DarkMatter in Cyberspace
  • Home
  • Categories
  • Tags
  • Archives

WiFi Sniffer Notes


airmon-ng

The wireless card Ralink RT5370 was bought from taobao seller 铠睿科技. Plug it into the USB hub and run the following commands:

sudo apt-get update
sudo apt-get install aircrack-ng

sudo airmon-ng
# got *phy0* in the row with *Interface* wlxc83a35b05bb9 under column *Driver*

iw phy0 info
# see *monitor* in *Supported interface mode* section,
# which mean this card support monitor mode

iwconifg     # see *Mode: Managed* in section *wlxc83a35b05bb9*

sudo airmon-ng start wlxc83a35b05bb9     # start a new interface in monitor mode

iwconfig
# see "Mode: Monitor* in section *mon0*
# while wlxc83a35b05bb9 still in managed mode

sudo airodump-ng mon0        # get chanel and bssid of the target AP

sudo airodump-ng -c 1 -w . --bssid D4:EE:07:03:D9:50 mon0
# save all traffic of the target AP to files

sudo airmon-ng stop mon0       # stop monitor mode

Other tools

scapy

$ conda create -n wifi python=3.5 ipython
$ conda install -n wifi -c anaconda cryptography
$ . activate wifi
$ pip install scapy-python3
$ sudo PATH=$PATH zsh -c scapy
>>> conf.iface = 'mon0'
>>> pkts = sniff(count=5)
>>> pkts.summary()
>>> pkts.show()
>>> p1 = pkts[0]
>>> p1.summary()
>>> p1.show()
>>> p1.type   # 0
>>> p1.subtype   # 8
>>> p1.addr2   # the mac address

tshark

sudo apt install tshark
sudo tshark -D     # list all interfaces
sudo tshark -i mon0 -c 20

See dsnote "tshark Notes" and man tshark for more information.



Published

Jan 11, 2018

Last Updated

Jan 11, 2018

Category

Tech

Tags

  • sniffer 1
  • wifi 4
  • wireless 2

Contact

  • Powered by Pelican. Theme: Elegant by Talha Mansoor