diff --git a/modules/wifi/wifi.go b/modules/wifi/wifi.go index 05048c3a..15b1b017 100644 --- a/modules/wifi/wifi.go +++ b/modules/wifi/wifi.go @@ -4,6 +4,7 @@ import ( "bytes" "fmt" "net" + "regexp" "strconv" "sync" "time" @@ -51,6 +52,8 @@ type WiFiModule struct { assocSkip []net.HardwareAddr assocSilent bool assocOpen bool + filterProbeSTA *regexp.Regexp + filterProbeAP *regexp.Regexp apRunning bool showManuf bool apConfig packets.Dot11ApConfig @@ -138,6 +141,33 @@ func NewWiFiModule(s *session.Session) *WiFiModule { return err })) + + mod.AddHandler(session.NewModuleHandler("wifi.client.probe.sta.filter FILTER", "wifi.client.probe.sta.filter (.+)", + "Use this regular expression on the station address to filter client probes, 'clear' to reset the filter.", + func(args []string) (err error) { + filter := args[0] + if filter == "clear" { + mod.filterProbeSTA = nil + return + } else if mod.filterProbeSTA, err = regexp.Compile(filter); err != nil { + return + } + return + })) + + mod.AddHandler(session.NewModuleHandler("wifi.client.probe.ap.filter FILTER", "wifi.client.probe.ap.filter (.+)", + "Use this regular expression on the access point name to filter client probes, 'clear' to reset the filter.", + func(args []string) (err error) { + filter := args[0] + if filter == "clear" { + mod.filterProbeAP = nil + return + } else if mod.filterProbeAP, err = regexp.Compile(filter); err != nil { + return + } + return + })) + minRSSI := session.NewIntParameter("wifi.rssi.min", "-200", "Minimum WiFi signal strength in dBm.") diff --git a/modules/wifi/wifi_recon.go b/modules/wifi/wifi_recon.go index 11aa53bd..c0c54f78 100644 --- a/modules/wifi/wifi_recon.go +++ b/modules/wifi/wifi_recon.go @@ -100,6 +100,11 @@ func (mod *WiFiModule) discoverProbes(radiotap *layers.RadioTap, dot11 *layers.D return } + clientSTA := network.NormalizeMac(dot11.Address2.String()) + if mod.filterProbeSTA != nil && !mod.filterProbeSTA.MatchString(clientSTA) { + return + } + tot := len(req.Contents) if tot < 3 { return @@ -114,11 +119,16 @@ func (mod *WiFiModule) discoverProbes(radiotap *layers.RadioTap, dot11 *layers.D return } + apSSID := string(req.Contents[2 : 2+size]) + if mod.filterProbeAP != nil && !mod.filterProbeAP.MatchString(apSSID) { + return + } + mod.Session.Events.Add("wifi.client.probe", ProbeEvent{ - FromAddr: dot11.Address2.String(), - FromVendor: network.ManufLookup(dot11.Address2.String()), - FromAlias: mod.Session.Lan.GetAlias(dot11.Address2.String()), - SSID: string(req.Contents[2 : 2+size]), + FromAddr: clientSTA, + FromVendor: network.ManufLookup(clientSTA), + FromAlias: mod.Session.Lan.GetAlias(clientSTA), + SSID: apSSID, RSSI: radiotap.DBMAntennaSignal, }) }