUT Channel timeout, in milliseconds -k ACK_TIMEOUT, --ack_timeout ACK_TIMEOUT ACK timeout in microseconds, accepts [250,4000], step 250 -r RETRIES, --retries RETRIES Auto retry limit, accepts [0,15]
Send packets from file keystroke.log to address 8C:D3:0F:3E:B4 on hopping channel
./nrf24-replay.py -a 8C:D3:0F:3E:B4 -i logs/keystroke.log
network mapper Star network mapper, which attempts to discover the active addresses in a star network by changing the last byte in the given address, and pinging each of 256 possible addresses on each channel in the channel list.
usage: ./nrf24-network-mapper.py [-h] [-c N [N ...]] [-v] [-l] -a ADDRESS [-p PASSES] [-k ACK_TIMEOUT] [-r RETRIES]
optional arguments: -h, --help show this help message and exit -c N [N ...], --channels N [N ...] RF channels -v, --verbose Enable verbose output -l, --lna Enable the LNA (for CrazyRadio PA dongles) -a ADDRESS, --address ADDRESS Known address -p PASSES, --passes PASSES Number of passes (default 2) -k ACK_TIMEOUT, --ack_timeout ACK_TIMEOUT ACK timeout in microseconds, accepts [250,4000], step 250 -r RETRIES, --retries RETRIES Auto retry limit, accepts [0,15]
Map the star network that address 61:49:66:82:03 belongs to
./nrf24-network-mapper.py -a 61:49:66:82:03
continuous tone test The nRF24LU1+ chips include a test mechanism to transmit a continuous tone, the frequency of which can be verified if you have access to an SDR. There is the potential for frequency offsets between devices to cause unexpected behavior. For instance, one of the SparkFun breakout boards that was tested had a frequency offset of ~300kHz, which caused it to receive packets on two adjacent channels. This script will cause the transceiver to transmit a tone on the first channel that is passed in.
usage: ./nrf24-continuous-tone-test.py [-h] [-c N [N ...]] [-v] [-l]
optional arguments: -h, --help show this help message and exit -c N [N ...], --channels N [N ...] RF channels -v, --verbose Enable verbose output -l, --lna Enable the LNA (for CrazyRadio PA dongles)
Transmit a continuous tone at 2405MHz
./nrf24-continuous-tone-test.py -c 5
Packet generator script This uses a dictionary to map keyboard presses to the equivalent packets. It reads stdin input and logs the mapped packets to logs/keystrokes.log. It will accept input until Ctrl+C is pressed.
usage: ./keymapper.py
Log files The folder logs contains various pre-saved packets for various keyboard operations. Shell.log is for exploitation of a Windows machine by running a powershell one-liner which connects back to the attacker machine. The file keys.log serves as a reference where various key presses and combinations are mapped to their equivalent packets.
The netattack.py is a python script that allows you to scan your local area for WiFi Networks and perform deauthentification attacks. The effectiveness and power of this script highly depends on your wireless card. USAGE
EASY
SCANNING FOR WIFI NETWORKS
python netattack.py -scan -mon
This example will perform a WiFi network scan. The BSSID, ESSID and the Channel will be listet in a table.
-scan | --scan
This parameter must be called when you want to do a scan. It's one of the main commands. It is searching for beacon frames that are sent by routers to notify there presence.
-mon | --monitor
By calling this parameter the script automatically detects you wireless card and puts it into monitoring mode to capture the ongoing traffic. If you know the name of your wireless card and it's already working in monitoring mode you can call
This command will obviously perform a deauthentification attack.
-deauth | --deauth
This parameter is a main parameter as well as scan. It is necessary to call if you want to deauth attack a certain target.
-b | --bssid
With -b you select the AP's MAC-Address (BSSID). The -deauth parameter requires one or multiple BSSID's
-u | --client
If you don't want to attack the whole network, but a single user/client/device, you can do this with -u. It is not necessary.
-c | --channel
By adding this parameter, your deauthentification attack is going to be performed on the entered channel. The usage of -c is highly recommended since the attack will be a failure if the wrong channel is used. The channel of the AP can be seen by doing a WiFi scan (-scan). If you don't add -c the attack will take place on the current channel. The -mon or -i is necessary for this attack as well.
