Iceloes

Scripts

2017-08-06T22:21:00.002-07:00

Build Your Amazon Alexa - Artificial Intelligence

2017-08-03T09:08:00.000-07:00

Building a DIY Amazon Echo is super easy. The entire system is obviously for DIY fans but because it’s completely open source you can build out based on the base offering. It’s a surprisingly cool piece of kit and I, for one, welcome our voice activated Raspberry Pi-powered robotic overlords.

Refrence:

https://github.com/alexa/alexa-avs-sample-app/
https://www.raspberrypi.org/blog/amazon-echo-homebrew-version/
http://lifehacker.com/how-to-build-your-own-amazon-echo-with-a-raspberry-pi-1787726931/

Video Tutorial:

This is what we made:

Make Obstacle Avoiding Robot using Arduino

2017-08-03T08:47:00.000-07:00

Tutorial On Arduino Robot

By: Utsav Sapkota

Difficulty level: Easy

CPU: Arduino uno

Input devices: Sharp GP2D12

Output devices: Plastic gear motors

Coding language: Arduino

Power: 4AA batteries, 9V PP3 battery

Need to get started with robotics ? Here's a step by step tutorial on how to make your first robot using arduino, an open source development platform.

P.S :The method used for chassis construction is just an example and a quick way for making a robot.You can use any design for the robot and also any materials for mounting the parts.Your imagination is the limit.

Now lets get started

Materials needed

1 x Arduino uno/duemilanove.

The Arduino Uno is a microcontroller board based on the ATmega328.

1 x Standard servo

Servos are basically Dc motors with position feedback that means you can tell the microcontroller through your code to move the servo to the desired position.In arduino a standard servo can be moved between 0 to 180 degree and 90 is the servo center(makes sense).Most of the hobby servos run happily between 4.8V to 6V.Supplying more than 6V may damage your servo.

Servo has three wires i.e.Brown,Red,Yellow or the color maybe Black,Red,White.

Brown or black wire is to be connected to ground of the microcontroller.

Red wire is to be connected to Vcc(4.8V to 6V).

Yellow or white wire is to be connected to the digital output of the microcontroller and is called signal wire.

1 x Breadboard

Half sized breadboard is enough for this robot

Gauge wires or male to male jumper wires

For making connections on the breadboard you will need either gauge wire or male to male jumper wires.

Your best deal would be gauge wire as it is available in local electronics/hobby shop. Male to male jumper wires are sometimes hard to find.

1 x L293D motor driver

L293D is a 16 pin chip and is a popular motor driver which can be used for small motors that have low output current.

2 X Plastic gear motors

Plastic gear motors are very lightweight,small in size and easy to mount.The motors are available in many RPM(revolutions per minute).You can buy the motor between 60 to 100 RPM for this robot.The lower the RPM ,the greater will be the torque(doesn't matter much for this robot).

2 x Wheels compatible with plastic gear motors

You will get two screws with these wheels.Those two screws are used for attaching the wheels to the plastic gear motors.

1 x Castor wheel

1 X Sharp GP2D12 analog distance sensor.

The sensor consists of two eyes.One eye sends the infrared light and the other eye sees the reflection of that infrared light and measures the distance which is then sent to the microcontroller through analog input to perform further operations based on the distance(the operations should be defined in the code).

It is possible that you may not get GP2D12 model.Another option is Sharp GP2Y0A02YK.

The only difference between both the model is the range of distance measurement.

GP2D12 measures distance from 10cm to 80 cm.

GP2Y0A02YK measures distance from 20cm to 150cm.

There is also GP2D120 (i think it is discontinued) which measure distance from 4cm to 30cm

Make sure you get a JST 3-pin connector with these sensors for easy interfacing.

There are three wires coming from the sensor.i.e.Red,Black adn White or it can be Red,Brown and Yellow.

Red is connected to 5V of arduino.

Black or brown to Ground of arduino.

White or yellow to analog input pin of arduino i.e. in this case to analog pin 0.

Batteries

Arduino itself needs 9V(recommended).So it is better to use two different battery packs.

1 x 9V PP3 battery for arduino and 4 AA batteries i.e. 6V for motors and servo.

Make sure you buy good quality batteries like Duracell or so.

1 x 4 AA Battery Holder

2 x Battery connector

One battery connector should have a DC plug at the end so that it can be directly plugged in to the dc jack of arduino.The Dc plug can be bought at any local electronics shop easily.

1 x Acrylic sheet

This acrylic sheet will be used as the robot base.It is not necessary that you have to use a acrylic sheet.You can use plywood,aluminium,etc.But try to use acrylic as it is easy to cut.Use a hack - saw to cut the acrylic plate.

I used a big acrylic sheet for the robot base because of the breadboard i.e for ease of placing parts.

1 x USB cord

The sketch(code) will be downloaded to the arduino with this USB cord from the PC.

1 x double sided tape

We wont be using any screws or nuts for mounting the components.We will just stick the components on the acrylic plate using double sided tape.

Soldering Iron

A standard soldering iron

So got all the materials ? Now lets start with the robot

First solder the wires to the motor leads.In my case,i have cut the male to male jumpers in half and soldered them to the motor leads.It helps in easy connections on the breadboard.

Now mount the wheels to the motor shaft with the help of screw that you got with the wheels.

After that mount the castor wheel on the bottom front and center(roughly) of the robot using double sided tape.The castor wheel usually comes with holes in it for easy mounting using small nuts and bolts but if you dont want to drill holes on the acrylic sheet(robot base) then you can simply stick it with double sided tape as i did.

Now place the two motors on the acrylic sheet with the help of double sided tape as shown in the below image.It would be better if you add some superglue or hotglue as the double sided tape sometimes may not be able to handle the robot weight.Another option would be to use clamps which are available on hobby webshops but again you will have to drill holes for that.I applied hot glue for mounting the motors

The distance between the front castor wheel and the rear wheels should be as less as possible.

Place a servo in the front using double sided tape.The servo should come above(roughly) the castor wheel.

The front of the robot will be where servo is.

Place arduino and breadboard on the base as shown in below image(use double sided tape).

Okay now place a 9V battery with the connector(with dc plug) and 4 AA batteries with the connector(without the dc plug) on the robot base.

The sensor will be on the servo but dont mount the sensor yet. Because before mounting the sensor on the servo,the servo should be in its center position i.e . 90

Now comes the most important part of the robot building.

Thoroughly view the circuit and make connections accordingly. After making the connections check twice or maybe thrice before powering the robot otherwise you may damage any component if there are any mistakes in the connection.

High resolution image of the circuit can be found here

The power distribution in this circuit is as follows:

The sensor and both the enable pins of L293D motor driver are powered through 5V regulated supply from the arduino board.The arduino uses 9V power and regulates it to 5V with the help of onboard voltage regulator.

The motors and servo are powered by 6V(4 AA batteries).

From the circuit:

The signal wire(white or yellow) of the sharp sensor is connected to analog pin 0 of the arduino,Vcc(red) to 5V and ground(black or brown) to ground of arduino.Color of the wires may vary.

The signal wire(white or yellow) of servo is connected to digital pin 8 of arduino,Vcc(red) to 6V and ground(black or brown) to ground of arduino.(the ground of the 6V battery pack and arduino should be combined).Color of the wires may vary.

The motors are driven by digital pins 4,5,6 and 7 and are powered by 6V.

Programming

The first thing you need to do is install arduino IDE and setup your arduino.

The arduino IDE can be downloaded from here and the step by step instructions on how to connect your arduino board to the computer can be found here

Okay, so you got your arduino board ready ? Now lets start with the programming.

Remember we didn't mount the sensor on the servo yet.First we will do that.

Make sure you have connected both the power supply as per the circuit diagram.

Open your arduino IDE and copy paste the below code and then click on upload button and then you should get a message "Done uploading".

#include <Servo.h>    // includes the servo library

Servo myservo;                                 // creates a servo object
 
void setup()
{
  myservo.attach(8);                       // attaches the servo to digital pin 8
}
void loop()
{
  myservo.write(90);                     // moves the servo to 90 degree.
  delay(700);                               // wait for the servo to finish its rotation
}

The above code will move the servo to center position i.e. 90.Now mount the sensor facing forward on the servo horn using clamp or double sided tape.

After the sensor is mounted ,you can now play with your servo by moving it left or right by using values between 0 and 180 instead of 90.

Now type in or copy paste this code.

int sensorpin = 0;                 // analog pin used to connect the sharp sensor
int val = 0;                 // variable to store the values from sensor(initially zero)

void setup()
{
  Serial.begin(9600);               // starts the serial monitor
}
 
void loop()
{
  val = analogRead(sensorpin);       // reads the value of the sharp sensor
  Serial.println(val);               // prints the value of the sensor to the serial monitor
}

This code is for the sharp analog sensor.After succesfully uploading this code open the serial monitor in arduino IDE and you will see some values changing rapidly.Yes those are the readings(can say distance) coming from the sensor.

