Feel like a real hacker - intercept other users' data! The program allows you to intercept web sessions of users who are connected to the same Wi-Fi point as you.
Easy to use, lightweight and stable, the program will allow you to “hijack” the web sessions of other users. In practice, you will be able to “look” into another user’s mail, edit data in a social network account, and much more.
Characteristic
The DroidSniff program is designed to intercept user web sessions. This happens as follows. You connect to a public, non-password-protected hotspot, turn on the program, wait for the scan, and “connect” to the detected users.
The program provides the ability to follow links, open other people’s social accounts, “crack” into third-party mail, not to mention the ability to simply track the actions of an unknown person.
The program is based on the use of a vulnerability in the HTTP protocol, which protects only the login-password entry page, and further maintains the client-server connection by transmitting cookies, which are easily intercepted and can be used for their own purposes by attackers using programs such as DroidSniff.
Peculiarities
There are two points that we want to pay special attention to. Firstly, the application does not have Russian localization, so you will have to figure out the functionality yourself. Secondly, the program compares favorably with DroidSheep - it works on Android systems from version 4, and does it stably, quickly and without unnecessary hassle.
The developers of such a utility claim that it was created in American secret laboratories. Of course, the installation of such a program is done under the full responsibility of the user, since by reading another person’s information, he violates his rights.
More about the game
Among the benefits that such a program brings is the ability to take over another person’s account, read all his messages and send them on his behalf.
In addition, you can change the avatar photo or status of another person, as well as send and receive files, which is very convenient.
Installation and use
The program copies the original MAC code of another person’s mobile device, after which the device’s software believes that it was logged in from a regular smartphone or tablet. “WhatsApp Sniffer” can copy this code using a special SMS to the “victim”, which has a special link.
Opening such a link will allow the user to penetrate the “victim’s” phone. It is also possible to copy the MAC code through a call made to the “victim’s” phone from this application. Answering such a call will allow the program to penetrate the “victim’s” phone. Being close to the “victim” and using the same Wi-Fi, you can launch the program and indicate the victim’s phone number. Literally, in a second the program will penetrate another person’s phone.
“A smartphone with hacking tools? There is no such thing,” we would have told you just recently. It was possible to launch some of the usual tools for implementing attacks only on some Maemo. Now, many familiar tools have been ported to iOS and Android, and some hack-tools have been specially written for the mobile environment. Can a smartphone replace a laptop in penetration tests? We decided to check it out.
ANDROID
Android is a popular platform not only for mere mortals, but also for the right people. The number of useful ][-utilities here is simply off the charts. For this we can thank the UNIX roots of the system - this has greatly simplified the porting of many tools to Android. Unfortunately, Google does not allow some of them into the Play Store, so you will have to install the corresponding APK manually. Also, some utilities require maximum access to the system (for example, the iptables firewall), so you should take care of root access in advance. Each manufacturer uses its own technology here, but finding the necessary instructions is quite easy. A good set of HOWTOs was put together by the LifeHacker resource (bit.ly/eWgDlu). However, if you couldn’t find a particular model here, the XDA-Developers forum (www.xda-developers.com) always comes to the rescue, where you can find various information on virtually any model of Android phone. One way or another, some of the utilities described below will work without root access.
Let's start the review with an unusual package manager. The developers call it “utilities for superusers,” and this is not far from the truth. After installing BotBrew, you get a repository from where you can download a huge number of familiar tools compiled for Android. Among them: Python and Ruby interpreters for running numerous tools that are written in them, a tcpdump sniffer and an Nmap scanner for network analysis, Git and Subversion for working with version control systems, and much more.
Network scanners
An inconspicuous smartphone, which, unlike a laptop, fits easily into a pocket and never raises suspicion, can be useful for network exploration. We have already said above how you can install Nmap, but there is another option. PIPS is a port of the Nmap scanner specifically adapted for Android, albeit an unofficial one. This means you can quickly find active devices on the network, determine their OS using fingerprinting options, perform a port scan - in short, do everything that Nmap is capable of.
There are two problems with using Nmap, despite all its power. Firstly, the parameters for scanning are transmitted through launch keys, which you must not only know, but also be able to enter using an inconvenient mobile keyboard. And secondly, the scanning results in the console output are not as clear as we would like. The Fing scanner does not have these shortcomings; it very quickly scans the network, does fingerprinting, and then displays in a clear form a list of all available devices, dividing them by type (router, desktop, iPhone, and so on). At the same time, for each host you can quickly view a list of open ports. Moreover, right from here you can connect, say, to FTP, using the FTP client installed in the system - very convenient.
