pax_global_header 0000666 0000000 0000000 00000000064 13503700217 0014510 g ustar 00root root 0000000 0000000 52 comment=992cd9e9eb225bc74d253a4d16c29a83899bde2e
hcxdumptool-5.1.7/ 0000775 0000000 0000000 00000000000 13503700217 0014070 5 ustar 00root root 0000000 0000000 hcxdumptool-5.1.7/.gitignore 0000664 0000000 0000000 00000000025 13503700217 0016055 0 ustar 00root root 0000000 0000000 hcxdumptool
hcxpioff
hcxdumptool-5.1.7/.gitmodules 0000664 0000000 0000000 00000000173 13503700217 0016246 0 ustar 00root root 0000000 0000000 [submodule "include/android-ifaddrs"]
path = include/android-ifaddrs
url = https://github.com/morristech/android-ifaddrs
hcxdumptool-5.1.7/Android.mk 0000664 0000000 0000000 00000000331 13503700217 0015776 0 ustar 00root root 0000000 0000000 LOCAL_PATH:=$(call my-dir)
HCX_CFLAGS:=-std=gnu99 -O3 -Wall -Wextra
include $(CLEAR_VARS)
LOCAL_MODULE := hcxdumptool
LOCAL_CFLAGS += $(HCX_CFLAGS)
LOCAL_SRC_FILES := hcxdumptool.c
include $(BUILD_EXECUTABLE)
hcxdumptool-5.1.7/AndroidManifest.xml 0000664 0000000 0000000 00000000241 13503700217 0017656 0 ustar 00root root 0000000 0000000
hcxdumptool-5.1.7/Makefile 0000664 0000000 0000000 00000001757 13503700217 0015542 0 ustar 00root root 0000000 0000000 PREFIX ?=/usr/local
INSTALLDIR = $(DESTDIR)$(PREFIX)/bin
HOSTOS := $(shell uname -s)
GPIOSUPPORT=off
CC ?= gcc
CFLAGS ?= -O3 -Wall -Wextra
CFLAGS += -std=gnu99
INSTFLAGS = -m 0755
ifeq ($(HOSTOS), Linux)
INSTFLAGS += -D
endif
all: build
build:
ifeq ($(HOSTOS), Linux)
$(CC) $(CFLAGS) $(CPPFLAGS) -o hcxpioff hcxpioff.c $(LDFLAGS)
$(CC) $(CFLAGS) $(CPPFLAGS) -o hcxdumptool hcxdumptool.c $(LDFLAGS)
else
$(info OS not supported)
endif
install: build
ifeq ($(HOSTOS), Linux)
install $(INSTFLAGS) hcxpioff $(INSTALLDIR)/hcxpioff
install $(INSTFLAGS) hcxdumptool $(INSTALLDIR)/hcxdumptool
else
$(info OS not supported)
endif
ifeq ($(HOSTOS), Linux)
rm -f hcxpioff
rm -f hcxdumptool
else
$(info OS not supported)
endif
rm -f *.o *~
clean:
ifeq ($(HOSTOS), Linux)
rm -f hcxpioff
rm -f hcxdumptool
else
$(info OS not supported)
endif
rm -f *.o *~
uninstall:
ifeq ($(HOSTOS), Linux)
rm -f $(INSTALLDIR)/hcxpioff
rm -f $(INSTALLDIR)/hcxdumptool
else
$(info OS not supported)
endif
hcxdumptool-5.1.7/README.md 0000664 0000000 0000000 00000016545 13503700217 0015362 0 ustar 00root root 0000000 0000000 hcxdumptool
==============
Small tool to capture packets from wlan devices.
After capturing, upload the "uncleaned" cap here (https://wpa-sec.stanev.org/?submit)
to see if your ap or the client is vulnerable by using common wordlists.
Convert the cap to hccapx and/or to WPA-PMKID-PBKDF2 hashline (16800) with hcxpcaptool (hcxtools)
and check if wlan-key or plainmasterkey was transmitted unencrypted.
Brief description
--------------
Stand-alone binaries - designed to run on Raspberry Pi's with installed Arch Linux.
It may work on other Linux systems (notebooks, desktops) and distributions, too.
Detailed description
--------------
| Tool | Description |
| -------------- | ------------------------------------------------------------------------------------------------------ |
| hcxdumptool | Tool to run several tests to determine if access points or clients are vulnerable |
| hcxpioff | Turns Raspberry Pi off via GPIO switch |
Compile
--------------
Simply run:
```
make
make install (as super user)
```
Compile for Android
--------------
You need:
* Android NDK installed in your system and in path variable
* This repository cloned with all submodules (`--recursive` flag in `git clone` or `git submodules update` command run)
Just run `ndk-build` - built executables for some architectures should be created inside `libs` directory.
Copy it to your phone and enjoy.