Keep your hand or anything infront of the sensor and you see the change in the readings on the serial monitor.The analog values are in the range of 0 to 1023.

IMPORTANT : Lower the analog sensor value greater is the distance and vice versa.

Now making the motors rotate.Copy paste or type the below code in the arduino IDE.

int motor_pin1 = 4;                 //define the pins to which motor wires are connected
int motor_pin2 = 5;

void setup ()
{
  pinMode(motor_pin1,OUTPUT);            // set the motor pins as output
  pinMode(motor_pin2,OUTPUT);
}

void loop()
{
  digitalWrite(motor_pin1,HIGH);
  digitalWrite(motor_pin2,LOW);
}

This will make one of your motor turn in one direction.The direction can be forward or backward.

If it turns backward then use this code and your motor will turn forward.

int motor_pin1 = 4;             //define the pins to which motor wires are connected
int motor_pin2 = 5;

void setup ()
{
  pinMode(motor_pin1,OUTPUT);           // set the motor pins as output
  pinMode(motor_pin2,OUTPUT);
}

void loop()
{
  digitalWrite(motor_pin1,LOW);
  digitalWrite(motor_pin2,HIGH);
}

Note in this code we used LOW for motor_pin1 and HIGH for motor_pin2 i.e opposite to the previous code.

Hence the motor moves in opposite direction.

For the second motor, type or copy paste this code in the arduino IDE

int motor_pin3 = 6;                  //define the pins to which motor wires are connected
int motor_pin4 = 7;

void setup ()
{
  pinMode(motor_pin3,OUTPUT);                   // set the motor pins as output
  pinMode(motor_pin4,OUTPUT);
}

void loop()
{
  digitalWrite(motor_pin3,HIGH);
  digitalWrite(motor_pin4,LOW);
}

This will turn the second motor in one direction.It can be forward or backward.

If it is moving backwards then use the same logic as for the previous motor to move the second motor forward.

For stopping all the motors make all the motor pins LOW.

Make sure you write down the combinations for forward and backward of each motor somewhere as it will be needed in the final code.

You might have a question in your mind that how will the robot turn left or right.

Heres the answer : We will be using skid steering method for turning the robot.In this method ,the robot skids while turning and hence the name skid steering.

It goes like this

For turning the robot to left:The right motor rotates forward and the left motor rotates backwards.

For turning the robot to right:The left motor rotates forward and the right motor rotates backwards.

For moving forward: Both the motors rotates forward.

For moving backward: Both the motors rotates backward.

Completed robot! I have uploaded the video. Do watch.

And here is a simple code for avoiding obtacles. Just copy and paste this code in the arduino IDE and click on upload and your robot is ALIVE !!

#include <Servo.h>                                  //includes the servo library

int motor_pin1 = 4;
int motor_pin2 = 5;
int motor_pin3 = 6;
int motor_pin4 = 7;
int servopin = 8;
int sensorpin = 0;
int dist = 0;
int leftdist = 0;
int rightdist = 0;
int object = 500;             //distance at which the robot should look for another route                           

Servo myservo;

void setup ()
{
  pinMode(motor_pin1,OUTPUT);
  pinMode(motor_pin2,OUTPUT);
  pinMode(motor_pin3,OUTPUT);
  pinMode(motor_pin4,OUTPUT);
  myservo.attach(servopin);
  myservo.write(90);
  delay(700);
}
void loop()
{
  dist = analogRead(sensorpin);               //reads the sensor
 
  if(dist < object) {                         //if distance is less than 550
   forward();                                  //then move forward
  }
  if(dist >= object) {               //if distance is greater than or equal to 550
    findroute();
  }
}
 
void forward() {                            // use combination which works for you
   digitalWrite(motor_pin1,HIGH);
   digitalWrite(motor_pin2,LOW);
   digitalWrite(motor_pin3,HIGH);
   digitalWrite(motor_pin4,LOW);
   return;
 }
 
void findroute() {
  halt();                                             // stop
  backward();                                       //go backwards
  lookleft();                                      //go to subroutine lookleft
  lookright();                                   //go to subroutine lookright
                                      
  if ( leftdist < rightdist )
  {
    turnleft();
  }
 else
 {
   turnright ();
 }
}

void backward() {
  digitalWrite(motor_pin1,LOW);
  digitalWrite(motor_pin2,HIGH);
  digitalWrite(motor_pin3,LOW);
  digitalWrite(motor_pin4,HIGH);
  delay(500);
  halt();
  return;
}

void halt () {
  digitalWrite(motor_pin1,LOW);
  digitalWrite(motor_pin2,LOW);
  digitalWrite(motor_pin3,LOW);
  digitalWrite(motor_pin4,LOW);
  delay(500);                          //wait after stopping
  return;
}
 
void lookleft() {
  myservo.write(150);
  delay(700);                                //wait for the servo to get there
  leftdist = analogRead(sensorpin);
  myservo.write(90);
  delay(700);                                 //wait for the servo to get there
  return;
}

void lookright () {
  myservo.write(30);
  delay(700);                           //wait for the servo to get there
  rightdist = analogRead(sensorpin);
  myservo.write(90);                                  
  delay(700);                        //wait for the servo to get there
  return;
}

void turnleft () {
  digitalWrite(motor_pin1,HIGH);       //use the combination which works for you
  digitalWrite(motor_pin2,LOW);      //right motor rotates forward and left motor backward
  digitalWrite(motor_pin3,LOW);
  digitalWrite(motor_pin4,HIGH);
  delay(1000);                     // wait for the robot to make the turn
  halt();
  return;
}

void turnright () {
  digitalWrite(motor_pin1,LOW);       //use the combination which works for you
  digitalWrite(motor_pin2,HIGH);    //left motor rotates forward and right motor backward
  digitalWrite(motor_pin3,HIGH);
  digitalWrite(motor_pin4,LOW);
  delay(1000);                              // wait for the robot to make the turn
  halt();
  return;
}

Here's what this code will do.

The robot will move forward if the sensor has reading less than 500.It means that the robot will consider that it has no object in front of it if sensor reading is less than 500.You can set this as per your needs.

If the sensor gets reading greater than or equal to 500 then it will look for another way in the following steps.

First the robot will stop completely, move little backwards, again the robot stops, the servo will move left and sensor will take reading and after that the servo will move right and the sensor will again take reading.The left and right readings are compared.The robot turns towards the direction where the reading is more less(lesser the analog reading greater is the distance) and stops.Now again the same code or cycle repeats till you switch off the power supply.

Congrats you have built your first robot.

Enjoy !!

Important points to remember:

If you find that the micro-controller is resetting when the motors start rotating,connect a 10uF capacitor across the 6v power supply.The long lead of the capacitor is +ve and the short lead is -ve.
The delay used in the turnleft, turnright,halt subroutines in the code should be according to the size of your robot.Smaller the size, smaller should be the delay and greater the size ,greater should be the delay.
In this code, the left of the servo is on the degree greater than 90 and right on the degree less than 90.For you it may be opposite as it depends on how you placed the servo.Adjust the servo degrees accordingly
Always combine the ground of arduino,servo and external battery.
The distance between the front castor wheel and the rear wheels should be as less as possible.Reduce the distance if you find that your robot is not turning properly.
Remember to solder male header pins or gauge wires at the end of the component cables so that they can be easily stacked on the breadboard.
Please check the connections thoroughly before powering the robot.
Do not supply more than 6V for the plastic gear motors and servo.
The sensor should be powered with not more than 5V

if you have any problems or questions regarding this robot then please post it in the comment.

Capturing WPA Passwords by Targeting Users with a Fluxion Attack

2017-08-02T23:43:00.000-07:00

With tools such as Reaver becoming less and less viable options for penetration testers as ISPs replace vulnerable routers, there becomes fewer certainties about which tools will work against a particular target. If you don't have time to crack the WPA password, or it is unusually strong, it can be hard to figure out your next step. Luckily, nearly all systems have one common vulnerability you can count on—users!

Social engineering goes beyond hardware and attacks the most vulnerable part of any system, and one tool that makes this super easy is Fluxion. Even the most antisocial hacker can hide behind a well-crafted login page, and Fluxion automates the process of creating a fake access point to capture WPA passwords.

Picking the Weakest Links to Attack

Users are almost always the weakest link of a system, and so attacks against them are often preferred because they are cheap and effective. Hardware concerns can often be ignored if the users are sufficiently inexperienced with technology to fall for a social engineering attack. While social engineering attacks may raise flags within more tech-savvy organizations, phishing and spoofing attacks against users are the tool of first choice for both nation states and criminal hackers.

