{"id":8283,"date":"2016-09-15T10:24:54","date_gmt":"2016-09-15T10:24:54","guid":{"rendered":"http:\/\/tajdini.net\/blog\/2016\/09\/15\/fake-ap-kali\/"},"modified":"2020-12-20T11:17:55","modified_gmt":"2020-12-20T09:17:55","slug":"fake-ap-kali","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/dfir-and-incident-response\/fake-ap-kali\/","title":{"rendered":"Quick and easy fake WiFi access point in Kali"},"content":{"rendered":"
\n

I\u2019m working on a project at the moment that requires me to observe traffic from an iOS\/Android app or any other computer Apps to various external IPs. This is the first step of my project \ud83d\ude09
(something in this article is not real , like MAC addresses, project Description , \u2026. )<\/p>\n

\u00a0The easiest way to do this is to setup a fake Wi-Fi access point and use Wireshark to sniff the traffic. This is very easy in Kali Linux.<\/p>\n

\u00a01. Connect the Kali box to the Internet<\/span><\/b><\/p>\n

\u00a0In my case, I use a Raspberry pi with an External TP-Link TL-WN722N wireless adapter, but you can use any other wireless adapter or built-in modules as you like<\/p>\n

\u00a0Using ifconfig<\/span><\/b> I can see that this adapter is called wlan0.<\/p>\n

\u00a0You could use wired Ethernet, then in all likelihood this will be eth0 instead.<\/p>\n

\u00a02. Connect an external Wi-Fi adapter that is supported by hostapd<\/span><\/b><\/p>\n

\u00a0I\u2019m using a USB TP-LINK TL-WN722N which is using an Atheros AR9271 chipset. These are cheap (\u00a38-\u00a310), powerful and reliable.<\/p>\n

\u00a0I suspect many USB Wi-Fi adapters are compatible with hostapd, unfortunately I can\u2019t see a clear source documenting which ones.<\/p>\n

\u00a0Check it works by connecting to any network using Kali\u2019s GUI. This will save you hassle later if there are any driver or hardware issues.<\/p>\n

\u00a03. Bring up the new wireless interface.<\/span><\/b><\/p>\n

\u00a0Use ifconfig -a<\/span><\/b> to see the new wireless interface name:<\/p>\n

\u00a0wlan3 Link encap:Ethernet HWaddr 00:27:19:bb:38:88<\/p>\n

\u00a0BROADCAST MULTICASTMTU:1500Metric:1<\/p>\n

\u00a0RX packets:0 errors:0 dropped:0 overruns:0 frame:0<\/p>\n

\u00a0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<\/p>\n

\u00a0collisions:0 txqueuelen:1000<\/p>\n

\u00a0RX bytes:0 (0.0 B)TX bytes:0 (0.0 B)<\/p>\n

\u00a0ring this up as the gateway for your new wireless network. I am using 10.0.0.1\/24 simply to avoid any chance of confusion with my internal NATed 192.168.0.1\/24 network.<\/p>\n

\u00a0root@kali:~# ifconfig wlan3 10.0.0.1\/24 up<\/b><\/span><\/p>\n

\u00a0root@kali:~# ifconfig wlan3<\/b><\/span><\/p>\n

\u00a0wlan3 Link encap:Ethernet HWaddr 00:27:19:bb:38:88<\/p>\n

\u00a0inet addr:10.0.0.1Bcast:10.0.0.255Mask:255.255.255.0<\/p>\n

\u00a0UP BROADCAST MULTICASTMTU:1500Metric:1<\/p>\n

\u00a0RX packets:0 errors:0 dropped:0 overruns:0 frame:0<\/p>\n

\u00a0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<\/p>\n

\u00a0collisions:0 txqueuelen:1000<\/p>\n

\u00a0RX bytes:0 (0.0 B)TX bytes:0 (0.0 B)<\/p>\n

\u00a04. Configure and run DHCP and DNS services<\/span><\/b><\/p>\n

\u00a0DHCP assigns IP addresses when clients connect, and DNS provides resolution of names to IPs.<\/p>\n

\u00a0Most wireless clients expect DHCP by default, so it is convenient to run a DHCP server. You can manually set IP addresses, but it\u2019s really easier to do DHCP.<\/p>\n

\u00a0Running our own DNS server means that we can easily intercept and alter DNS queries, which can assist in setting up man-in-the-middle attacks.<\/p>\n

\u00a0A piece of software called dnsmasq does both DHCP and DNS and is very simple to setup.<\/p>\n

\u00a0First, install dnsmasq:<\/p>\n

\u00a0apt-get install dnsmasq<\/span><\/b><\/p>\n

\u00a0Next, create a config file dnsmasq.conf <\/span><\/b>as follows: (we can make and edit this file with nano dnsmasq.cof<\/span><\/b> everywhere as you like )<\/p>\n