Requirements
--------------
* Operatingsystem: Arch Linux (strict), Kernel >= 4.19 (strict). It may work on other Linux systems (notebooks, desktops) and distributions, too (no support for other distributions, no support for other operating systems). Don't use Kernel 4.4 (rt2x00 driver regression)
* Chipset must be able to run in monitor mode and driver must support monitor mode (strict by: ip and iw). Recommended: MEDIATEK (MT7601) or RALINK (RT2870, RT3070, RT5370) chipset
* Raspberry Pi A, B, A+, B+, Zero (WH). (Recommended: Zero (WH) or A+, because of a very low power consumption), but notebooks and desktops may work, too.
* GPIO hardware mod recommended (push button and LED).
Adapters
--------------
hcxdumptool need full (monitor mode and full packet injection running all packet types) and exclusive access to the adapter! Otherwise it will not start!
Get information about VENDOR, model, chipset and driver here: https://wikidevi.com
Manufacturers do change chipsets without changing model numbers. Sometimes they add (v)ersion or (rev)vision.
This list is for information purposes only and should not be regarded as a binding presentation of the products:
| VENDOR MODEL | ID |
| -------------------- | -------------------------------------------------------------------- |
| EDIMAX EW-7711UAN | ID 7392:7710 Edimax Technology Co., Ltd |
| ALLNET ALL-WA0150N | ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter |
| TENDA W311U+ | ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter |
| TP-LINK TL-WN722N v1 | ID 0cf3:9271 Qualcomm Atheros Communications AR9271 802.11n |
| ALFA AWUS036H | ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter |
Always verify the actual chipset with 'lsusb' and/or 'lspci'!
Due to a bug in xhci subsystem other devices may not work at the moment: https://bugzilla.kernel.org/show_bug.cgi?id=202541
No support for a third party driver which is not part of the official kernel (https://www.kernel.org/)
No support for a driver which doesn't support monitor and packet injection, native - if you need this features, do a request on www.kernel.org
Antennas
--------------
The best high frequency amplifier is a good antenna!
| VENDOR MODEL | TYPE |
| ---------------------- | --------------- |
| LOGILINK WL0097 | grid parabolic |
| TP-LINK TL-ANT2414 A/B | panel |
| LevelOne WAN-1112 | panel |
| DELOCK 88806 | panel |
| TP-LINK TL-ANT2409 A | panel |
Useful scripts
--------------
| Script | Description |
| ------------ | -------------------------------------------------------- |
| bash_profile | Autostart for Raspberry Pi (copy to /root/.bash_profile) |
| pireadcard | Back up a Pi SD card |
| piwritecard | Restore a Pi SD card |
| makemonnb | Example script to activate monitor mode |
| killmonnb | Example script to deactivate monitor mode |
Hardware mod - see docs gpiowait.odg (hcxdumptool)
--------------
LED flashes 5 times if hcxdumptool successfully started
LED flashes every 5 seconds if everything is fine and signals are received
LED turns on, if no signal received during the last past 5 seconds
Press push button at least > 5 seconds until LED turns on (also LED turns on if hcxdumptool terminates)
Green ACT LED flashes 10 times
Raspberry Pi turned off and can be disconnected from power supply
Do not use hcxdumptool and hcxpioff together!
Hardware mod - see docs gpiowait.odg
--------------
LED flashes every 5 seconds 2 times if hcxpioff successfully started
Press push button at least > 5 seconds until LED turns on
Green ACT LED flashes 10 times
Raspberry Pi turned off safely and can be disconnected from power supply
Do not use hcxdumptool or hcxpioff together!
Warning
--------------
You must use hcxdumptool only on networks you have permission to do this, because:
* hcxdumptool is able to prevent complete wlan traffic
(depends on selected options)
* hcxdumptool is able to capture PMKIDs from access points (only one single PMKID from an access point required)
(use hcxpcaptool to save them to file)
* hcxdumptool is able to capture handshakes from not connected clients (only one single M2 from the client is required)
(use hcxpcaptool to save them to file)
* hcxdumptool is able to capture handshakes from 5GHz clients on 2.4GHz (only one single M2 from the client is required)
(use hcxpcaptool to save them to file)
* hcxdumptool is able to capture passwords from the wlan traffic
(use hcxpcaptool -E to save them to file, together with networknames)
* hcxdumptool is able to capture plainmasterkeys from the wlan traffic
(use hcxpcaptool -P to save them to file)
* hcxdumptool is able to request and capture extended EAPOL (RADIUS, GSM-SIM, WPS)
(hcxpcaptool will show you information about them)
* hcxdumptool is able to capture identities from the wlan traffic
(for example: request IMSI numbers from mobile phones - use hcxpcaptool -I to save them to file)
* hcxdumptool is able to capture usernames from the wlan traffic
(for example: user name of a server authentication - use hcxpcaptool -U to save them to file)
* Do not use a logical interface and leave the physical interface in managed mode
* Do not use hcxdumptool in combination with aircrack-ng, reaver, bully or other tools which takes access to the interface
* Stop all services which takes access to the physical interface (NetworkManager, wpa_supplicant,...)