One of the most vulnerable targets to this kind of attack is a small- or medium-sized business focused on an industry other than technology. These businesses usually have many vulnerable or unpatched systems with default credentials that are easy to exploit over their wireless network, and are not likely to know what an attack looks like.

How Fluxion Works Its Magic

Fluxion is the future—a blend of technical and social engineering automation that trick a user into handing over the Wi-Fi password in a matter of keystrokes. Specifically, it's a social engineering framework using an evil twin access point (AP), integrated jamming, and handshake capture functions to ignore hardware and focus on the "wetware." Tools such as Wifiphisher execute similar attacks, but lack the ability to verify the WPA passwords supplied.

Fluxion evolved from an advanced social engineering attack named Lindset, where the original tool was written mostly in Spanish and suffered from a number of bugs. Fluxion is a rewritten attack to trick inexperienced users into divulging the password/passphrase of the network.

Fluxion is a unique tool in its use of a WPA handshake to not only control the behavior of the login page, but the behavior of the entire script. It jams the original network and creates a clone with the same name, enticing the disconnected user to join. This presents a fake login page indicating the router needs to restart or load firmware and requests the network password to proceed. Simple as that.

The tool uses a captured handshake to check the password entered and continues to jam the target AP until the correct password is entered. Fluxion uses Aircrack-ng to verify the results live as they are entered, and a successful result means the password is ours.

Checking WPA password capture confirming through Aircrack-ng.

Tactically, this attack is only as good as the fake login screen. Many have been added to Fluxion since it was created, and it is possible to create other screens with some research. In general, running this attack with default login screens will immediately call attention from a more experienced user or tech-savvy organization. This attack is most effective when targeted at whoever is the oldest or least tech-savvy in an organization. Sensitive APs with intrusion detection systems may detect and attempt to defend against this attack by blocking your IP in response to the integrated jamming.

System Compatibility & Requirements

Fluxion works on Kali Linux. Just make sure that you are fully updated, or that you're running Kali Rolling, to ensure system and dependencies are current. You may run it on your dedicated Kali install, in a virtual machine. If you're looking for a cheap, handy platform to get started on, check out our Kali Linux Raspberry Pi build using the $35 Raspberry Pi.

A perfect beginner Wi-Fi hacking kit.

This tool will not work over SSH since it relies on opening other windows.

For this to work, we'll need to use a compatible wireless network adapter. Check out our 2017 list of Kali Linux and Backtrack compatible wireless network adapters in the link above, or you can grab our most popular adapter for beginners here.

Check out list of Kali Linux compatible wireless network adapters.

Make sure that your wireless adapter capable of monitor mode is plugged in and recognized by Kali and seen when iwconfig or ifconfig is entered.

How to Capture WPA Passwords with Fluxion

Our goal in this article will be to target an organization via its WPA encrypted Wi-Fi connection. We will launch an attack against users attached to the access point "Probe," capture a handshake, set up a cloned (evil twin) AP, jam the target AP, set up a fake login page, and confirm the captured password against the handshake.

Step 1Install Fluxion

To get Fluxion running on our Kali Linux system, clone the git repository with:

git clone https://github.com/wi-fi-analyzer/fluxion

Note: The developer of Fluxion shut down the product recently, but you can get an older version of it using the command above instead (not the URL you see in the image below).

Then, let's check for missing dependencies by navigating to the folder and starting it up for the first time.

cd fluxion
sudo ./fluxion

You'll likely see the following, where some dependencies will be needed.

Run the installer to fetch dependencies and set your board to green with:

sudo ./Installer.sh

A window will open to handle installing the missing packages. Be patient and let it finish installing dependencies.

After all the dependencies are met, our board is green and we can proceed to the attack interface. Run the Fluxion command again with sudo ./fluxion to get hacking.

Step 2Scan Wi-Fi Hotspots

The first option is to select the language. Select your language by typing the number next to it and press enter to proceed to the target identification stage. Then, if the channel of the network you wish to attack is known, you may enter 2 to narrow the scan to the desired channel. Otherwise, select 1 to scan all channels and allow the scan to collect wireless data for at least 20 seconds.

A window will open while this occurs. Press CTRL+C to stop the capture process whenever you spot the wireless network that you want. It is important to let the attack run for at least 30 seconds to reasonably verify if a client is connected to the network.

Step 3Choose Your Target AP

Select a target with active clients for the attack to run on by entering the number next to it. Unless you intend to wait for a client to connect (possibly for a long time), this attack will not work on a network without any clients. Without anyone connected to the network, who would we trick into giving us the password?

Step 4Select Your Attack

Once you've typed the number of the target network, press enter to load the network profile into the attack selector. For our purpose, we will use option 1 to make a "FakeAP" using Hostapd. This will create a fake hotspot using the captured information to clone the target access point. Type 1 and press enter.

Step 5Get a Handshake

In order to verify that the password we receive is working, we will check it against a captured handshake. If we have a handshake, we can enter it at the next screen. If not, we can press enter to force the network to provide a handshake in the next step.

Using the Aircrack-ng method by selecting option 1 ("aircrack-ng"), Fluxion will send deauthentication packets to the target AP as the client and listen in on the resulting WPA handshake. When you see the handshake appear, as it does in the top right of the screenshot below, you have captured the handshake. Type 1 (for "Check handshake") and enter to load the handshake into our attack configuration.

Step 6Create the Fake Login Page

Select option 1, "Web Interface," to use the social engineering tool.

You will be presented with a menu of different fake login pages you can present to the user. These are customizable with some work, but should match the device and language. The defaults should be tested before use, as some are not very convincing.

I chose an English language Netgear attack. This is the final step to arm the attack; At this point, you are ready to fire, so press enter to launch the attack. The attack spawns multiple windows to create a cloned version of their wireless network while simultaneously jamming the normal access point, enticing the user to join the identically named, but unencrypted, network.

Step 7Capture the Password

The user is directed to a fake login page, which is either convincing or not, depending on which you chose.

Perhaps not the most elegant deception, but these files are configurable.

Entering the wrong password will fail the handshake verification, and the user is prompted to try again. Upon entering the correct password, Aircrack-ng verifies and saves the password to a text file while displaying it on the screen. The user is directed to a "thank you" screen as the jamming ceases and the fake access point shuts down.

You can verify your success by checking the readout of the Aircrack-ng screen.

Key captured and verified. The network is ours!

Congratulations, you've succeeded in obtaining and verifying a password, supplied by targeting the "wetware." We've tricked a user into entering the password rather than relying on a preexisting flaw with the security.

Warning: This Technique Could Be Illegal Without Permission

Legally, Fluxion combines scanning, cloning, creating a fake AP, creating a phishing login screen, and using the Aircrack-ng script to obtain and crack WPA handshakes. As such, it leaves signatures in router logs consistent with using these techniques. Most of these practices are illegal and unwelcome on any system you don't have permission to audit.

Set Up a Headless Raspberry Pi Hacking Platform Running Kali Linux

2017-08-02T23:16:00.000-07:00

The Raspberry Pi is a credit card-sized computer that can crack Wi-Fi, clone key cards, break into laptops, and even clone an existing Wi-Fi network to trick users into connecting to the Pi instead. It can jam Wi-Fi for blocks, track cell phones, listen in on police scanners, broadcast an FM radio signal, and apparently even fly a goddamn missile into a helicopter.

The key to this power is a massive community of developers and builders who contribute thousands of builds for the Kali Linux and Raspberry Pi platforms. For less than a tank of gas, a Raspberry Pi 3 buys you a low-cost, flexible cyberweapon.

A cyberweapon that fits anywhere? Name something else in your pocket that creates a fake AP in Czech.

Of course, it's important to compartmentalize your hacking and avoid using systems that uniquely identify you, like customized hardware. Not everyone has access to a supercomputer or gaming tower, but fortunately one is not needed to have a solid Kali Linux platform.

With over 10 million units sold, the Raspberry Pi can be purchased in cash by anyone with $35 to spare. This makes it more difficult to determine who is behind an attack launched from a Raspberry Pi, as it could just as likely be a state-sponsored attack flying under the radar or a hyperactive teenager in high school coding class.

Thinking Like an Attacker

The Raspberry Pi has several unique characteristics that make it a powerful and easily accessible tool in a penetration tester's kit. In particular, the Pi is cheap and the components cost as little as a Lego set. Also, the Raspberry Pi is discreet; It's small, thin, and easy to hide. And thanks to running Kali Linux OS natively, it is flexible and able to run a broad range of hacking tools from badge cloners to Wi-Fi cracking scripts. By swapping the SD card and adding or removing components from marketplaces like Adafruit, the Raspberry Pi can be customized to suit any situation.

Raspberry Pi + projector = Kali on a huge screen.

