Merge branch 'main' of

.gitignore

@@ -1,3 +1,4 @@
 private-notes.txt
 boofuzz
-old
+old
+imgs

scapy/wifi-beacon-fuzz.py

@@ -75,6 +75,39 @@ def sendRandBytesBeaconsRaw(
 		print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}")
 		sendProbeRaw(SSID, repeat, interval, listedLen)
 
+
+
 #sendRandBytesBeaconsRaw(numOfBeacons=100, lenOfSSIDs=1, listedLen=255, repeat=3, interval=0.15)
 #sendRandBytesBeacons(100, 20, 5, 0.1)
-sendFuzzBeacons()
+
+
+def fullFuzz(
+	numOfBeacons=200,
+	repeat=3,
+	interval=0.150):
+
+	for i in range(numOfBeacons):
+		realLenSSID = random.randint(0,255)
+		SSID = random.randbytes(realLenSSID)
+		urlEncoded = urllib.parse.quote(SSID)
+		fakeLenSSID = random.randint(0,255)
+		senderMAC = RandMAC()
+
+		dot11 = Dot11(type=0, subtype=8,
+				addr1='ff:ff:ff:ff:ff:ff',
+				addr2=senderMAC,
+				addr3=senderMAC)
+		
+		beacon = Dot11Beacon()
+
+		essid = Dot11Elt(ID='SSID',
+				   info=SSID,
+				   len=fakeLenSSID)
+					
+		frame = RadioTap()/dot11/beacon/essid
+		
+		print(f"\n{i}/{numOfBeacons}\n\tEach Repeats: {repeat}\n\tReal Length: {realLenSSID}\n\tFake Length: {fakeLenSSID}\n\tSender MAC: {senderMAC}\n\tSSID: {urlEncoded}\n")
+
+		sendp(frame, iface=iface, inter=interval, count=repeat)
+
+fullFuzz()

scapy/wifi-beacon-random-byte.py

@@ -15,11 +15,11 @@ def sendProbe(SSID,
 	frame = RadioTap()/dot11/beacon/essid
 	sendp(frame, iface=iface, inter=interval, count=repeat)
 
-def sendProbeRaw(SSID,
-				 repeat=1,
-				 interval=0.200,
-				 listedLen=255,
-				 lenOverride=False):
+def sendProbeRaw(SSID='F',
+				 repeat=3,
+				 interval=0.150,
+				 listedLen=512,
+				 lenOverride=True):
 
 		dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender)
 		beacon = Dot11Beacon()
@@ -41,6 +41,7 @@ def sendRandBytesBeacons(numOfBeacons=200,
 		sendProbe(SSID, repeat, interval)
 
 def sendRandBytesBeaconsRaw(
+	SSID='I-am-your-pony-waifu',
 	numOfBeacons=200,
 	lenOfSSIDs=255,
 	listedLen=255,
@@ -49,16 +50,81 @@ def sendRandBytesBeaconsRaw(
 	interval=0.2):
 	
 	for i in range(numOfBeacons):
-		SSID = randbytes(lenOfSSIDs)
+		#SSID = randbytes(lenOfSSIDs)
 		urlEncoded = urllib.parse.quote(SSID)
 		print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}")
 		sendProbeRaw(SSID, repeat, interval, listedLen, lenOverride=lenOverridei)
 
-sendRandBytesBeaconsRaw(numOfBeacons=200,
-						lenOfSSIDs=2,
-						listedLen=1,
-						lenOverridei=True,
+def overloadParamBeacon(max=10000,
 						repeat=3,
-						interval=0.1)
+						chari = "X",
+						interval=0.2,
+						listedLen=1):
 
