From eb384d67c1e1755bdbb5eb8e62987b471ac8e45d Mon Sep 17 00:00:00 2001 From: Simone Margaritelli Date: Mon, 12 Apr 2021 14:36:27 +0200 Subject: [PATCH] misc: moved example script in dedicated repo --- _example/config.example.js | 3 -- _example/example.js | 35 ------------------ _example/functions.js | 73 -------------------------------------- _example/telegram.js | 18 ---------- 4 files changed, 129 deletions(-) delete mode 100644 _example/config.example.js delete mode 100644 _example/example.js delete mode 100644 _example/functions.js delete mode 100644 _example/telegram.js diff --git a/_example/config.example.js b/_example/config.example.js deleted file mode 100644 index 38a6a2ee..00000000 --- a/_example/config.example.js +++ /dev/null @@ -1,3 +0,0 @@ -var wifiInterface = 'put the wifi interface to put in monitor mode here'; -var telegramToken = 'put your telegram bot token here'; -var telegramChatId = 'put your telegram chat id here'; diff --git a/_example/example.js b/_example/example.js deleted file mode 100644 index 2ca86409..00000000 --- a/_example/example.js +++ /dev/null @@ -1,35 +0,0 @@ -require("config") -require("telegram") -require("functions") - -log("session script loaded, fake AP is " + fakeESSID); - -// create an empty ticker so we can run commands every few seconds -// this will inject decoy wifi client probes used to detect KARMA -// attacks and in general rogue access points -run('set ticker.commands ""') -run('set ticker.period 10') -run('ticker on') - -// enable recon and probing of new hosts on IPv4 and IPv6 -run('net.recon on'); -run('net.probe on'); - -// enable wifi scanning -run('set wifi.interface ' + wifiInterface); -run('wifi.recon on'); - -// send fake client probes every tick -onEvent('tick', onTick); - -// register for wifi.deauthentication events -onEvent('wifi.deauthentication', onDeauthentication); - -// register for wifi.client.handshake events -onEvent('wifi.client.handshake', onHandshake); - -// register for wifi.ap.new events (used to detect rogue APs) -onEvent('wifi.ap.new', onNewAP); - -// register for gateway changes -onEvent('gateway.change', onGatewayChange) \ No newline at end of file diff --git a/_example/functions.js b/_example/functions.js deleted file mode 100644 index 63e2474f..00000000 --- a/_example/functions.js +++ /dev/null @@ -1,73 +0,0 @@ -var fakeESSID = random.String(16, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'); -var fakeBSSID = random.Mac() - -function onDeauthentication(event) { - var data = event.data; - - var message = '🚨 Detected deauthentication frame:\n\n' + - // 'Time: ' + event.time + "\n" + - // 'GPS: lat=' + session.GPS.Latitude + " lon=" + session.GPS.Longitude + " updated_at=" + - //session.GPS.Updated.String() + "\n\n" + - 'RSSI: ' + data.rssi + "\n" + - 'Reason: ' + data.reason + "\n" + - 'Address1: ' + data.address1 + "\n" + - 'Address2: ' + data.address2 + "\n" + - 'Address3: ' + data.address3 + "\n" - 'AP:\n' + JSON.stringify(data.ap, null, 2); - - - // send to telegram bot - sendMessage(message); -} - -function onNewAP(event){ - var ap = event.data; - if(ap.hostname == fakeESSID) { - var message = '🦠 Detected rogue AP:\n\n' + - // 'Time: ' + event.time + "\n" + - // 'GPS: lat=' + session.GPS.Latitude + " lon=" + session.GPS.Longitude + " updated_at=" + - //session.GPS.Updated.String() + "\n\n" + - 'AP: ' + ap.mac + ' (' + ap.vendor + ')'; - - // send to telegram bot - sendMessage(message); - } -} - -function onHandshake(event){ - var data = event.data; - var what = 'handshake'; - - if(data.pmkid != null) { - what = "RSN PMKID"; - } else if(data.full) { - what += " (full)"; - } else if(data.half) { - what += " (half)"; - } - - var message = '💰 Captured ' + what + ':\n\n' + - //'Time: ' + event.time + "\n" + - //'GPS: lat=' + session.GPS.Latitude + " lon=" + session.GPS.Longitude + " updated_at=" + - //session.GPS.Updated.String() + "\n\n" + - 'Station: ' + data.station + "\n" + - 'AP: ' + data.ap; - - // send to telegram bot - sendMessage(message); -} - -function onGatewayChange(event) { - var change = event.data; - - var message = '🚨 Detected ' + change.type + ' gateway change, possible MITM attack:\n\n' + - 'Prev: ' + change.prev.ip + ' (' + change.prev.mac + ")\n" + - 'New: ' + change.new.ip + ' (' + change.new.mac + ")"; - - // send to telegram bot - sendMessage(message); -} - -function onTick(event) { - run('wifi.probe ' + fakeBSSID + ' ' + fakeESSID); -} \ No newline at end of file diff --git a/_example/telegram.js b/_example/telegram.js deleted file mode 100644 index 6838333b..00000000 --- a/_example/telegram.js +++ /dev/null @@ -1,18 +0,0 @@ -function sendMessage(message) { - log(message); - - var url = 'https://api.telegram.org/bot' + telegramToken + - '/sendMessage?chat_id=' + telegramChatId + - '&text=' + http.Encode(message); - - var resp = http.Get(url, {}); - if( resp.Error ) { - log("error while running sending telegram message: " + resp.Error.Error()); - } -} - -function sendPhoto(path) { - var url = 'https://api.telegram.org/bot' + telegramToken + '/sendPhoto'; - var cmd = 'curl -s -X POST "' + url + '" -F chat_id=' + telegramChatId + ' -F photo="@' + path + '" > /dev/null'; - run("!"+cmd); -} \ No newline at end of file