When it comes to analyzing a specific host, the NetAudit utility can be indispensable. It works on any Android device (even non-rooted) and allows you not only to quickly identify devices on the network, but also to examine them using a large fingerprinting database to determine the operating system, as well as CMS systems used on the web server. There are now more than 3,000 digital fingerprints in the database.
If, on the contrary, you need to work at a lower level and carefully examine the operation of the network, then you cannot do without Net Tools. This is an indispensable set of utilities for the work of a system administrator, which allows you to fully diagnose the operation of the network to which the device is connected. The package contains more than 15 different types of programs, such as ping, traceroute, arp, dns, netstat, route.
Traffic manipulation
The tcpdump-based sniffer honestly logs all data into a pcap file, which can then be studied using familiar utilities like Wireshark or Network Miner. Since no capabilities for MITM attacks are implemented in it, it is rather a tool for analyzing your traffic. For example, this is a great way to study what programs installed on your device from dubious repositories convey.
If we talk about combat applications for Android, then one of the most sensational is FaceNiff, which implements interception and injection into intercepted web sessions. By downloading the APK package with the program, you can run this hack tool on almost any Android smartphone and, by connecting to a wireless network, intercept accounts of a variety of services: Facebook, Twitter, VKontakte, and so on - more than ten in total. Session hijacking is carried out using the ARP spoofing attack, but the attack is only possible on unprotected connections (FaceNiff is not able to wedge into SSL traffic). To curb the flow of scriptdis, the author limited the maximum number of sessions to three - then you need to contact the developer for a special activation code.
If the creator of FaceNiff wants money for using it, then DroidSheep is a completely free tool with the same functionality. True, you won’t find the distribution kit on the official website (this is due to Germany’s harsh laws regarding security utilities), but it can be found on the Internet without any problems. The main task of the utility is to intercept user web sessions of popular social networks, implemented using the same ARP Spoofing. But there’s a problem with secure connections: like FaceNiff, DroidSheep flatly refuses to work with the HTTPS protocol.
This utility also demonstrates the insecurity of open wireless networks, but on a slightly different level. It does not intercept user sessions, but allows HTTP traffic to pass through itself using a spoofing attack, performing specified manipulations with it. Starting from ordinary pranks (replacing all the pictures on the site with trollfaces, flipping all the images or, say, replacing Google results) and ending with phishing attacks, when the user is given fake pages of such popular services as facebook.com, linkedin.com, vkontakte.ru and many others.
If you ask which hack utility for Android is the most powerful, then Anti probably has no competitors. This is a real hacker combine. The main task of the program is to scan the network perimeter. Next, various modules enter the battle, with the help of which a whole arsenal is implemented: eavesdropping on traffic, carrying out MITM attacks, and exploiting found vulnerabilities. True, there are also disadvantages. The first thing that catches your eye is that the exploitation of vulnerabilities is carried out only from the central program server, which is located on the Internet, as a result of which targets that do not have an external IP address can be forgotten.
Traffic tunneling
The well-known file manager is now on smartphones! As in the desktop version, there is a system of plugins for connecting to various network directories, as well as a canonical two-panel mode - especially convenient on tablets.
Okay, but how can you ensure the security of your data that is transmitted over an open wireless network? In addition to VPN, which Android supports out of the box, you can create an SSH tunnel. For this purpose, there is a wonderful SSH Tunnel utility, which allows you to route the traffic of selected applications or the entire system as a whole through a remote SSH server.
It is often necessary to send traffic through a proxy or SOX, and in this case ProxyDroid will help out. It's simple: you choose which application traffic you want to tunnel, and specify a proxy (HTTP/HTTPS/SOCKS4/SOCKS5 are supported). If authorization is required, ProxyDroid also supports this. By the way, the configuration can be linked to a specific wireless network by making different settings for each of them.
Wireless network
The built-in wireless network manager is not very informative. If you need to quickly get a complete picture of nearby access points, then the Wifi Analyzer utility is an excellent choice. It will not only show all nearby access points, but will also display the channel on which they operate, their MAC address and, most importantly, the type of encryption used (having seen the coveted letters “WEP”, we can assume that access to the secure network is provided ). In addition, the utility is ideal if you need to find where the desired access point is physically located, thanks to a visual signal strength indicator.