* Do not use tools like macchanger, as they are useless, because hcxdumptool uses its own random mac address space
hcxdumptool-5.1.7/changelog 0000664 0000000 0000000 00000074176 13503700217 0015761 0 ustar 00root root 0000000 0000000 23.06.2019
==========
moved to v 5.1.7
hcxdumptool: improved help
fixed pcpng option header
12.06.2019
==========
hcxdumptool: ignore more warnings if --ignore_warning is selcted
do not report issues if you run this option!!!
29.05.2019
==========
hcxdumptool moved to v 5.1.5
19.05.2019
==========
hcxdumptool: activated option --ignore warning
--ignore_warning : ignore warnings
try this if you get some driver warnings
do not report issues
16.04.2019
==========
updated wiki device and README.md.
This adapters are working fine, running kernel 4.19, 4.20 and 5.0:
EDIMAX EW-7711UAN ID 7392:7710 Edimax Technology Co., Ltd
ALLNET ALL-WA0150N ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter
TENDA W311U+ ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
LogiLink WL0151 ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter
regardles of the xhci issue.
14.04.2019
==========
removed all device names from README.md, because VENDORS often change chipsets or driver errors occur:
v1 of a device is working fine, while v2 doesn't work
device A, running driver A is working fine, while device B running driver A doesn't work
driver doesn't support monitor mode
driver support monitor mode, but doesn't support packet injection
Examples here:
https://bugzilla.kernel.org/show_bug.cgi?id=202241
https://bugzilla.kernel.org/show_bug.cgi?id=202243
https://bugzilla.kernel.org/show_bug.cgi?id=202541
To find a working device, I recommend to read wikidevi:
https://wikidevi.com/
02.04.2019
==========
hcxdumptool now use this radiotap header:
static const uint8_t hdradiotap[] =
{
0x00, 0x00, // radiotap version + pad byte
0x0e, 0x00, // radiotap header length
0x06, 0x8c, 0x00, 0x00, // bitmap
0x00, // flags
0x02, // rate
0x14, // tx power
0x01, // antenna
0x08, 0x00 // tx flags
#define HDRRT_SIZE sizeof(hdradiotap)
};
read more about radiotap header here:
https://www.kernel.org/doc/Documentation/networking/mac80211-injection.txt
header is working with:
ID 148f:761a Ralink Technology, Corp. MT7610U ("Archer T2U" 2.4G+5G WLAN Adapter
removed "USB ID 7392:a812 Edimax Technology Co., Ltd" from "known as working device list"
because this driver is not working with the radiotap header.
30.03.2019
==========
hcxdumptool: added new option --silent
--silent : do not transmit!
hcxdumptool is acting like a passive dumper
added RTL8187. Removed the wron devices from the list (only RT3070 ia affected)
* USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter (ALFA AWUS036H)
* USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter
29.03.2019
==========
added cflag DEBUG
if compiled with DEBUG, hcxdumptool show raw packets and raw GSP data, directly received from the device
removed ALFA AWUS036NH from the "known as workinging list", because the device doesn't work
any longer, running kernel 5.0.
28.03.2019
==========
removed devices from "known working" list:
* USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter (ALFA AWUS036H)
* USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter
because they are not working running kernel 5.0
27.03.2019
==========
removed wiringPi dependency
now we are running "bare metal" - complete GPIO stuff moved to hcxdumptool and hcxpioff
do not use wiringPi in combination with hcxdumptool and/or hcxpioff
Makefile: removed DOGPIOSUPPORT
hcxdumptool: changed options wiringPi options to GPIO options
--gpio_button= : Raspberry Pi GPIO pin number of button (2...27)
default = GPIO not in use
--gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27)
default = GPIO not in use
hcxpioff: changed options wiringPi options to GPIO options
--gpio_button= : Raspberry Pi GPIO pin number of button (2...27)
default = GPIO not in use
--gpio_statusled= : Raspberry Pi GPIO number of status LED (2...27)
default = GPIO not in use
The GPIO is disabled on default. If you like to activate GPIO support you must do
the hardware modifactions as described here: doc/gpiowait.odg
and set the options according to your modification.
You can choose every GPIO pin, as long as you use a pull down resistor to ground.
Raspberry model should be detected by automatic and according to the revision we use:
GPIO mem 0x20000000 for A, B, A+, B+, and Zero, Zero W(H)
GPIO mem 0x3F000000 for 2B, 3B, 3A+, 3B+
compute modules (CMx) are not supported.
20.03.2019
==========
hcxdumptool: GPIO pins are no longer hard coded!