The Raspberry Pi on Offense

First, it's important to manage your expectations and remain reasonable when selecting a Raspberry Pi as a hacking platform. The Raspberry Pi is not a super computer and doesn't have a tremendous amount of processing power. It's not well-suited to processor intensive tasks like brute-force WPA password cracking, or acting as a network attack as the connection is too slow to fool users. That being said, the Raspberry Pi is perfectly suited to many attack environments. We simply offload these tasks to bigger computers and use the Pi as a data collector.

An active Raspberry Pi Wi-Fi jamming setup.

In my experience, the Raspberry Pi works exceptionally well as a Wi-Fi attack platform. Due to its small size and large library of Kali Linux-based attack tools, it's ideal for reconnaissance and attacking Wi-Fi networks. Our offensive Kali Linux build will be geared towards anonymous field auditing of wired and wireless networks.

The Basic Components of Our Attack System

Here are the basic components needed to build our Pi attack system, and why we need them. If you're just starting out, this excellent Raspberry Pi Kit from CanaKit includes most of what you need to get your Pi set up.

Raspberry Pi: The Raspberry Pi 3 is the platform of these builds, coordinating and controlling all other components. Its low power consumption and flexible capabilities allow it to serve as a platform for running Linux-based operating systems besides Kali.

Raspberry Pi 3.

Command and control (C2) wireless card: The purpose of the C2 wireless card is to automatically connect the Pi to the command AP (access point) such as your phone hotspot or home network. This allows remote control of the Pi discreetly or from a great distance via SSH (Secure Shell) or VNC (Virtual Network Computing). Fortunately for us, the Raspberry Pi 3 has a Wi-Fi card internally, but a wireless network adapter can also be added to a Raspberry Pi 2.
Wireless attack card:: Our attack wireless card will be a Kali Linux-compatible Wi-Fi adapter capable of packet injection. This will be our attack surface and can be a long-range, short-range, or directional antenna depending on attack requirements.

OS build cards: The micro SD card hosts the OS and brain of the computer and can be precisely configured for any desired environment. By creating customized cards, it is possible to rapidly change the configuration and function of a Raspberry Pi by simply swapping the card and components.
Computer: You will also need a computer to download the firmware to load onto the micro SD card.
Power supply: The Raspberry Pi uses a standard Micro-USB power supply, and nearly any android phone charger or battery pack will work to power a Pi. This allows for a number of different battery configurations to suit long-endurance reconnaissance or continuiously powered operations.

My Raspberry Pi hacking kit.

Ethernet cable (optional): An Ethernet cable allows you to bypass wireless authentication by directly interfacing with local networks to which you have physical access. Specialized attacks like PoisonTap can also take advantage of ethernet interfaces to infiltrate computers.
Bluetooth keyboard (optional): A Bluetooth keyboard is helpful for interfacing when you have an HDMI connection.
Case (optional): Every Pi needs a case to protect it.

Build Considerations

In designing this tutorial, I considered two primary modes in which you would be operating the Raspberry Pi. In our open configuration, the Raspberry Pi is connected to a display via HDMI cord with inputs running through a wireless mouse and keyboard. In our tactical configuration, you will use a laptop or smartphone to access the Raspberry Pi remotely via SSH. By connecting the Pi to our phone's hotspot or a nearby friendly AP, we can access the Raspberry Pi while still being able to use cellular data in the field.

(Top) Lab configuration: Output over HDMI, input via Bluetooth keyboard. (Bottom) Tactical Configuration: Kali Linux via SSH.

How to Set Everything Up

In this guide, I'll show the steps needed to set up a Raspberry Pi 3 as a basic hacking platform with Kali Linux. I'll go over how to select a build to install, writing the disc image to a micro SD card, and the steps to run after first setting up your Pi. We'll update Kali Linux to the latest version to ensure everything works correctly, change the default SSH keys, and take care of some housekeeping like changing the admin password.

Raspberry Pi in action connected to an HDMI output.

As a note, there are many ways to configure Kali on a Raspberry Pi 3. Some include touchscreens, some are completely headless (accessed via network connections without a keyboard or display), and others use the internal Wi-Fi card to create a hotspot for remote control of the Pi. In selecting this build, I discounted any designs that included a power-hungry and fragile touchscreen or additional hardware, and settled a version optimized for our two different C2 scenarios.

Step 1Download Kali Linux Image for the Raspberry Pi

Head to Offensive Security and download the latest Kali Linux image for the Raspberry Pi. As of this writing, it is "RaspberryPi 2 / 3" on version 2.1.2.

Step 2Flash the Image to the Micro SD Card

You can use a tool like ApplePiBaker for Mac or Etcher to load your Kali image onto your SD card, but sometimes these can result in errors. To prevent that, we'll cover how to do this via Terminal on a Mac. If you use Windows, you can use Win32 Disk Imager to put your image on the card.

On a Mac, before plugging in your SD card, run the following in Terminal:

df -h

This will display a list of all the disks attached to your system. Attach your SD card and run the command again, and note the filesystem name of your SD card (it's the one that wasn't there before). It should look like "/dev/disk2s1" and you should be very careful not to mix this up in the next steps, since doing so could overwrite your hard drive.

The available drives.

Now, we'll use the dd command to load the Kali image onto the card.

Use "man dd" to see the rest of the operands for dd.

First, let's unmount the partition so you can write to it with the following command, with "x" being the correct disk number:

sudo diskutil unmount /dev/diskX

Now we're ready to load Kali. Type, but don't run the command, sudo dd bs=1m if=and enter the location of the Kali Linux image we want to load onto the card. You can drag and drop the disk image into the window to show the file path. After that, type a space, then of=/dev/rdisk and the number of the disk from before.

If there is an "s" after the initial disk number (like rdisk2s1), do not include the "s" or following number. So, "rdisk2s1" should look like "rdisk2." Here's what it should look like altogether:

sudo dd bs=1m if=LocationOfKaliImage of=/dev/rdiskX

Press enter to begin the process, and note that dd does not provide any on-screen information unless there is an error or it finishes. To view the progress during the transfer, you can type Ctrl T. Wait for the process to complete. You'll know the process is complete when you see a readout of bytes transferred over the time the process ran.

It will look like the screenshot below (if you press Ctrl T a few times during the transfer) when complete.

Mashing Ctrl T to see the status—took 1,131 seconds to transfer!

Step 3Boot into Kali Linux

When finished, your SD card is ready to go! Insert the SD card into your Pi, connect it to HDMI, and attach your Bluetooth keyboard. Plug in the power source to boot into Kali Linux for the first time. To get to the desktop, your default login is "root" with "toor" being the password.

Kali Pi with power, HDMI, Ethernet, Bluetooth receiver, and secondary wireless adapter attached.

The login process is a problem for autonomous control, and we will need to disable it later. This will let us plug our Pi in and immediately connect to it remotely without a screen.

First boot of Kali.

Step 4Update Kali Linux

Kali Linux is a special flavor of Debian Linux meant for penetration testing, and a favorite here on Null Byte. It's compatible with some of the best and most advanced tools available for wireless hacking, and flexible enough to support a large number of hacking builds. It's maintained by Offensive Security, and you'll need to update it to the latest version to make sure all the tools work properly.

Before running, now is a good time to expand your installation to the size of the partition. To do so, run the following:

resize2fs /dev/mmcblk0p2

At the top right of the desktop, you'll see an option to connect to a nearby wireless network. Connect to your phone's hotspot or a friendly AP to fetch the update. Run the update by opening a terminal window and typing the following:

apt-get update
apt-get upgrade
apt-get dist-upgrade

Your Kali install is now up to date. Update the root password to something more secure than "toor" by typing:

passwd root

Then enter a new password for your Kali Linux system.

Step 5Install OpenSSH Server

To communicate with our Raspberry Pi from a computer or phone, we'll need to be able to log in. To do so, we can use SSH to connect via any Wi-Fi connection we share with the Pi. SSH, or the Secure Shell, is a network protocol that allows us to run commands remotely on a device. This means we don't need to plug in a screen to interact with our Pi.

In a terminal, run the following to install openSSH server and update the runlevels to allow SSH to start on boot:

apt-get install openssh-server
update-rc.d -f ssh remove
update-rc.d -f ssh defaults

The default keys represent a huge vulnerability since anyone can guess them. Let's change them immediately by running the following commands:

cd /etc/ssh/
mkdir insecure_old
mv ssh_host* insecure_old
dpkg-reconfigure openssh-server

This backs up the old SSH keys in another folder and generates new keys. Problem solved! Now let's make sure we can log in via root by typing:

nano /etc/ssh/sshd_config

This will open your SSH configuration folder. Change this line:

PermitRootLogin without-password

To this line instead:

PermitRootLogin yes

And type Ctrl O to save the changes. If it already is correct, you don't need to change anything.

Configuring sshd_config.

Great! Let's restart the SSH service by typing:

sudo service ssh restart
update-rc.d -f ssh enable 2 3 4 5

Finally, to test that we've got SSH working, use the following to see if SSH is currently running.

sudo service ssh status

We should see something like this if we are successful.