This utility, as its developer states, can be useful when the wireless network is filled to capacity with clients who use the entire channel, and it is at this moment that a good connection and stable connection is needed. WiFiKill allows you to disconnect clients from the Internet either selectively or based on a specific criterion (for example, it is possible to make fun of all the Yabloko members). The program simply performs an ARP spoofing attack and redirects all clients to themselves. This algorithm is stupidly simply implemented on the basis of iptables. This is the control panel for fast food wireless networks :).
Web application audit
Manipulating HTTP requests from a computer is a piece of cake; there are a huge number of utilities and browser plugins for this. In the case of a smartphone, everything is a little more complicated. HTTP Query Builder will help you send a custom HTTP request with the parameters you need, for example, the desired cookie or a changed User-Agent. The result of the request will be displayed in a standard browser.
If the site is password protected using Basic Access Authentication, then you can check its reliability using the Router Brute Force ADS 2 utility. Initially, the utility was created to brute force passwords on the router admin panel, but it is clear that it can be used against any other resource with similar protection . The utility works, but is clearly crude. For example, the developer does not provide for brute force, but only brute force using a dictionary.
Surely you have heard about such a sensational program for disabling web servers as Slowloris. The principle of its operation is to create and hold the maximum number of connections with a remote web server, thus preventing new clients from connecting to it. So, AnDOSid is an analogue of Slowloris right in your Android device! I'll tell you a secret, two hundred connections are enough to ensure unstable operation of every fourth website running the Apache web server. And all this - from your phone!
Various utilities
When working with many web applications and analyzing their logic, it is quite common to encounter data transmitted in encoded form, namely Base64. Encode will help you decode this data and see what exactly is stored in it. Perhaps, by substituting quotes, encoding them back into Base64 and substituting them in the URL of the site you are researching, you will get the coveted database query error.
If you need a hexadecimal editor, then there is one for Android too. With HexEditor you can edit any files, including system files, if you elevate the program's rights to superuser. An excellent replacement for a standard text editor, allowing you to easily find the desired piece of text and change it.
Remote access
Once you have access to a remote host, you need to be able to use it. And for this we need clients. Let's start with SSH, where ConnectBot is already the de facto standard. In addition to a convenient interface, it provides the ability to organize secure tunnels via SSH connections.
A useful program that allows you to connect to a remote desktop via RDP or VNC services. I’m very glad that these are two clients in one; there is no need to use different tools for RDP and VNC.
A MIB browser specially written for Android, with which you can manage network devices using the SNMP protocol. It can be useful for developing an attack vector on various routers, because the standard community string (in other words, an access password) for management via SNMP has not yet been canceled.
iOS
The iOS platform is no less popular among security utility developers. But if in the case of Android, root rights were needed only for some applications, then on Apple devices, jailbreaking is almost always required. Fortunately, even for the latest iDevices firmware (5.1.1) there is already a jailbreak tool. Along with full access, you also get an alternative application manager, Cydia, which already contains many utilities.
Working with the system
The first thing I want to start with is installing the terminal. For obvious reasons, it is not included in the standard delivery of the mobile OS, but we will need it to run console utilities, which we will discuss further. The best implementation of a terminal emulator is MobileTerminal - it supports multiple terminals, control gestures (for example, for sending Control-C) and is generally impressive in its thoughtfulness.
Another, more complex option to gain access to the device's console is to install OpenSSH on it (this is done through Cydia) and connect to it locally through an SSH client. If you use the right client like iSSH, which has amazing touch screen control, then this method is even more convenient than using MobileTerminal.
Data interception
Now that you have access to the console, you can try the utilities. Let's start with Pirni, which went down in history as a full-fledged sniffer for iOS. Unfortunately, the structurally limited Wi-Fi module built into the device cannot be switched to the promiscuous mode necessary for normal data interception. So to intercept data, classic ARP spoofing is used, with the help of which all traffic is passed through the device itself. The standard version of the utility is launched from the console, where, in addition to the MITM attack parameters, the name of the PCAP file is specified, into which all traffic is logged. The utility has a more advanced version - Pirni Pro, which boasts a graphical interface. Moreover, it can parse HTTP traffic on the fly and even automatically extract interesting data from it (for example, logins and passwords), using regular expressions that are specified in the settings.