--wpi_button= : wiringPi number of of button (0...31, Raspberry Pi A and B: 0 .. 16)
default = 7
--wpi_statusled= : wiringPi number of status LED (0...31, Raspberry Pi A and B: 0 .. 16)
default = 0
19.03.2019
==========
hcxpioff: refactored - GPIO pins are no longer hard coded!
--wpi_button= : wiringPi number of of button (0...31, Raspberry Pi A and B: 0 .. 16)
default = 7
--wpi_statusled= : wiringPi number of status LED (0...31, Raspberry Pi A and B: 0 .. 16)
default = 0
--help : show this help
--version : show version
16.03.2019
==========
added man page hcxdumptool.1
removed device from list:
USB ID 7392:a812 Edimax Technology Co., Ltd (Edimax AC600 USB / Manufacturer: Realtek)
because the driver from here: https://github.com/aircrack-ng/rtl8812au
is no longer working on kernel 5.0
09.03.2019
==========
hcxdumptool moved to v 5.1.4
hcxdumptool: added new option:
--ignore_warning : hcxdumptool will not terminate if other services take access on the device
: warning: expect problems if hcxdumptool tries to change channels
From now on, hcxdumptool will not terminate during the initalization
if another service take access on the interface.
Expect problems and do not report issues related to this option!!!!
From now on, hcxdumptool will also show channel and frequency (when running option -C)
1 / 2412MHz (20 dBm)
2 / 2417MHz (20 dBm)
3 / 2422MHz (20 dBm)
4 / 2427MHz (20 dBm)
5 / 2432MHz (20 dBm)
6 / 2437MHz (20 dBm)
7 / 2442MHz (20 dBm)
8 / 2447MHz (20 dBm)
9 / 2452MHz (20 dBm)
10 / 2457MHz (20 dBm)
11 / 2462MHz (20 dBm)
12 / 2467MHz (20 dBm)
13 / 2472MHz (20 dBm)
09.03.2019
==========
hcxdumptool: added improved warning message
Now hcxdumptool print the error message received from the driver inside the brackets
$ hcxdumptool -i wlp3s0f0u1 -c 14
initialization...
warning: unable to set channel 14 (Invalid argument) - removed this channel from scan list
In this case the user tried to set channel 14. The driver doesn't support this
and responds with Invalid argument
07.03.2019
==========
hcxdumptool: added debug code in main packet loop [processpackets()]
to print raw GPS data, received from GPSD:
/*
printf("\ndebug: %s\n", gpsddata);
*/
uncomment this before you run make to retrieve this values.
06.03.2019
==========
hcxdumptool: added GPS date and GPS time to status and pcapng comment field.
$ sudo hcxdumptool -i wlp3s0f0u1 --use_gpsd -o test.pcapng
initialization...
connecting to GPSD...
waiting up to 5 seconds to retrieve first position
GPSD activated
start capturing (stop with ctrl+c)
GPS LATITUDE.............: 49.126403
GPS LONGITUDE............: 4.626175
GPS ALTITUDE.............: 129.500000
GPS DATE.................: 06.03.2019
GPS TIME.................: 21:52:41
INTERFACE................: wlp3s0f0u1
ERRORMAX.................: 100 errors
FILTERLIST...............: 0 entries
MAC CLIENT...............: f04f7c89dabb
MAC ACCESS POINT.........: 980ee432604d (incremented on every new client)
EAPOL TIMEOUT............: 150000
REPLAYCOUNT..............: 61455
ANONCE...................: 182972399cd2e65deb7941601cca14b644681c092dcf6f704935c7f3d2eaceea
INFO: cha=11, rx=7080, rx(dropped)=1676, tx=408, powned=10, err=0, lat=49.126342, lon=4.626268, alt=129.500000, gpsdate=06.03.2019, gpstime=22:01:55^C
terminated...
$ tshark -r test.pcapng-0 -Y frame.comment -T fields -E header=y -e frame.number -e frame.time -e wlan.sa -e frame.comment
172 Mar 6, 2019 23:01:48.793212000 CET 1a:f8:7c:91:24:a3 lat:49.126337,lon:4.626268,alt:129.500000,date:06.03.2019,time:22:01:48
05.03.2019
==========
hcxdumptool: removed general info about tx-power - now we use iw style to show tx-power/channel
hcxdumptool -i -C
initialization...
available channels:
1 (20 dBm)
2 (20 dBm)
3 (20 dBm)
...
132 (26 dBm)
136 (26 dBm)
140 (26 dBm)
149 (13 dBm)
153 (13 dBm)
157 (13 dBm)
161 (13 dBm)
165 (13 dBm)
26.02.2019
==========
hcxdumptool moved to version 5.1.3 due several bug fixes and improved rcascan status output
18.02.2019
==========
release hcxdumptool v 5.1.2 due to serveral bugfixes
02.02.2019
==========
release hcxdumptool v 5.1.1
20.01.2019
==========
hcxdumptool:
added new MT76 device: "TP-LINK Archer Archer T2U"
working with kernel: 4.19, 4.20 (some issues), 5.0
read more here:
https://github.com/ZerBea/hcxdumptool/issues/42
https://bugzilla.kernel.org/show_bug.cgi?id=202241
https://bugzilla.kernel.org/show_bug.cgi?id=202243
11.01.2019
==========
hcxdudmptool:
From now on, we assume that a packet is outgoing, if
dBm Antenne Signal is absent.