DEAUTHENTIFICATION ATTACK ON EVERYBODY
python netattack.py -deauthall -i [IFACE]
When this command is called, the script automatically searches for AP in your area. After the search it start deauth-attacking all of the found AP's. The -deauthall parameter only needs an interface to get it working. ATTENTION: If you want all of this attacks to be as efficient as possible, have a look at the following "ADVANCED"-section
ADVANCED
-p | --packetburst
This parameter is understood as the packetburst. Especially when you are targeting multiple AP's or even performing a -deauthall attack, the command is a must have. It defines the amount of deauth-packages to send after switching the target. When not adding the parameter it is going to be set to 64 by default. But that is highly unefficient if you are attacking 4+ AP's.
-t | --timeout
This parameter can be added to a -scan or -deauth. If it's added to the -scan parameter it defines the delay while switching the channel. It is set to 0.75s by default, so it is waiting 0.75s on each channel to collect beacon frames. If it's added to the -deauth parameter, it defines the delay between each packetburst. This can be used to decrease the intense of the attack or to attack the target(s) at a certain time.
-cf | --channelformat
This parameter can only be added to -scan. It shows a more detailed output while scanning. It's mainly recommended when the location changes and with it the AP's.
-a | --amount
This parameter can only be added to -deauth. It defines a certain amount of packetbursts to send. This can be used for taking down the WiFi for a certain time.
REQUIREMENTS
Python 2.5+ (not Python 3+)
Modules:
scapy
argparse
sys
OS
threading
logging
iw(config)
OFC LINUX
DISCLAIMER AND LICENSE THE OWNER AND PRODUCER OF THIS SOFTWARE IS NOT LIABLE FOR ANY DAMAGE OR ANY LAW VIOLATIONS CAUSED BY THE SOFTWARE.
The SySS Radio Hack Box is a proof-of-concept software tool to demonstrate the replay and keystroke injection vulnerabilities of the wireless keyboard Cherry B.Unlimited AES.
Requirements
Raspberry Pi
Raspberry Pi Radio Hack Box shield (a LCD, some LEDs, and some buttons)
nRF24LU1+ USB radio dongle with flashed nrf-research-firmware by the Bastille Threat Research Team, e. g.
Automatic startup For automatically starting the Radio Hack Box process on the Raspberry Pi after a reboot, either use the provided init.d script or the following crontab entry:
Usage The Radio Hack Box currently has four simple push buttons for
start/stop recording
start playback (replay attack)
start attack (keystroke injection attack)
start scanning
A graceful shutdown of the Radio Hack Box without corrupting the file system can be performed by pressing the SCAN button directly followed by the RECORD button.
Demo Video A demo video illustrating replay and keystroke injection attacks against an AES encrypted wireless keyboard using the SySS Radio Hack Box a.k.a. Cherry Picker is available on YouTube:
Pi Radio Hack Box Shield The hand-crafted Pi shield simply consists of an LCD, some LEDs, some buttons, resistors, and wires soldered to a perfboard.
RogueSploit is an open source automated script made to create a Fake Acces Point, with dhcpd server, dns spoofing, host redirection, browser_autopwn1 or autopwn2 or beef+mitmf.
Wifiphisher is a security tool that mounts fast automated phishing attacks against WiFi networks in order to obtain secret passphrases and other credentials. It is a social engineering attack that unlike other methods it does not include any brute forcing. It is an easy way for obtaining credentials from captive portals and third party login pages or WPA/WPA2 secret passphrases. Wifiphisher works on Kali Linux and is licensed under the MIT license.
From the victim's perspective, the attack makes use in three phases:
Victim is being deauthenticated from her access point. Wifiphisher continuously jams all of the target access point's wifi devices within range by sending deauth packets to the client from the access point, to the access point from the client, and to the broadcast address as well.
Victim joins a rogue access point. Wifiphisher sniffs the area and copies the target access point's settings. It then creates a rogue wireless access point that is modeled on the target. It also sets up a NAT/DHCP server and forwards the right ports. Consequently, because of the jamming, clients will start connecting to the rogue access point. After this phase, the victim is MiTMed.
Victim is being served a realistic router config-looking page. wifiphisher employs a minimal web server that responds to HTTP & HTTPS requests. As soon as the victim requests a page from the Internet, wifiphisher will respond with a realistic fake page that asks for credentials, for example one that asks WPA password confirmation due to a router firmware upgrade.