\u00a0interface=wlan3<\/span><\/p>\n

\u00a0dhcp-range=10.0.0.10,10.0.0.250,12h<\/span><\/p>\n

\u00a0dhcp-option=3,10.0.0.1<\/span><\/p>\n

\u00a0dhcp-option=6,10.0.0.1<\/span><\/p>\n

\u00a0server=8.8.8.8<\/span><\/p>\n

\u00a0log-queries<\/span><\/p>\n

\u00a0log-dhcp<\/span><\/p>\n

\u00a0This is about as simple as it gets. Only listen on wlan3, our additional wireless adapter. Hand out DHCP addresses from 10.0.0.10-10.0.0.250. DHCP option 3 is the gateway, DHCP option 6 is the DNS server \u2013 both of these should be set to our wlan3 IP of 10.0.0.1. server specifies upstream DNS servers that will handle most DNS queries \u2013 I have provided Google\u2019s DNS server of 8.8.8.8. Finally, log DNS queries and DHCP requests \u2013 this just makes it easier to check everything is working.<\/p>\n

\u00a0We also want to create a file fakehosts.conf to allow us to spoof certain DNS requests:<\/p>\n

\u00a010.0.0.9 neohub.co.uk<\/span><\/p>\n

\u00a0This will cause the dnsmasq DNS server to respond with 10.0.0.9 to any request for neohub.co.uk.<\/p>\n

\u00a0We then need to bring dnsmasq up. I want it to run with output to stderr, so this is done as follows:<\/p>\n

\u00a0dnsmasq -C dnsmasq.conf -H fakehosts.conf -d<\/span><\/b><\/p>\n

\u00a05. Configure and run hostapd<\/span><\/b><\/p>\n

\u00a0Next, we need to get our wireless adapter to run as a access point.<\/p>\n

\u00a0hostapd allows us to do this.<\/p>\n

\u00a0Install hostapd:<\/p>\n

\u00a0apt-get install hostapd<\/span><\/b><\/p>\n

\u00a0Create a config file hostapd.conf:<\/p>\n

\u00a0interface=wlan3<\/span><\/p>\n

\u00a0driver=nl80211<\/span><\/p>\n

\u00a0ssid=FreeAP-Internet<\/span><\/p>\n

\u00a0channel=1<\/span><\/p>\n

\u00a0Again \u2013 really simple. Use our additional wireless adapter wlan3 with the nl80211 drivers (which seem to cover pretty much all modern adapters than can be APs), set the SSID to FreeAP-Internet and set the channel to 1. There is no encryption etc. but I really don\u2019t need or want it for sniffing traffic.<\/p>\n

\u00a0Then start hostapd:<\/p>\n

\u00a0root@kali:~# hostapd .\/hostapd.conf <\/span><\/b><\/p>\n

\u00a0Configuration file: .\/hostapd.conf<\/p>\n

\u00a0Failed to update rate sets in kernel module<\/p>\n

\u00a0Using interface wlan3 with hwaddr c0:4a:00:1e:64:fd and ssid ‘FreeAP-Internet’<\/p>\n

<\/p>\n

<\/p>\n

If you get an Error about Driver just run this command and then try again : airmon-ng check kill<\/span><\/b><\/p>\n

\u00a06. Setup routing for the access point<\/span><\/b><\/p>\n

\u00a0You want a very simple setup at the moment \u2013 act as a basic NAT gateway between wlan3 and wlan0.<\/p>\n

\u00a0Without going into any detail, because we need forward the packets from another network adapters to wlan0 because we have internet connection on this adapter , the following commands will set this up:<\/p>\n

\u00a0sudo sysctl -w net.ipv4.ip_forward=1<\/span><\/b><\/p>\n

\u00a0sudo iptables -P FORWARD ACCEPT<\/span><\/b><\/p>\n

\u00a0sudo iptables –table nat -A POSTROUTING -o wlan0 -j MASQUERADE<\/span><\/b><\/p>\n

\u00a0At this stage, you should now be able to connect to FreeAP-Internet, get an IP address, and start using the Internet.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

I\u2019m working on a project at the moment that requires me to observe traffic from an iOS\/Android app or any other computer Apps to various external […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[224,227,229,230],"tags":[179,254,4,5,259,263,230,262,274,279],"class_list":["post-8283","post","type-post","status-publish","format-standard","hentry","category-dfir-and-incident-response","category-linux-and-open-source","category-network-and-protocol-security","category-penetration-testing","tag-dfir","tag-kali-linux","tag-linux","tag-network-security","tag-packet-analysis","tag-penetration-testing","tag-pki","tag-tls-ssl","tag-wi-fi"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8283"}],"version-history":[{"count":1,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8283\/revisions"}],"predecessor-version":[{"id":8611,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8283\/revisions\/8611"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}