08.01.2019
==========
hcxdudmptool and mac80211_hwsim
mac80211_hwsim is a Linux kernel module that can be used to simulate
arbitrary number of IEEE 802.11 radios for mac80211. It can be used to
test hcxdumptool:
load module:
$ sudo modprobe mac80211_hwsim
run hcxdumptool to retrieve informations about the interface:
$ hcxdumptool -I
wlan interfaces:
020000000000 wlan0 (mac80211_hwsim)
020000000100 wlan1 (mac80211_hwsim)
bring monitor interface up:
$ sudo sudo ip link set hwsim0 up
run hcxdumptool:
$ sudo hcxdumptool -i wlan0
initialization...
start capturing (stop with ctrl+c)
INTERFACE:...............: wlan0
ERRORMAX.................: 100 errors
FILTERLIST...............: 0 entries
MAC CLIENT...............: c8aacc9c01ec
MAC ACCESS POINT.........: 580943000000 (incremented on every new client)
EAPOL TIMEOUT............: 150000
REPLAYCOUNT..............: 62263
ANONCE...................: 513282ebb604e6e10c450d6c3eaa6428d118b54abeef4672be3ef700052305d5
INFO: cha=11, rx=0, rx(dropped)=0, tx=120, powned=0, err=0
run wireshark on wlan0 or hwsim0 to monitor hcxdumptool output.
do not forget to remove mac80211_hwsim if the module is not longer needed!
read more here:
https://www.kernel.org/doc/readme/Documentation-networking-mac80211_hwsim-README
04.01.2019
==========
hcxdumptool - changed flash time:
LED flashes every 5 seconds = everything is fine
LED stays on = no signal received during the last past five seconds
hcxdumptool - ignore double outgoing packets (rth->it_present == 0)
03.01.2019
==========
hcxdumptool: changed flash time (5 times longer on ERROR)
hcxpioff: changed flash time
20.12.2018
==========
improved detection of broken driver
from now on GPIO LED blinks twice every 5 seconds
- if a possbile driver issue is detected
- if no packets received during the last past 5 seconds
another indicator is that the incomming packetcounter (rx=xxxx)
doesn't increase
or dmesg show this error:
[65786.808078] ieee80211 phy2: rt2x00queue_flush_queue: Warning - Queue 14 failed to flush
[65824.174119] ieee80211 phy2: rt2x00queue_flush_queue: Warning - Queue 14 failed to flush
[67801.029527] ------------[ cut here ]------------
it seems to be a kernel issue that hcxdumptool isn't able to handle, automatically:
https://bbs.archlinux.org/viewtopic.php?id=237028
https://bugs.openwrt.org/index.php?do=details&task_id=929&opened=169&status%5B0%5D=
https://community.spiceworks.com/topic/2132263-ubuntu-16-04-wifi-disconnects-randomly
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1750226
https://www.raspberrypi.org/forums/viewtopic.php?t=206815
workaround:
1) get driver information
$ hcxdumptool -I
wlan interfaces:
7cdd90xxxxxx wlp3s0f0u2 (rt2800usb)
2) remove module
$ modprobe -r rt2800usb
3) load module
$ modprobe rt2800usb
18.12.2018
==========
added new option to set station MAC address
--station_mac= : use this MAC address for station
format = 112233445566
format = 112233000000 (to set only OUI)
format = 445566 (to set only NIC)
added new option to set access point MAC address
--ap_mac= : use this MAC address for access point as start MAC
format = 112233445566
format = 112233000000 (to set only OUI)
format = 445566 (to set only NIC)
warning: do not use a MAC of an existing access point in your range
improved detection of broken driver
set default ERRORMAX to 100
added option to set ERRORMAX
-T : set maximum ERRROR count (hcxdumptool terminates when the value is reached)
default: 100 errors
Remarks:
errorcount will increase by one, if send packet (tx=xxx) > 3*incomming packets (rx=xxx)
15.12.2018
==========
improved random generator (now seeded with and adapter mac address)
Raspberry Pi: improved handling of GPIO switch
07.12.2018
==========
restore interface settings after -C
improved help menu
-more informations about monitor mode
-more informations about packet injection
monitor mode and packet injection must be supported by the driver,
otherwise hcxdumptool will not work.