Usage
Short form
Long form
Explanation
-m
maximum
Choose the maximum number of clients to deauth. List of clients will be emptied and repopulated after hitting the limit. Example: -m 5
-n
noupdate
Do not clear the deauth list when the maximum (-m) number of client/AP combos is reached. Must be used in conjunction with -m. Example: -m 10 -n
-t
timeinterval
Choose the time interval between packets being sent. Default is as fast as possible. If you see scapy errors like 'no buffer space' try: -t .00001
-p
packets
Choose the number of packets to send in each deauth burst. Default value is 1; 1 packet to the client and 1 packet to the AP. Send 2 deauth packets to the client and 2 deauth packets to the AP: -p 2
-d
directedonly
Skip the deauthentication packets to the broadcast address of the access points and only send them to client/AP pairs
-a
accesspoint
Enter the MAC address of a specific access point to target
-jI
jamminginterface
Choose the interface for jamming. By default script will find the most powerful interface and starts monitor mode on it.
-aI
apinterface
Choose the interface for the fake AP. By default script will find the second most powerful interface and starts monitor mode on it.
Screenshots
Targeting an access point
A successful attack
Fake router configuration page
Requirements
Kali Linux.
Two wireless network interfaces, one capable of injection.
WirelessNetView is a small utility that runs in the background, and monitor the activity of wireless networks around you. For each detected network, it displays the following information: SSID, Last Signal Quality, Average Signal Quality, Detection Counter, Authentication Algorithm, Cipher Algorithm, MAC Address, RSSI, Channel Frequency, Channel Number, and more. Command-Line Options
/stext <Filename>
Save the list of wireless networks into a regular text file.
/stab <Filename>
Save the list of wireless networks into a tab-delimited text file.
/scomma <Filename>
Save the list of wireless networks into a comma-delimited text file (csv).
/stabular <Filename>
Save the list of wireless networks into a tabular text file.
/shtml <Filename>
Save the list of wireless networks into HTML file (Horizontal).
/sverhtml <Filename>
Save the list of wireless networks into HTML file (Vertical).
/sxml <Filename>
Save the list of wireless networks into XML file.
/sort <column>
This command-line option can be used with other save options for sorting by the desired column. If you don't specify this option, the list is sorted according to the last sort that you made from the user interface. The <column> parameter can specify the column index (0 for the first column, 1 for the second column, and so on) or the name of the column, like "SSID" and "Last Signal". You can specify the '~' prefix character (e.g: "~SSID") if you want to sort in descending order. You can put multiple /sort in the command-line if you want to sort by multiple columns. Examples: WirelessNetView.exe /shtml "f:\temp\wireless.html" /sort 2 /sort ~1 WirelessNetView.exe /shtml "f:\temp\wireless.html" /sort "~Security Enabled" /sort "SSID"
/nosort
When you specify this command-line option, the list will be saved without any sorting.
Acrylic WiFi Professional is the best WiFi analyzer software to identify access points and wifi channels, and to analyze and resolve incidences on 802.11a/b/g/n/ac wireless networks in real time.
It is a perfect tool for advanced users and professional WiFi network analysts and administrators to control their office wireless network performance and who is connected to it, identify access point data transmission speeds, andD optimize their company’s WiFi network channels.
Access WiFi network detailed information, including hidden wireless networks, and make the most of unique features such as monitor mode to capture and analyze all wireless device traffic, device viewer, equipment inventory, and WiFi speed analysis.
WiFi analyzer software features
Resolve incidences and verify the good performance of your wireless networks with a unique set of functionalities not available in any other software today.
802.11 Version: Detect WiFi access points and clients type
(802.11a/b/g/n/ac) and update obsolete devices that lower your WiFi speed.
Supported Speeds: Information on maximum data transmission rate supported
by access points and WiFi clients, and a complete list of supported data transmission rates through deep network packet inspection to ensure a fast and efficient data transmission.
Packet Retry Rate: Statistics on packets retried
by access points and WiFi devices to help identify data transmission and network coverage issues.
Device Information: Performance and behavior details
on all WiFi devices in range.
Inventory: Assign WiFi device names
by replacing the MAC field with a description for easier network analysis.
Hardware: Acrylic WiFi analyzer software works with any WiFi device thanks to its Windows API, and supports monitor mode
to visualize all devices and packages with Airpcap cards and with compatible WiFi hardware.
Detailed View: Get device model information and capabilities on device detailed view.