If it's not, run this to get it going:

sudo service ssh start

If you find SSH doesn't work, you can use raspi-config as a workaround. It's meant for Jessie, but it'll work on Kali, too. To use it, first clone from GitHub, type sudo mount /dev/mmcblk0p1 /boot to mount the boot partition, cd to the directory, and run sudo bash raspi-config.

Step 6Create a Custom MOTD

Of course, the speed and power of your hacking computer is directly related to how cool your message of the day (MOTD) banner is. You will be greeted with this upon successful login, and traditionally is used with some ASCII art to spice things up.

Create your own by typing:

Nano /etc/motd

Delete the contents and paste whatever you want to show up each time you log in.

Save and exit nano by hitting Ctrl O, then Ctrl X.

Step 7Test Login via SSH

Let's try logging in from your home computer or laptop. Connect the Pi to the same wireless network your home or work computer is on. Run the command ifconfig on your Pi in terminal to learn your IP address.

ifconfig

In the comments, some people mentioned getting an error here. If so, try running
sudo apt-get install net-tools to determine if you don't have net-tools installed. Run ifconfig again and see if it works.

Here, our IP is seen as 10.11.1.144.

On your personal computer, type:

ssh root@(your IP address)

You should see your MOTD screen!

A simple MOTD on successful SSH login.

If not, you can run an arp-scan on a Mac to see a list of all available devices on the network if you need to find your Pi's IP address from personal computer.

Step 8Configure Autologin for Headless Operation

Sometimes, we will want to be able to log into an account other than root. Let's create a new user named WHT (or whatever you like) with root permission by running:

useradd -m WHT -G sudo -s /bin/bash

Change WHT's (or whatever you named it) password to something more secure than "toor":

passwd WHT

Great! Now let's disable that login from before so we can boot directly into Kali, and our wireless cards will start up and connect to allow us remote control. To do so, type:

nano /etc/lightdm/lightdm.conf

And delete the # before these lines:

autologin-user=root
autologin-user-timeout=0

Save and exit with Ctrl X. Next, type:

nano /etc/pam.d/lightdm-autologin

And you'll need to change this starting on line 11:

# Allow access without authentication
auth required pam_succeed_if.so user != root quiet_success
auth required pam_permit.so

To this:

# Allow access without authentication
###auth required pam_succeed_if.so user != root quiet_success
auth required pam_permit.so

Save and exit, and type "reboot" into terminal to restart your Pi to test.

Test Your Build Against This Checklist

In order to be considered field ready, your device must pass this checklist:

The device starts up, logs on without prompting for a password, and starts SSH at boot allowing remote access.
The device connects to the command AP to enable remote control (does this by default after connecting the first time).
Run besside-ng script on attack antenna to test packet injection.
The Pi can be shutdown without corruption to the data on the micro SD card (boots normally after shutdown).

Pass all the requirements? Then your Raspberry Pi is ready to hit the road. I'll be writing a series of Pi-based builds, so keep up with me by building your own Raspberry Pi-based Kali Linux computer.

Using Fluxion with a Raspberry Pi and projector.

Exploit Routers on an Unrooted Android Phone

2017-08-02T23:12:00.002-07:00

RouterSploit is a powerful exploit framework similar to Metasploit, working to quickly identify and exploit common vulnerabilities in routers. And guess what. It can be run on most Android devices.

I initially covered RouterSploit on Kali Linux and macOS (OS X), but this tutorial will walk you through setting up RouterSploit to work on an unrooted Android phone. This allows you to pwn any vulnerable router you can connect your smartphone to. Doing so takes seconds and shows the power of running Debian Linux tools on the device you carry everywhere.

RouterSploit vs Routers

Routers are our gateway to the world. They route our internet traffic, encrypt our traffic to protect our privacy, and link us to other devices on our local networks and on the World Wide Web.

Most people take this wonderful device for granted, assuming once one is plugged in and providing the internet, the job of setting it up is done. Not knowing the router is actually its own Linux computer, most people simply leave the default password on the router's administrator panel or never bother logging in to install any security updates.

If this sounds like you, you should probably go change the password on your router before reading the rest of this tutorial.

Because routers are neglected, they frequently have commonly known vulnerabilities that can be exploited with the right program. RouterSploit takes advantage of the most common vulnerabilities and default settings, allowing you to quickly assess and exploit a router from any device the supports the Python script.

Debian Linux on Android

In order to run hacking tools on an Android phone, most tools require root access, which is not always easily done or safe. In order to run RouterSploit on the best available phone, an app called GNURootDebian takes the work out of setting up a Debian system, which is what Kali is, on an Android phone.

We've got RouterSploit running on an unrooted Android!

Kali helpfully ensures that the majority of our dependencies are installed, so we'll need to install a lot more dependencies on our Android version of Debian to make sure we have everything we need. This method doesn't require root or any weird permissions and can be used to run Linux Python tools from an Android phone. While packet injection isn't supported, frameworks like RouterSploit work and are very effective.

Using an Attack Framework on Android

The Android environment allows for a neat stack of wireless attack technologies to guide your tactics. Within one device, various apps will help you detect, connect to, and defeat any open AP. My "stack" of Android apps to defeat routers is as follows.

For detection and identification of wireless networks in an area, Wigle Wifi Wardriving allows you to see, log, and interact with any and all wireless networks transmitting in your area
For scanning of networks and identification of likely targets by manufacturer, IP address, and services available, Fing Network Scanner will scan the entirety of any network you are connected to and return detailed information about each connected device.
Once a device has been targeted on the network to attack, RouterSploit's Autopwn scanner will throw every available exploit at the target and see which stick, often taking less than a minute on a Samsung Galaxy phone.

Target variables are set.

Unrooted Android Burner Phones as Attack Platforms

Using powerful Linux frameworks on Android gives us another way to use something common to hack in plain sight. Even if someone knows what you're doing on your phone isn't normal, it's still a lot less suspicious than pulling out custom hardware to preform a task a generic burner Android phone can accomplish.

It is often said that the best weapon to use during a moment of opportunity is the one you know you'll have with you, and hacking tools are no exception. With the ability to quickly set up an Android phone for offensive use, GNURoot Debian allows anyone to begin auditing router security without any specialized tools. Soon, you will learn to seize control of these precious, internet-giving devices while appearing like you're still looking for Pokémon.

What You Need to Get Started

The beauty of this setup is that you just need an Android phone. I'm using a Samsung Galaxy S8 because carrying around a giant piece of curved screen glass reminds me of how fragile life is, but you can use any Android phone that supports GNURoot Debian.

Step 1Installing GNURoot Debian

To begin, we'll install GNURoot Debian, which will give us the ability to run Debian Linux on an unrooted Android device. In the Google Play Store, search for GNURoot Debian or follow this link.

You can tell he's a good time because of the goatee.

Download the app (at 60 MB, it may take a bit on a slow connection). Once the app is installed, it's time for your first run. On starting for the first time, you'll see the Debian environment being set up as a bunch of text scrolling very quickly across the screen.

More dependencies loading.

Let the setup complete for a few minutes, and you should see the following screen when installation is complete.

Debian Linux is running on Android.

Once Debian Linux is installed, it's time to start installing dependencies.

Step 2Installing Dependencies

Debian Linux on Android doesn't come with any special dependencies preinstalled like Kali, so we'll have to start from scratch on a lot of things. In particular, we'll need Python to run our desired module. First, let's update our version of Debian with the following.

apt-get update

Next, let's install some of the tools we'll need to fetch and install RouterSploit:

apt-get install sudo
sudo apt-get install git-core

This will install git and sudo, so you can fetch RouterSploit from GitHub and execute commands as sudo.

sudo apt-get install python-dev python-pip libncurses5-dev git

Step 3Installing RouterSploit

Once the dependencies are all installed, it's time to grab RouterSploit by typing the following.

git clone https://github.com/reverse-shell/routersploit

Look at all these beautiful dependencies.

Step 4Running RouterSploit for the First Time

Upon installing RouterSploit, you'll want to run it for the first time to check that it's working. Navigate to the home folder by typing the following.

cd routersploit

Then run the Python script with this:

sudo python ./rsf.py

After a few seconds to load, you should see the RouterSploit splash screen. From here, the interface is similar to Metasploit, with the primary commands being:

use (module)
set (variable)
show options (shows module options)
check (checks to see if target is vulnerable to exploit)
run (runs the exploit module against the target)

The module we'll be running is Autopwn, which we can select by typing the following.

use scanners/autopwn

This will open the Autopwn scanner to begin scanning a target.

Step 5Setting & Prosecuting a Target

With the Wigle Wifi Wardriving app installed on your Android phone, it's easy to see nearby wireless networks. As soon as you gain access to a Wi-Fi network, either an open network or by gaining the password, you'll be able to scan the network to find all devices on it with Fing or another network scanner.