+	for i in range(max):
+		num = i+1000
+		SSIDI = chari*num
+		SSID = f"{num}{SSIDI}"
+		
+		dot11 = Dot11(type=0,
+			subtype=8,
+			addr1='ff:ff:ff:ff:ff:ff',
+			addr2=sender,
+			addr3=sender)
+		
+		beacon = Dot11Beacon()
+		
+		essid = Dot11Elt(ID='SSID',
+				   		info=RawVal(SSID),
+						len=listedLen)
+		
+		frame = RadioTap()/dot11/beacon/essid
+
+		print(f"\nSending {num}{chari}*{num} as SSID With Length Of {listedLen}")
+		sendp(frame, iface=iface, inter=interval, count=repeat)
+
+#overloadParamBeacon()
+
+
+
+#$sendRandBytesBeaconsRaw(
+#						SSID = b"YOU-SEEM-FUNDAMETALLY-FUN\x00\x0AI-THINK-ID-LIKE-TO-KNOW-YOU\x00\x0AI-FEEL-LIKE-BEING-YOUR-FRIEND\x00\x0AI-AM-YOUR-PONY-WAIFU",
+#						numOfBeacons=200,
+#						lenOfSSIDs=2,
+#						listedLen=1,
+#						lenOverridei=True,
+#						repeat=3,
+#						interval=0.1)
+
+def bullyForRCE(max=10000,
+						repeat=3,
+						chari = "\xff",
+						interval=0.2,
+						listedLen=255):
+
+	for i in range(max):
+		chars = chari*i
+		#SSID = f"n-{i}-YOU-SEEM-FUNDAMETALLY-FUN-I-THINK-ID-LIKE-TO-KNOW-YOU{chars}\xc6\x54\x00-I-FEEL-LIKE-BEING-YOUR-FRIEND-I-AM-YOUR-PONY-WAIFU"
+		SSID = f"n{chars}"
+		urlEncoded = urllib.parse.quote(SSID)
+		
+		dot11 = Dot11(type=0,
+			subtype=8,
+			addr1='ff:ff:ff:ff:ff:ff',
+			addr2=sender,
+			addr3=sender)
+		
+		beacon = Dot11Beacon()
+		
+		essid = Dot11Elt(ID='SSID',
+				   		info=RawVal(SSID),
+						len=listedLen)
+		
+		frame = RadioTap()/dot11/beacon/essid
+
+		print(f"\nSending {i}/{max}\n\tWith SSID {urlEncoded}\n\tWith Length Of {listedLen}")
+		sendp(frame, iface=iface, inter=interval, count=repeat)
+
+sendProbeRaw(repeat=300)
+#bullyForRCE()
 #sendRandBytesBeacons(100, 20, 5, 0.1)

scapy/wifi-beacon-scapy.py

@@ -25,5 +25,6 @@ def beacon_normie(SSID):
 #longgg = "\xFF"*800
 #longggg = f"\x00{longgg}\x00"
 #beacon_raw(longggg)
-SSID = b"YOU-SEEM-FUNDAMETALLY-FUN\x0AI-THINK-ID-LIKE-TO-KNOW-YOU\x0AI-FEEL-LIKE-BEING-YOUR-FRIEND\x0AI-AM-YOUR-PONY-WAIFU"
+#SSID =  b"YOU-SEEM-FUNDAMETALLY-FUN\x00\x0AI-THINK-ID-LIKE-TO-KNOW-YOU\x00\x0AI-FEEL-LIKE-BEING-YOUR-FRIEND\x00\x0AI-AM-YOUR-PONY-WAIFU\x0a\x00\xc6\x54\x00"
+SSID = b"YOU-SEEM-FUNDAMETALLY-FUN-I-THINK-ID-LIKE-TO-KNOW-YOU\x0a\x00\xc6\x54\x00-I-FEEL-LIKE-BEING-YOUR-FRIEND-I-AM-YOUR-PONY-WAIFU"
 beacon_raw(SSID)

sd-card/dump-script

@@ -1,9 +1,16 @@
 #!/bin/bash
 number=0
+<<<<<<< HEAD:sd-card-helpers/dump-script
 tag=full-fuzz
 blocks=100
 blocksize=1M
 dumpsize=100M
+=======
+tag=fresh
+blocks=75
+blocksize=1M
+dumpsize=75M
+>>>>>>> 74ecdcb053840a8ffeeb1fd63d6789a9f4ef29eb:sd-card/dump-script
 
 
 
@@ -20,4 +27,4 @@ filename="./imgs/${number}-${tag}-${dumpsize}-${timestamp}.img"
 echo -e "\nWriting to ${filename}"
 sudo dd if=$block of=$filename bs=$blocksize count=$blocks status=progress conv=fdatasync
 
-echo -e "\n\nDONE\n\nWritten to: ${filename}\n\n"
+echo -e "\n\nDONE\n\nWritten to: ${filename}\n\n"