TELE3119 Trusted Networks Lab 1 (a), (b) Sniffing wireless traffic

Transcription

1 TELE3119 Trusted Networks Lab 1 (a), (b) Sniffing wireless traffic [10 points, Due Week 5] Part (a) Objective: The objective of this exercise is to setup an infrastructure for capturing the network traffic of Wi-Fi connected devices and analysing the captured traffic in order to perform a replay attack. Guidelines: You are required to work in a team of 2 members. You may have to bring and use your own laptops for this lab. Each team will be provided with an external wireless adapter to create an access point and an IoT device that can connect to the access point via Wi-Fi. Caution: It is very important to try pen-testing tools and your skills only on your own device not on unauthorized devices on the Internet. Infrastructure setup: Fig 1: lab setup Kali Linux is a Linux distribution based on Debian. Kali is especially made for pen-testers -- this operating system is optimised for most of tools that are needed for penetration testing. You are required to set up a Kali OS on your computer. However, installing Kali Linux in a virtual environment (i.e. Virtual Box) is recommended instead of installing alongside your primary OS. 1 of 5

2 How to set up the Kali? 1. Install virtual box on your computer. You may download the application from: 2. You can download the appropriate version of Kali Pre-configured virtual machines from the following link: (You can also create your own virtual machine by downloading the Kali image from official source. We recommend to use the pre-built virtual machine for this lab) 3. Extract the downloaded image and import it into your virtual box. 4. Configure the appropriate setting for the virtual machine. Recommended settings: a. RAM minimum 2GB (Find on System tab) b. Network Adapter: i. Attached to: Bridged Adapter 5. Virtualbox extension pack extends the functionality of virtual box like providing virtual USB slots. It is required to connect the external Wi-Fi adapter to the virtual machine. Thus, download and install the same version of extension pack from: i. Connect the USB wireless adapter to your computer ii. Attach the wireless adapter to the virtual machine. Now, boot your Kali machine using default credential (Username: root, Password: toor) 2 of 5

3 Creating an access point: 1. Install the driver for the wireless adapter sudo apt-get update sudo apt-get upgrade sudo apt-get dist-upgrade sudo shutdown -r now sudo apt-get install realtek-rtl88xxau-dkms sudo shutdown -r now 2. You can make sure whether wireless adapter is properly configured by using ifconfig command in terminal (i.e interface wlan0 should be created). 3. To create an access point, install hostapd using below command sudo apt-get install hostpad 4. Create a hostapd configuration file(hostapd.conf) with the below content interface=wlan0 driver=nl80211 ssid=ap[-groupid] channel=[your-groupid mod 11] logger_syslog=-1 logger_syslog_level=2 wpa=2 wpa_passphrase= wpa_key_mgmt=wpa-psk WPA-EAP WPA-PSK-SHA256 WPA-EAP-SHA256 hw_mode=g 5. In order to configure DNS and DHCP server install dnsmasq sudo apt-get install dnsmasq 6. Create a dnsmasq configuration file(dnsmasq.conf) interface=wlan0 dhcp-range= , ,8h dhcp-option=3, dhcp-option=6, server= log-queries log-dhcp 7. In order to avoid network manager from interfering with the AP interface, append below entries to /etc/networkmanager/networkmanager.conf [device] wifi.scan-rand-mac-address=no [keyfile] unmanaged-devices=mac:7e:91:00:36:d7:0b 8. Run below script to create an access point and to capture packets [1] #!/bin/bash 3 of 5

4 MONITOR_DEVICE=wlan0 OUTPUT_DEVICE=eth0 # Catch ctrl c so we can exit cleanly trap ctrl_c INT function ctrl_c(){ echo Killing processes.. killall dnsmasq killall hostapd } ifconfig $MONITOR_DEVICE down ifconfig $MONITOR_DEVICE hw ether 7e:91:00:36:d7:0b ifconfig $MONITOR_DEVICE /24 up dnsmasq -C dnsmasq.conf sysctl -w net.ipv4.ip_forward=1 iptables -P FORWARD ACCEPT iptables --table nat -A POSTROUTING -o $OUTPUT_DEVICE -j MASQUERADE hostapd./hostapd.conf -B tshark -i $MONITOR_DEVICE -w output.pcap -P Now you may connect your phone and IoT devices to the access point. Set up IoT devices: 1. Connect your mobile phone to the access point that you have created. 2. Connect the given IoT device to the access point according to the instruction provided on the box/user manual of the IoT. Part (b) Objective: 1) Collect the traffic traces for few hours whilst capturing device functionalities (i.e. turn on/off light bulb/viewing camera feed). 2) Use mudgee tool ( to generate the device profile. Pre-requisites: java, maven and tcpdump git clone cd mudgee mvn clean install update the target/mud_config.json with details of the IoT device that you are experimenting with. An example of the configuration file is given below: { "defaultgatewayconfig": { "macaddress" : "7e:91:00:36:d7:0b", "ipaddress": " ", "ipv6address": "fe80:0:0:0:16cc:20ff:fe51:33ea" }, 4 of 5

5 } "deviceconfig":{ "device":"ac:84:c6:02:b9:ad", "devicename": "tplinksmartplug" }, "pcaplocation": "/Users/ayyoobhamza/Downloads/output.pcap" Execute the following command to generate the device behavioural profile. java -jar target/mudgee snapshot.jar target/mud_config.json 3) Given captured traffic in part(a), you need to analyse the packet(s) corresponding to your IoT device. Then if possible, you will write a script to craft and replay a new packet over the IoT device in the lab, changing the state of the device (e.g. turning on/off a lightbulb) or accessing data from the device (e.g. collecting image from a camera). References [1] 5 of 5