Once you locate the IP address of your target, it's time to put it into Autopwn. To see the available options on any module, type the following.

show options

In this case, we'll be setting the target IP to that of the router we want to attack. To do so, enter this into the terminal:

set target IP_address_here

Here, we set the target for the Autopwn scan with the IP address of the target.

Replace IP_address_here with the IP address of the router, and hit enter. This should set the target to the router. To double check, type show options again. When you're satisfied with the result, type run and hit enter to begin the module. The module will run, presenting a list of found vulnerabilities at the end of the scan.

Here, we see a scanning run starting against a target.

Step 6Exploiting Found Vulnerabilities

When Autopwn finds a vulnerability, exploiting it couldn't be easier. After the scan is complete, type use and then copy and paste the path provided by Autopwn to the exploit. For example, running the exploits/cameras/dlink/dcs_9301_9321_auth_bypasswould be done by typing:

use exploits/cameras/dlink/dcs_9301_9321_auth_bypass

As before, we can set the target with:

set target IP_address_here

Once the target is set to our desired IP address, you can run check to verify the device is vulnerable. When you're ready to exploit, type run and the exploit module will run.

This device is vulnerable!

Warning

Even if the router is left completely undefended and is easy to pwn, that doesn't make it legal. Make sure you have permission to audit the router you're pwning, as the Autopwn scanner makes a lot of noise and may be detected by active security measures.

Wardrive on an Android Phone to Map Vulnerable Networks

2017-08-02T23:04:00.000-07:00

Tossing an old Android smartphone with a decent battery into your hacking kit can let you quickly map hundreds of vulnerable networks in your area just by walking or driving by them. The practice of wardriving uses a Wi-Fi network card and GPS receiver to stealthily discover and record the location and settings of any nearby routers, and your phone allows you to easily discover those with security issues.

Introduction to Wardriving

In 2005, hacker Albert Gonzalez and friends were wardriving along a Miami highway, looking for vulnerable WEP networks. They realized that major retailers like Bob's Stores, HomeGoods, Marshalls, T.J. Maxx, and A.J. Wright were using insecure WEP-encrypted wireless networks in their retail locations. Worse, these stores used the network to service the in-store credit card payment systems.

What happened next was one of the greatest thefts of customer credit and debit card information in history.

Albert and his accomplices cracked the passwords of WEP networks in stores owned by TJX Companies, soon pivoting into the Massachusetts-based corporate network and planting a packet sniffer. This sniffer siphoned 90 million customer credit and debit cards to a server in Ukraine, which then sold them on the darknet for around $11 million. Although it was clear that TJX was aware of the security issues around WEP network encryption, they thought it was unlikely someone would notice.

Wardriving can map networks it discovers to pinpoint vulnerable networks.

Wardriving as a concept has been around since the '90s, fueled by programs like NetStumbler. It turns out, you can do a lot with the data created from wardriving, and since then, everyone from hackers to location providers like Skyhook scan and log Wi-Fi networks worldwide.

In the early 2000s, Google got into the wardriving game and began collecting geotagged Wi-Fi data early in their Google Street View initiative. Led by engineer Marius Milner, the creator of NetStumbler, Google Street View cars began logging the Wi-Fi networks of people around the world, creating a directory of wireless networks tied to addresses and Google Maps imagery. This data also included information from networks which had been left unencrypted, causing Google a lot of legal trouble over privacy concerns and resulting in over $7 million in fees.

More recently, the US military, keen to avoid jamming of GPS (which causes drones to become confused and predictable), have been developing NAVSOP, or Navigation via Signals of Opportunity, as a way of determining your position from random nearby signals even when communication from traditional navigation systems have been cut off.

Wardriving as a Tactical Tool

In this guide, we will be using an Android adaptation of Wigle (Wireless Geographic Logging Engine), which will harvest our data and plug it into the Wigle.net database. Why search only your data when thousands of other people have already contributed?

Wigle Wifi Wardriving, a free Android app, shows the location, channel, encryption, and other important qualities of a Wi-Fi network without ever needing to connect to it.

First started in 2001, the Wigle.net website is a collective searchable database of all discovered networks that have been contributed by wardrivers over the past decade. With over 323,446,100 networks mapped to date, searching Wigle.net is a powerful way to perform a database correlation attack. You can also download your entire personal database at any time through the app, as it's stored on the Wigle.net server if you choose to upload it.

Our focus here will be on creating and linking a Wigle.net account with the Wigle Wifi Wardriving Android app (which we'll just call "Wigle Wifi" from now on) to allow us to build our own databases of wireless networks, as well as search a crowdsourced database when needed.

Because Wigle Wifi uses easily available hardware, no specialized computer is needed to conduct a detailed analysis of a target. Even an old Android phone will support the Wigle Wifi app. It's subtle and can be used with no trace, so this method can be used in any high-security location discreetly.

Like cellular triangulation, Wigle Wifi locates networks through combining multiple sightings of an access point. These sightings include precise GPS and signal strength measurements used to calculate the likely position of the router, often down to a few meters. From a signals intelligence perspective, this gives us the ability to run passive, undetectable reconnaissance against a target, and query to a massive database of geolocated APs contributed by other wardrivers to track down probe frames.

Step 1Setting Up a Wigle Account

Wigle Wifi is tightly integrated with the Wigle.net database and website. So before we even install the Wigle Wifi app, we'll want to create a Wigle.net account.

If you're on your computer, just navigate to Wigle.net in your browser and click on the "Login" button up top to show the "Register" option. In your phone's browser, after going to the website, tap on the hamburger icon, select "Login," then "Register."

Fill out the fields to create your free account. After that, remember the user name and password so you can input it into the Wigle Wifi app later. This will allow you to upload to the site and retrieve your entire database.

Step 2Installing Wigle Wifi

Wigle Wifi is available in the Google Play Store, so just visit that link to download and install it onto your Android device. You need Android 2.3 and higher, so this will literally work on any smartphone you have collecting dust around your place.

Using Wigle Wifi to find nearby networks.

Step 3Running Wigle Wifi on Android

Once you've got the app installed, open it to the main screen. Wigle Wifi is an aggressive app and will override settings to turn the Wi-Fi card on while it's running, so don't be surprised if your Wi-Fi turns on with Wigle Wifi running in the background.

After granting the app all of the required permissions, a run should start right away. If not, make sure you're on the "Network List" page (via the hamburger icon), then tap on the three-dots icon in the top right. Select "Scan On" to begin scanning through channels and collecting wireless information. This will immediately begin displaying wireless networks in the area.

The "Network List" screen with scanning off.

Keep in mind, Wigle Wifi will consume extra power while scanning and logging networks. The more often you run it in the background, though, the better location accuracy you'll get. You can go back to the same three-dot menu and select "Scan Off" when you don't need it.

Step 4Adjusting Wigle Wifi's Settings

To adjust the settings, you can access the menu by tapping the hamburger icon on the top left and selecting the "Settings" option. At the top of this menu, you can enter your Wigle.net login and password.

Here, you can also adjust the display and run options, as well as specific options like how to increase or decrease scan times in response to changes in speed. Increasing the number of scans will drain the battery faster but capture more networks if you're moving quickly.

Step 5Backing Up Your Runs from Wigle Wifi

Make sure you've entered your Wigle.net login at the top of the "Settings" menu item, then back up your data in the app by tapping the "Upload to Wigle.net" button on the Network List page. When you upload your runs, you'll always be able to view and download them later on Wigle.net.

Here, we see many runs with number of networks and other information displayed.

Step 6Using the Wigle.net Website

To easily search your entire database, as well as other contributed data, we'll open Wigle.net in a browser. You can do this on your phone's browser or your computer's browser.

There are many ways to search for information on Wigle.net. In the Wigle Wifi app, you can search for nearby networks, but on the website, you can search the entire database of contributions. The most obvious settings are under the "Search" function that appears after you log into your account.

Searching the Wigle.net database for a network.

For a more visual overview of the target, check out the "Maps" section. You can type in an address and adjust overlay filters to create a graphical map of the target with wireless data overlayed.

Lots of people wardrive, and there is a lot of information already out there.

Selecting on a network will give you more information about it. You can filter networks with the list of options on the right of the screen. Look up your address and see if your router has been logged!

Step 7Searching Local Queries in Wigle Wifi's Map

If you want to search a wardriving run on your phone rather than Wigle.net, you can do so (or watch results appear on the map live) by tapping the "Map" menu option. This will open a map of the area pinned to your current location and display nearby networks. Tapping on a network will bring up information about the manufacturer, the security used, and the channel and BSSID. Below, we see some mapped results from a local run.

Querying the local database on the Wigle Wifi app.

You can see how many networks you've collected in a run by selecting the "Dashboard" option in the menu.