05.12.2018
==========
moved to v 5.1.0 (according to hashcat)
04.12.2018
==========
added new option:
-C : show available channels and quit
27.11.2018
==========
added new option:
--poweroff : once hcxdumptool finished, power off system
26.11.2018
==========
several big endian fixes
switched to version 5.0.1
07.10.2018
==========
added new option filter mode 3:
--filterlist= : mac filter list
format: 112233445566 + comment
maximum line lenght 255, maximum entries 64
--filtermode= : mode for filter list
1: use filter list as protection list (default) in transmission branch
receive everything, interact with all APs and CLIENTs in range,
except(!) the ones from the filter list
2: use filter list as target list in transmission branch
receive everything, only interact with APs and CLIENTs in range,
from the filter list
3: use filter list as target list in receiving branch
only receive APs and CLIENTs in range,
from the filter list
30.10.2018
==========
moved to version 5.0.0
05.10.2018
==========
added more error messages
fixed small bug in error count on channel change failure
04.10.2018
==========
show GPS position (if activated) in status line (refresh every 5 seconds)
fixed broken status display on rcascan
increased speed of rcascan
fixed error handling if selected channels not supported by driver
if option -t is not set, skip empty channels after one second
improved scan list
fixed some static var
01.10.2018
==========
changed order of channels in default scan list:
1, 9, 6, 3, 11, 7, 1, 10, 6, 8, 11, 4, 1, 12, 6, 2, 11, 5, 13
27.09.2018
==========
added GPSD support (stored as comment in pcapng file)
--use_gpsd : use GPSD to retrieve position
add latitude, longitude and altitude to every pcapng frame
device must be supported by GPSD:
http://www.catb.org/gpsd/hardware.html
(tested using: AktivePilot JENTRO BT-GPS-8)
Retrieve GPS information with:
$ tshark -r filename.pcapng -Y frame.comment -T fields -E header=y -e frame.number -e frame.time -e wlan.sa -e frame.comment
write mac_ap to pcapng SHB
write mac_sta to pcapng SHB
SHB optioncodes:
#define OPTIONCODE_MACMYAP 62107
#define OPTIONCODE_RC 62108
#define OPTIONCODE_ANONCE 62109
#define OPTIONCODE_MACMYSTA 62110
16.09.2018
==========
show warning if NetworkManager and/or wpa_supplicant is running
15.09.2018
==========
added Cisco Systems, Inc VENDOR information
--station_vendor= : use this VENDOR information for station
0: transmit no VENDOR information (default)
1: Broadcom
2: Apple-Broadcom
3: Sonos
4: Netgear-Broadcom
5: Wilibox Deliberant Group LLC
6: Cisco Systems, Inc
11.09.2018
==========
You can “uncomment a line” in a configuration file
by removing the # at the start of the line.
Or, to “comment out” a line, add a # character
to the start of the line.
001122334455 myap
# aabbccddeeff ignore this mac
112233445566 second ap
# this is may comment
05.09.2018
==========
added Netgear Broadcom VENDOR information
added Wilibox Deliberant Group LLC VENDOR information
04.09.2018
==========
improved rcascan (show time and access points which hide their ESSID)
prepare detection of PMF
refactored access point handling
handle 4096 access points simultaneously
refactored client handling
handle 4096 clients simultaneously
speed up retrieving PMKIDs (< 1 minute)
attack access points which hide their ESSID
increased filter list line length
increased filter list maximum entries
added option to show beacons in status output:
--enable_status= : enable status messages
bitmask:
1: EAPOL
2: PROBEREQUEST/PROBERESPONSE
4: AUTHENTICATON
8: ASSOCIATION
16: BEACON
added option to choose station VENDOR information:
--station_chipset= : use this VENDOR information for station
0: transmit no VENDOR information (default)
1: Broadcom
2: Apple-Broadcom
3: Sonos
30.08.2018
==========
iw/ip functionality added!
now hcxdumptool will set monitor mode and bring up interface!
previous interface settings will be restored, when hcxdumptool terminated
19.08.2018
==========
parse SAE authentication
19.08.2018
==========
added radio assignment scan
--do_rcascan : show radio channel assignment (scan for target access points)
--save_rcascan= : output rca scan list to file when hcxdumptool terminated
--save_rcascan_raw= : output file in pcapngformat
unfiltered packets
including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
17.08.2018
==========
detect NETWORK EAP authentication system
transmit BROADCAST beacon
16.08.2018
==========
From now on we store open system authentications to pcapng
only if they have have a vendor specific field.