WiFi reports: Export WiFi data and create WiFi reports
DA-WIN is the end of the manual PCI wireless scan DA-WIN provides an organisation a continuous wireless scanning capability that is light touch and simple. It utilises compact and discreet sensors that can easily be deployed reducing the total cost of protection and simplifying the effort required for absolute, categoric regulatory compliance.
BYOD - Bring Your Own Disaster
Marketing directors everywhere need to be able to swager (see urban dictionary not a spelling mistake - aka swagger) into the office. They NEED to be able to use an I-P-PAD-POD-PONE with teeniest screen to do their job.
DO THEY REALLY need to introduce that POX, VIRUS and MALWARE infected digital equivalent of TYPHOID Mary on to your network
DA-WIN provides an organisation a continuous wireless scanning capability that is light touch and simple. It replaces the network surveillance that head of risk made you take out after the last gartner conference
What is DA-WIN
DA- WIN (pronounced DARWIN) is the evolution of wireless security scanning. Developed by a team that had a significant impact on the field of 802.11 security, it embraces the true-ism that most organisations don't like or embrace network IDS technology and so are unlikely to welcome, invest in or support an IDS implementation in a more specialised area like Wfi.
Scanning is a costly, regulatory requirement for many - Yet it often provides little security protection because it only measures the threat on 4 or 5 days a year. How many CIOs would be happy with a firewall or anti-virus that worked for 1 week in 52?
How we solved the problem
Purpose built, designed from the ground up, Wireless IDS are expensive and require an organisation that is committed to the significant investment that is required to gain a security return. Other offering based on repurposed PC or Network equipment can only be deployed in too sparse numbers because of their size and cost to yield real benefits. Mostly these are network sniffers bundled together with adhoc scripts which often results in a significant manual overhead in interpreting the output. DA-WIN is different because:
The software it uses has been purposefully designed for the task, it has been designed with regulations such as PC-DSS and Government Standards (332/5) in mind � by personnel that helped set the baseline.
The hardware is custom assembled - it is compact, cost effective which allows for easy and trouble free volume deployment.
Supports Attack detection, Flood detection, brute forcing detection and a myriad of rogue access point detection techniques.
The typical organisation will claw back its expenditure on manual wireless scanning within 18 months.
Wireless Network Watcher is a small utility that scans your wireless network and displays the list of all computers and devices that are currently connected to your network.
For every computer or device that is connected to your network, the following information is displayed: IP address, MAC address, the company that manufactured the network card, and optionally the computer name.
You can also export the connected devices list into html/xml/csv/text file, or copy the list to the clipboard and then paste into Excel or other spreadsheet application.
Using Wireless Network Watcher
Wireless Network Watcher doesn't require any installation process or additional dll files. In order to start using it, simply extract the executable file (WNetWatcher.exe) from the zip file, and run it.
If you want, you can also download WNetWatcher with full install/uninstall support (wnetwatcher_setup.exe), so a shortcut for running WNetWatcher will be automatically added into your start menu.
After running WNetWatcher, it automatically locates your wireless adapter, and scans your network. After a few seconds, you should start see the list of computers that are currently connected to your network.
If from some reason, WNetWatcher failed to locate and scan your network, you can try to manually choosing the correct network adapter, by pressing F9 (Advanced Options) and choosing the right network adapter.
Columns Description
IP Address: IP Address of the device or computer.
Device Name: The name of the device or computer. This field may remain empty if the computer or the device doesn't provide its name.
MAC Address: The MAC address of the network adapter.
Network Adapter Company:The company that manufactured the network adapter, according to the MAC Address. This column can help you to detect the type of the device or computer. For example, if the company name is Apple, the device is probably a Mac computer, iPhone, or iPad.
if the company name is Nokia, the device is probably a cellular phone of Nokia.
By default, this utility uses an internal MAC addresses database stored inside the .exe file, but it's not always updated with the latest MAC address assignments.
You can manually download the latest MAC addresses file from http://standards.ieee.org/develop/regauth/oui/oui.txtand then put oui.txt in the same folder where WNetWatcher.exe is located. When you run WNetWatcher.exe, it'll automatically load and use the external oui.txt instead of the internal MAC addresses database.
Device Information:This column displays 'Your Computer' if the device is the computer that you currently use. This column displays 'Your Router' if the device is the wireless router.
User Text:You can assign your own text to any device detected by WNetWatcher. By default, this field is filled with the device name. In order to change the User Text, simply double-click the item and type the desired text.