Wigle Wifi lets you build your own database of networks around you.

Step 8Exporting Data from Recon Runs in Wigle Wifi

Maybe you want to work with your data directly. Navigating to the "Database" tab on the Wigle app shows the various options for exporting data from Wigle Wifi.

If you want to pull everything you've ever uploaded into one file, you can select "Import Observed." Doing this pulls from Wigle.net, so be prepared to wait a little for the download if you have a ton of networks. You can also use this tab to search network runs, although sometimes this functionality can be a little buggy.

Step 9Contributing to the Big Picture

Wigle.net works because of people contributing. If you feel like adding to the giant pool of knowledge that is Wigle.net (or you've got a competitive streak), consider adding to the community database to build a better OSINT tool for fellow wireless researchers.

There is a thriving community of wardrivers who compete to discover the most networks, and anyone can join! You can even create a team to rank up against other wardriving teams. With some users having discovered millions of new networks, competition is fierce for a place in wardriving history. Check out the "Rankings" menu item in the app.

It currently takes finding over 100,000 new (previously unknown to Wigle.net) Wi-Fi networks just to crack the top 500 users on Wigle's leaderboard, so be prepared to do some serious hunting to earn street cred in the wardriving community!

Conclusion

Whether you're wardriving for tactical network reconnaissance, to build a database of your city's Wi-Fi networks, or just to contribute to an exciting project, Wigle Wifi is a great tool to quickly learn about the wireless world around you.

Tactical wardriving, or warwalking, can give you a picture of a target's wireless infrastructure.

An Intro to Vim, the Unix Text Editor Every Hacker Should Be Familiar With

2017-08-02T22:56:00.000-07:00

As pentesters and hackers, we're going to be working with text frequently—wordlists, configuration files, etc. A lot of this we'll be doing on our own machine, where we have access to whatever editor we prefer. The rest of it will be on remote machines, where the tools for editing will be limited. If nano is installed, we have an easy-to-use terminal text editor, but it isn't very powerful.

Luckily, most systems will have either Vi or Vim installed. Vi simply stands for visual, and is a powerful, fast modal text editor that works in either insert mode (where you're typing inside the document) or normal mode (where you input commands for the session). Switching between these sessions is as easy a keystroke, so it's great for those of you who don't like taking your hands of your keyboard.

Vim, which stands for Vi IMproved, has all the features of Vi with some wonderful additions that aid in editing source code. There's also a comprehensive help system and lots of customization options available. Many systems symlink Vi to Vim, including macOS. I personally use Vim for all of my editing on remote hosts.

Image via Daniel Miessler

Vim may seem complicated and unintuitive, but don't worry—it feels that way for everyone when they're just starting out. The trick is to keep at it. The longer you use Vim, the better you will get with it—to the point where you won't even need to take your hands off the keyboard.

This guide will be very introductory. There are entire books written about Vi/Vim, but I want to make sure you know at least the basics so you can get up and operating with it.

Configuring Vim

Our first step is to configure Vim. Since we'll generally be working with code or configuration, we'll want line numbering and syntax highlighting on. Vim can be configured by editing the .vimrc file in your home directory.

Step 1Open a Terminal

Open up a terminal emulator such as iTerm and ensure you are at your home directory with the command:

pwd

The terminal should show that you are in /Users/$yourusername. If it doesn't, enter the command:

This will change directories to your home directory.

Step 2Edit the File

Your .vimrc file is where your Vim configurations are stored. As you use Vim, you will start to have more custom configuration in your .vimrc file. I keep a copy of my complex .vimrc on my GitHub, but in general, when you are using Vim on a remote host, unless you are an authorized user, you won't have a custom .vimrc so it's important to be familiar with basic behavior.

In the terminal, enter the command:

vim .vimrc

This tells Vim to open the file .vimrc. This file may not exist. In my case, I haven't configured .vimrc yet.

As you can see, this is an empty document. The "~" symbols simply indicate empty lines.

Vim starts up in command mode (aka normal mode), not insert mode. This means that keys pressed will be interpreted as commands for Vim and not data entry. In order to get out of command mode, you will need to press i on your keyboard. This enables insert mode. If you were to press a instead, Vim would move the cursor a space to the left and begin insert mode there.

On the bottom left of the screen, we can see we are in insert mode. Now we can type in our configuration. You will want the following lines in the file:

syntax on
set wrapmargin=8
set number

Syntax on enables built-in syntax highlighting for many programming languages and configuration files. Set wrapmargin=8 gives us an 8-character buffer before the end of the terminal and makes the screen more legible. Set number simply turns on line numbering.

Step 3Write Your Changes & Quit

We will now need to press the esc key in order to change Vim's mode back to command mode. The "INSERT" text at the bottom left of the screen should disappear when you are in command mode.

In order to write (w) and quit (q), we simply enter the following command, including the ":" colon character.

:wq

We now have a .vimrc file, and the next time we edit something with Vim, we will see the changes.

That looks a whole lot better.

Moving Around in Command Mode

When we're in command mode, we can move around the document quickly. The arrow keys will move around the document, as well as h, j, k, l—these keys work just like the arrow keys. If you've ever played Crawl, you will be very familiar with them.

Some additional movement keys:

e will move you forward to the end of a word
w will move you forward to the beginning of a word
b will move you backward to the beginning of a word
$ will move you to the end of a line
0 (zero) will move you the beginning of a line
G will move you to the end of a file
gg will move you to the start of a file

There are, of course, many more ways to move around a file, but these should cover most use-cases.

Searching a File

Often we will need to find strings in files, usually configuration, but it can also help with history files or anything else we maybe editing. For this, you will need to be in command mode. If you aren't sure what mode you are in, press the escape key, which will bring you back to command mode if you're not there already.

For a simple search, we use / and then the string. For example, /password. If we were at the end of the file, we would use ?, as in ?password, to search backward.
The n command will repeat the last forward search, and the N command will repeat the last backward search.

In order to search and replace, we use the :%s/search/replace/ syntax. You will need to enter the colon.

:%s/tcpdump/ls/ will search the entire file and replace every instance of tcpdump with ls.
:%s/myPrivEscalationScript/ls/c will search the entire file and replace each instance only if you confirm it.

Vim also supports regular expressions in the same way that grep does.

Saving, Quitting & Shell Escaping

Exiting Vim is always a problem for people just starting out. In order to exit, use these commands:

:w will write the file
:wq will write the file and quit
:q! will exit the editor and discard all changes
:w someFileName will write the changes to a file called someFileName

In some cases, we might want to escape to a shell to browse directory trees or look at other files. In order to execute a system command in Vim, we use the command:

:!command

This will execute whatever command we put after the bang. This can be a shell :!bash, which we can exit to return to Vim, or we could :!ls /etc to view the contents of the /etc directory.

That Should Get You Started

This article barely scratches the surface. As I stated in the introduction, Vim is a very powerful tool with entire books being dedicated to it. However, with these basic commands, you should be able to get around files, manipulate them, and exit the editor. I highly recommend picking up a copy of O'Reilly's guides below until you feel comfortable using it.

Once you become skilled with Vim, you'll be flying through those text files like they were clouds.

The 8 Best Drones to Buy in 2017

2017-08-02T22:34:00.001-07:00

Drones have literally taken off in the last few years. But when it comes to buying one, there's a lot to consider. First off, you'll have to decide what your primary needs are for it. Are you just starting out and looking for a beginners' model? Do you just want a cheap model to play around with? Or do you want to use it to take aerial pictures and video? To help you decide which drone might be best for you, read our top eight picks below (and before you use it, be sure to read about the rules and regulations on the FAA website).

Best Overall: DJI Mavic Pro

DJI’s Mavic Pro can be summed up in three words: portable and powerful. Capable of collapsing down to as small as a bottle of water, DJI Mavic Pro is a fantastic choice for quadcopter fans. A new OcuSync transmission system will offer up to 4.3 miles of range, 40 mph speed and a flight time around 27 minutes, thanks to a powerful battery. The lengthy range away from the base controller is aided by GPS and satellite to help maintain precise location control. Thanks to sensor redundancy, the inclusion of obstacle avoidance will help the Mavic Pro dodge anything that could knock it out of the sky.

Visually, the 3.27 x 7.8 x 3.27-inch Mavic Pro looks and feels different from DJI’s wildly popular existing quadcopter line and has more contour and angular shapes. It almost gives off the appeal of a stealth bomber, rather than the stark white Phantom line. Shorter legs give the Mavic Pro the appearance of landing on its belly, and the rear arms pivot downward to tuck in the underside while the front arms fold inward toward the top of the main body. Recreating the camera and three-axis gimbal system allows DJI’s designers to create such a backpack-friendly design.