we are no longer interested in standard open system authentications (payload len = 6)
changed some default values:
-D : deauthentication interval
default: 10 (every 10 beacons)
the target beacon interval is used as trigger
-A : ap attack interval
default: 10 (every 10 beacons)
--give_up_deauthentications=: disable transmitting deauthentications after n tries
default: 100 tries (minimum: 4)
affected: connections between client an access point
deauthentication attacks will not work against protected management frames
--give_up_ap_attacks= : disable transmitting directed proberequests after n tries
default: 100 tries (minimum: 4)
affected: client-less attack
deauthentication attacks will not work against protected management frames
13.08.2018
==========
increased some attack values:
--give_up_deauthentications=: disable transmitting deauthentications after n tries
default: 100 tries (minimum: 4)
affected: connections between client an access point
deauthentication attacks will not work against protected management frames
--give_up_ap_attacks= : disable transmitting directed proberequests after n tries
default: 100 tries (minimum: 4)
07.08.2018
==========
moved to 4.2.1
added communication between hcxdumptool and hcxpcaptool via pcapng option fields:
62108 for REPLAYCOUNT uint64_t
62109 for ANONCE uint8_t[32]
enabled hardware handshake instead of software handshake
changed beavior auf status:
--enable_status= : enables status messages
bitmask:
1: EAPOL
2: PROBEREQUEST/PROBERESPONSE
4: AUTHENTICATON
8: ASSOCIATION
Now we use a bitmask to deliver status messages.
06.08.2018
==========
write ISB (Interface Statistic Block) at the end of a cpature
04.08.2018
==========
addet new option (--disable-active_scan) to hcxdumptool
--disable_active_scan: do not transmit proberequests to BROADCAST using a BROADCAST ESSID
04.08.2018
==========
release hcxdumptool 4.2.0
complete refactored:
-various new options
-measurement of EAPOL timeout
-full support for hashcat hashmodes -m 16800 and 16801
-now default format is pcapng
$ ./hcxdumptool-bleeding --help
hcxdumptool 4.2.0 (C) 2018 ZeroBeat
usage : hcxdumptool
example: hcxdumptool -o output.pcapng -i wlp39s0f3u4u5 -t 5 --enable_status
options:
-i : interface (monitor mode must be enabled)
ip link set down
iw dev set type monitor
ip link set up
-o : output file in pcapngformat
management frames and EAP/EAPOL frames
including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
-O : output file in pcapngformat
unencrypted IPv4 and IPv6 frames
including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
-W : output file in pcapngformat
encrypted WEP frames
including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
-c : set scanlist (1,2,3,...)
default scanlist: 1, 3, 5, 7, 9, 11, 13, 2, 4, 6, 8, 10, 12
maximum entries: 127
allowed channels:
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 58, 60, 62, 64
100, 104, 108, 112, 116, 120, 124, 128, 132,
136, 140, 144, 147, 149, 151, 153, 155, 157
161, 165, 167, 169, 184, 188, 192, 196, 200, 204, 208, 212, 216
-t : stay time on channel before hopping to the next channel
default: 5 seconds
-E : EAPOL timeout
default: 100000 = 1 second
value depends on channel assignment
-D : deauthentication interval
default: 20 (every 20 beacons)
the target beacon interval is used as trigger
-A : ap attack interval
default: 20 (every 20 beacons)
the target beacon interval is used as trigger
-I : show suitable wlan interfaces and quit
-h : show this help
-v : show version
--filterlist= : mac filter list
format: 112233445566 + comment
maximum line lenght 128, maximum entries 32
--filtermode= : mode for filter list
1: use filter list as protection list (default)
2: use filter list as target list
--disable_deauthentications: disable transmitting deauthentications
affected: connections between client an access point
deauthentication attacks will not work against protected management frames
--give_up_deauthentications=: disable transmitting deauthentications after n tries
default: 10 tries (minimum: 4)
affected: connections between client an access point
deauthentication attacks will not work against protected management frames
--disable_disassociations : disable transmitting disassociations
affected: retry (EAPOL 4/4 - M4) attack
--disable_ap_attacks : disable attacks on single access points
affected: client-less (PMKID) attack
--give_up_ap_attacks= : disable transmitting directed proberequests after n tries
default: 10 tries (minimum: 4)
affected: client-less attack
deauthentication attacks will not work against protected management frames
--disable_client_attacks : disable attacks on single clients points
affected: ap-less (EAPOL 2/4 - M2) attack
--enable_status : enable status messages
--help : show this help
--version : show version
01.08.2018
==========
moved some stuff from hcxtools to hcxdumptool repository
prepare complete refactoring!
04.03.2018
==========
hcxdumptool: added new option -W
-W : WEP encrypted packets output file in pcapformat including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
04.03.2018
==========
hcxdumptool again complete refactored:
02.03.2018
==========
hcxdumptool is complete refactored:
- improved scan engine
- improved authentication engine (incl. Radio Measurement, and NULL frame detection)
- dropped timer
- use threads for LED and channel switch
- use only one file descriptor for raw socket operations
- working on Intel Corporation Centrino Ultimate-N 6300 (rev 3e) WiFi adapter (kernel >= 4.15)
- working on Alfa AWUS036NH, Alfa AWUS036NHA
- working on Alfa AWUS036ACH (driver: https://github.com/kimocoder/rtl8812au)
- more channels allowed (depends on installed wireless regulatory domain)
- simple usage: hcxdumptool -i -o dumpfile.pcap -t 5
interface (real interface - no monX) must be in monitor - all services/programs with access to the interface must be stopped!