Active:Specifies whether this device is currently active. When a device is not detected anymore, the 'Active' value is turned from 'Yes' to 'No'
Background Scan
Starting from version 1.15, there is a new option under the Options menu - 'Background Scan'.
When it's turned on, Wireless Network Watcher first make the regular fast network scan to discover all current connected devices. After that, a continuous background scan is activated to discover when new devices are connected to your network. The background scan is slower and less intensive then the regular scan, so it won't overload your computer and you can leave it to run in the background while using other programs.
When the background scan is running, a counter of the scan process is displayed in the second section of the bottom status bar.
When the background scan is used, you can use the 'Beep On New Device' option to get a beep sound when a new device is detected.
Command-Line Options
/cfg <Filename>
Start Wireless Network Watcher with the specified configuration file. For example: WNetWatcher.exe /cfg "c:\config\wnw.cfg" WNetWatcher.exe /cfg "%AppData%\WNetWatcher.cfg"
/stext <Filename>
Scan your network, and save the network devices list into a regular text file.
/stab <Filename>
Scan your network, and save the network devices list into a tab-delimited text file.
/scomma <Filename>
Scan your network, and save the network devices list into a comma-delimited text file (csv).
/stabular <Filename>
Scan your network, and save the network devices list into a tabular text file.
/shtml <Filename>
Scan your network, and save the network devices list into HTML file (Horizontal).
/sverhtml <Filename>
Scan your network, and save the network devices list into HTML file (Vertical).
/sxml <Filename>
Scan your network, and save the network devices list into XML file.
LinSSID is graphically and functionally similar to Inssider (Microsoft™ Windows®). It is written in C++ using Linux wireless tools, Qt5, and Qwt 6.1.
LinSSID may be installed either by downloading source or binary from this site, or if you're using Debian/Ubuntu or one of its brethren, adding a ppa to your software sources and then installing it with your favorite application manager. The ppa is:
(substitute 'precise', 'quantal', 'raring', 'saucy', 'trusty' or 'utopic' for 'myversion')
Builds are available for amd64 and i386. Please report problems on the 'discussion' tab.
Version 2.2 and above now built on Qt5 using version 6.1 of the Qwt library, based on a 'trusty' development environment. Several small bugs have been fixed and there is now a status message in the top panel.
LinSSID is not bug-free. If you find one please report it on the discussion page and let's fix it.
New Acrylic WiFi software update. WiFi software for network analysis has gone through many changes since the first free version and finally reaches version v2.0 with more power than ever and long awaited features for network and channel analysis under Windows and with any wireless card.
Acrylic WiFi Free and Professional WiFi software news:
The main improvements of the new Acrylic WiFi software release are as follows:
Acrylic Free WiFi program incorporates information about the maximum speeds supported by the WiFi access point.
Fixed install and uninstall issues with NDIS capture driver under x64
Enhanced NDIS driver to avoid packet loss under heavy network capture with monitor mode.
Enhanced Wireshark integration for better performance and fixed radiotap header issues
Fixed compatibility with Windows Vista.
Added additional Visual studio dependencies.
Fixed issues when requesting trial licenses for Acrylic WiFi professional.
New exception handler module to detect Acrylic bugs.
Execute Acrylic as user: Acrylic can be installed and executed as user, without administrator rights. Note that without admin privileges monitor mode won’t be available
Added additional software tooltips.
Added social network buttons to share information about Acrylic WiFi software with all your friends and followers :).
Improved graphical interface and usability.
Acrylic WiFi Free starts with data capture automatically once the program is executed.
Wireless Network Watcher is a small utility that scans your wireless network and displays the list of all computers and devices that are currently connected to your network.
For every computer or device that is connected to your network, the following information is displayed: IP address, MAC address, the company that manufactured the network card, and optionally the computer name.
You can also export the connected devices list into html/xml/csv/text file, or copy the list to the clipboard and then paste into Excel or other spreadsheet application.
WifiInfoView scans the wireless networks in your area and displays extensive information about them, including: Network Name (SSID), MAC Address, PHY Type (802.11g or 802.11n), RSSI, Signal Quality, Frequency, Channel Number, Maximum Speed, Company Name, Router Model and Router Name (Only for routers that provides this information), and more...
When you select a wireless network in the upper pane of this tool, the lower pane displays the Wi-Fi information elements received from this device, in hexadecimal format.
WifiInfoView also has a summary mode, which displays a summary of all detected wireless networks, grouped by channel number, company that manufactured the router, PHY type, or the maximum speed.