Setup is a snap and, after connecting to the remote control, you can add a smartphone to act as a screen. The compact remote is as well designed as the Mavic Pro itself, with two joysticks controlling height, direction and motion. One scroll wheel on the back adjusts the camera gimbal and the other is open to programming. The camera records 4K video at 30fps or 1080p at 96fps, the latter of which can live stream to Facebook, YouTube, and Periscope at 30fps. Additionally, you can capture stills with the 12-megapixel camera.

Runner-Up, Best Overall: Best Camera: DJI Phantom 4

The Phantom 4 continues DJI’s dominance in the drone market and it's the best camera drone out there. And it comes complete with additional features and functionalities to justify its high price tag. At just over three pounds, most of the Phantom 4’s additional weight over the Phantom 3 Professional comes from the 5,350mAh battery. Both novice fliers and experts will find the Phantom 4 easy to navigate partially due to a safety system that detects obstacles ahead and stops the Phantom 4 in its tracks. It’s not foolproof, but it’s one of the many fine points that helps make this drone well worth the price of admission.

Capable of speeds of up to 45 mph, the Phantom 4 can fly four miles above sea level, but FAA regulations will cut that down to about 400 feet in an area with tight restrictions. Multiple flight modes including autonomous flying, sport mode, positioning and more allow for various capabilities, all of which are handled beautifully by the incredible controller. The 28-minute flight time and 75-minute recharge time puts the Phantom 4 among the best at this price range.

With a fixed f/2.8 aperture and 4K video capture, it’s the camera that truly stands out on this drone. Images can be captured in either JPG, RAW DNG or RAW + JPG at 12-megapixel resolution. The 4K video recording maxes out at 30fps and dropping video quality down to 1080p will add 48, 50, 60 and 120fps shooting. The gimbal does an excellent job of leveling out the camera as you’re flying around and helps avoid some of the shaking and twisting of the drone body from appearing or affecting video. If you’re grabbing 4K video, you’ll want to consider that you can fill up a 16GB memory card during the course of a single flight. Slight caveats aside, the Phantom 4 is one of the best drones available.

Best Budget: Syma X5SC

While we often look to higher price ranges for the very best in quadcopter and drone technology, there’s plenty of budget options we shouldn’t ignore. The wallet-friendly Syma X5SC offers HD video and pictures, headless mode, a sturdy frame, six to eight minutes of flight time and a 150-foot range of flight. Unfortunately, recharging the 500mAh battery takes two hours, but you have to understand that there will be trade-offs at this price point.

However, for a drone that’s just under .24 pounds, we’re not surprised that stability outdoors is a challenge. A slight burst of wind and it can take some time with the controls to bring the unit back to stability. One last disappointment is the camera, a 2mp camera leads to average photos and, while our expectations are tempered for the price, we’d love to see slightly higher quality photos. Fortunately, the X5SC is very durable and online reviews mention people crashing into doors, trees, walls, ceilings and more with nary a scratch on the unit. The good news is that, for the price, replacement parts are cheap should you ever find yourself in need of new blades or blade protectors.

Although flight time can be short, additional batteries can be purchased for under $20. Even with some shortfalls at the entry-level price, the Syma X5SC is an outstanding value and a ton of fun, earning an easy recommendation as your budget option.

Best for Beginners: Syma X5C

If you've never flown a drone before, it’s best to start small, start inexpensive and start with something great. The Syma X5C hits all three of these requirements. Praised by general technology and drone-specific sites alike, the Syma is a great way to introduce yourself to the drone world. There’s nothing here that will knock your socks off and the SYMA is just a great introductory drone.

At just 2.1 pounds, the X5C is capable of a seven-minute flight time supported by a 100-minute recharge time. That’s all fairly standard in the price range of the X5C. However, unlike some its similarly-priced competition, the X5C is capable of being flown both indoors and outdoors, thanks to a wind-resistant build. A six-axis gyro stabilization helps ensure that the X5C has maximum stability during its flight time. Equipped with a 720p HD camera and 2GB memory card, the X5C can take photos and video while in flight but we’d temper any expectations about quality since it’s just average.

The advertised range of about 50 meters is a limit we wouldn’t recommend pushing until you are truly comfortable with the controls. The 2.4GHz spread spectrum technology is designed to help avoid interference and allow for increased distance, but we’d stick close to home until you move beyond the “new out of the box” phase. Thankfully, Syma packs four spare propellers and four spare blade guards with the X5C to help repair any damage from those almost guaranteed first-timer crashes. While the battery life might be short and its built-in camera less than stellar, its overall value makes the SYMA X5C an easy recommendation for beginners.

Best Flight Time: Yuneec Typhoon H Collision Avoidance Hexacopter

Fly farther with this six rotor hexacopter from Yuneec, a compact and nimble drone that can fly for up to 25 minutes on a single battery charge. The Typhoon H is ready to fly out of the box and is a CES 2016 “Best of Class” winner, a high-end favorite of professional drone enthusiasts and first-time fliers.

In your nearly 30 minutes of flight time you can capture stunning Ultra HD 4K footage with the three-axis anti-vibration CGO3+gimbal camera, which has a 360-degree range of motion and can capture 12 megapixel still images. The camera has a wide-angle lens and you can see the footage on a seven-inch Android touchscreen in a ST16 controller.

The drone has multiple advanced safety mechanisms to protect your investment, including ultrasonic collision prevention, retractable landing gear, and five rotor fail-safe insurance. Other innovative features include Orbit Me circular path, point-of-interest focus and curve cable cam.

Best Mini: Hubsan H107C+ HD

Some good things come in small packages. Miniature drones don’t have the flash, battery life or camera quality like the rest on this list, but they are a ton of fun to fly. If you just don’t have the time, desire or cash to splurge on a more pricey model, the Hubsan H107C+ HD is the drone for you. With just seven minutes of flying time, you’ll want to maximize every second this miniature wonder is afloat (up to 150 feet), but that’s ok because it takes just 40 minutes to recharge and get back in the air.

The addition of a 720p camera means you’ll be able to capture the flight. But what truly grabbed our attention on the Hubsan were some of the additional features that aren’t usually included at this price point. Altitude hold, for example, allows for a smooth and stable flight without any additional operator movement. Partnered with the six axis gyro for increased stability, the Hubsan once again proves that it can punch well above its weight class.

Best for Intermediates: DJI Phantom 3 Professional

The DJI Phantom 3 Professional, is one of the best drones on today's market, and the 4K UHD video recording and 720p live viewing drone, make this a fan-favorite. The design is basic, weighing just under three pounds with a bottom-mounted camera and four pylons each with a rotor.

There are two pre-programmed flight controls for both beginners and advanced pilots, a fantastic inclusion given the asking price. Battery life is rated at 23 minutes, but you can expect that number to drop with heavy camera use. Connecting your smartphone or tablet will give you a 720p live stream video of everything your Phantom 3 Professional sees while in flight. Vision positioning technology will help beginners and advanced drone hobbyists properly control the flight path with assisted help from the DJI software with visual and ultrasonic sensors. This will aid anyone who wants to set a course indoors, fly low to the ground or in GPS-free areas. Charging the Phantom takes a little longer than we’d like because of a lower wattage charger, but you can jump from 15 to 20 percent charge to 100 percent in around an hour.

While FAA rules require that you keep your drone in visual sight, the Phantom is capable of flying nearly 3.1 miles from the handheld controller. The newly redesigned controller from the Phantom 2 features both power and home buttons, the latter of which allows the drone to return to its preset “home” location with just the press of a button. Two aluminum joysticks provide what is said to be some of the best-designed functionality for properly handling and flying any drone.

Best For Professionals: DJI Inspire 1 Pro

If you’re already well-versed in the drone industry, the name DJI is already at the forefront of your vocabulary, and it’s no surprise that the DJI Inspire 1 Pro is our choice for the best splurge. Coming in at 6.5 pounds and 1.5 feet wide, this drone is for serious buyers only. Attached to the drone is the Zenmuse micro four thirds sensor with DJI branded 15mm f/1.7 lens, which is 4K video and HD image capable. Needless to say, this drone comes with one of the best cameras you can buy across the drone industry.

Since it is capable of flying at more than 50mph and ascending to 15,000 feet AND flying in sub-zero temperatures, the asking price isn’t so out-of-this-world. Aside from the FAA requirements that would come with a drone capable of flying at 15,000 feet, you’ll definitely want to be cognizant of weather, take-off and landing conditions, as well as a soft place to put down in an emergency. Included with the unit is a 4500mAh battery which allows for 18 minutes of flight time. DJI offers a larger 5700mAh battery sold separately that would bring total flight time to 22 minutes.

For the price, this drone excels at professional aerial imaging and, with comprehensive app control via a downloadable application on Android and iOS, you can compose the perfect shot on the fly, pun intended. All in all, footage from the camera is gorgeous and cinematographers will rave for days about the quality of the aerial footage captured.