- new format of blacklist
- and more...
reported to run on Gentoo
https://github.com/ZerBea/hcxdumptool_bleeding_testing/issues/2#issuecomment-369256915
reported to run on OpenWRT/LEDE
https://github.com/ZerBea/hcxdumptool_bleeding_testing/issues/3#issuecomment-369756725
reported to run with Intel Corporation Centrino Ultimate-N 6300 (rev 3e)
https://github.com/ZerBea/hcxdumptool_bleeding_testing/issues/2#issuecomment-369259800
$ hcxdumptool -h
hcxdumptool 4.1.0 (C) 2018 ZeroBeat
usage:
hcxdumptool
options:
-i : interface (monitor mode must be eanabled)
ip link set down
iw dev set type monitor
ip link set up
-o : output file in pcapformat including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
-O : ip based traffic output file in pcapformat including radiotap header (LINKTYPE_IEEE802_11_RADIOTAP)
-c : set scanlist (1,2,3,... / default = default scanlist)
default scanlist: 1, 3, 5, 7, 9, 11, 13, 2, 4, 6, 8, 10, 12
allowed channels:
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
36, 40, 44, 48, 52, 56, 60, 64
100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 147, 151, 155, 167
-t : stay time on channel before hopping to the next channel
default = 5 seconds
-T : terminate after maximal errors
: default: 1000000
-D : do not transmit deauthentications or disassociations
-R : do not transmit requests
-A : do not respond to requests from clients
-B : blacklist (do not deauthenticate clients from this hosts)
format = mac_ap:mac_sta:ESSID
112233445566:aabbccddeeff:networkname (max. 32 chars)
-P : enable poweroff
-s : enable status messages
-I : show suitable wlan interfaces and quit
-h : show this help
-v : show version
27.02.2018
==========
Now recommendations since we are run into heavy problems with latest drivers and operating systems
* Operatingsystem: archlinux (strict), Kernel >= 4.14 (strict)
* Raspberry Pi A, B, A+, B+ (Recommended: A+ = very low power consumption or B+), but notebooks and desktops could work, too.
* GPIO hardware mod recommended
Supported adapters (strict)
* USB ID 148f:7601 Ralink Technology, Corp. MT7601U Wireless Adapter
* USB ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
* USB ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter
* USB ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter
* USB ID 0bda:8189 Realtek Semiconductor Corp. RTL8187B Wireless 802.11g 54Mbps Network Adapter
25.02.2018
==========
- initial start of this repository
- added hcxdumptool
- added hcxpioff
hcxdumptool-5.1.7/docs/ 0000775 0000000 0000000 00000000000 13503700217 0015020 5 ustar 00root root 0000000 0000000 hcxdumptool-5.1.7/docs/gpiowait.odg 0000664 0000000 0000000 00000033172 13503700217 0017344 0 ustar 00root root 0000000 0000000 PK E=|N.+ + mimetypeapplication/vnd.oasis.opendocument.graphicsPK E=|N meta.xmlSM0W WcCR=mJM"b{ނlBJQqoͼ60VjU8Ba \c}YX}(drV(Z`*KPFQ][i[acTwB-FIh~95R*:
0@"myzL(ΠhWG.X^SahܗcYZ_L{܀zPm[ܫ豀5UOk%{x;Gysk(gǮoRë5/e8b
3bFAQo ƀ$%if(858ۡ&1("lI.YUp 7S.|!ƻ5fU >7\+id?M\4UozPK ) PK E=|N settings.xmlZr8}߯HffnB 5$a7a5,$9ߖ Yh%[:jw})4T+PR&~-\ɄP2L"pеz(QD3]$]3aM Gǧk|>?J5-WXF(bY
(/F ˅9Ï*:b|W.;(F_]aW^ZW"GA9àqrWl.[R_'HoL[4fM&L(W.ʯqޅ݇IWɨU/l:KZ9'\0O-7N-v=a6
C!hhO?AcB"]%ŦCA⑴,d
DMY,F%I>It^2Ỳ'A7,<Ư]tޞpY10|iS3kk.[ڏ>Y`'~;ij4z>>C|e mP7i0a}8F%M,w fȏosW,m&z8Ԃ](\K=ݑ :Y0'sIYf,B3"p'~4C(;9O߃FDlKU)yVʧa[!j%o|+|LO+`衖|V0Q՛jvml&U9ma>:DϼDspf
M4܄hPth?VI܁1g
vhW1s_[ǣMr[=D4o2˜(|6e
uBLanKA/Z@e-M1<˫.kdXնZR>bHٱα=Dai~Z6]ea-7>8O#~1{K7y͒%U_щ{ӹ9b.2
EDR(9)SE0"_E lHae_<`퓅L2G%