The well-known sniffer Intercepter-NG, which we have written about several times, has recently had a console version. As the author says, most of the code is written in pure ANSI C, which behaves the same in almost any environment, so the console version worked from the very beginning both on desktop Windows, Linux and BSD, and on mobile platforms, including iOS and Android . The console version already implements grabbing passwords transmitted over a variety of protocols, intercepting instant messenger messages (ICQ/Jabber and many others), as well as recovering files from traffic (HTTP/FTP/IMAP/POP3/SMTP/SMB). At the same time, network scanning functions and high-quality ARP Poison are available. For correct operation, you must first install the libpcap package via Cydia (don’t forget to enable development packages in the settings). All startup instructions boil down to setting the correct rights: chmod +x intercepter_ios. Next, if you run the sniffer without parameters, a clear interactive Itercepter interface will appear, allowing you to launch any attacks.
It’s hard to believe, but this sophisticated tool for implementing MITM attacks was finally ported to iOS. After a tremendous amount of work, we managed to make a full-fledged mobile port. To save yourself from dancing with a tambourine around dependencies during self-compilation, it is better to install an already built package using Cydia, after adding theworm.altervista.org/cydia (TWRepo repository) as a data source. The kit also includes the etterlog utility, which helps to extract various types of useful information from the collected traffic dump (for example, FTP access accounts).
Wireless network analysis
In older versions of iOS, craftsmen ran aircrack and could break the WEP key, but we checked: the program does not work on new devices. Therefore, to study Wi-Fi, we will have to be content with only Wi-Fi scanners. WiFi Analyzer analyzes and displays information about all available 802.11 networks around you, including information about SSID, channels, vendors, MAC addresses and encryption types. The utility builds visual graphs in real time based on the data present on the air. With such a program it is easy to find the physical location of the point if you suddenly forget it, and, for example, look at the WPS PIN, which can be useful for connecting.
Network scanners
What program does any penetration tester use anywhere in the world, regardless of goals and objectives? Network scanner. And in the case of iOS, this will most likely be the most powerful Scany toolkit. Thanks to a set of built-in utilities, you can quickly get a detailed picture of network devices and, for example, open ports. In addition, the package includes network testing utilities such as ping, traceroute, nslookup.
However, many people prefer Fing. The scanner has quite simple and limited functionality, but it is quite enough for the first acquaintance with the network of, say, a cafeteria :). The results display information about available services on remote machines, MAC addresses and host names connected to the scanned network.
It would seem that everyone has forgotten about Nikto, but why? After all, you can easily install this web vulnerability scanner, written in a script language (namely Perl), via Cydia. This means that you can easily launch it on your jailbroken device from the terminal. Nikto will be happy to provide you with additional information on the tested web resource. In addition, you can add your own search signatures to its knowledge database with your own hands.
This powerful tool for automatically exploiting SQL vulnerabilities is written in Python, which means that once you install the interpreter, you can easily use it directly from your mobile device.
Remote control
Many network devices (including expensive routers) are managed using the SNMP protocol. This utility allows you to scan subnets for available SNMP services with pre-known community string values (in other words, standard passwords). Note that searching for SNMP services with standard community strings (public/private) in an attempt to gain access to device management is an integral part of any penetration test, along with identifying the perimeter itself and identifying services.
Two utilities from the same manufacturer are designed to connect to a remote desktop using the RDP and VNC protocols. There are many similar utilities in the App Store, but these are the ones that are especially easy to use.
Password recovery
The legendary program that helps millions of hackers around the world “remember” their password has been ported to iOS. Now you can search passwords for services such as HTTP, FTP, TELNET, SSH, SMB, VNC, SMTP, POP3 and many others directly from your iPhone. True, for a more effective attack, it is better to stock up on good brute force dictionaries.
Everyone knows firsthand the vulnerability of using standard passwords. Pass Mule is a kind of directory that contains all kinds of standard logins and passwords for network devices. They are conveniently organized by vendor name, product, and model, so finding the one you need won't be difficult. The program is rather designed to save time on searching for a manual for the router, the standard login and password for which you need to find out.
Exploiting vulnerabilities
It’s hard to imagine a more hacking utility than Metasploit, and that’s what concludes our review today. Metasploit is a package of various tools whose main task is to exploit vulnerabilities in software. Imagine: about 1000 reliable, proven and necessary exploits in the daily life of a pentester - right on your smartphone! With the help of such a tool you can really establish yourself in any network. Metasploit not only allows you to exploit flaws in server applications - tools are also available to attack client applications (for example, through the Browser Autopwn module, when a combat payload is inserted into client traffic). Here it must be said that there is no mobile version of the toolkit, however, you can install a standard package on an Apple device using .
", an almost similar article about Android was born.
We already know what the iPhone is capable of. Is Android inferior to it?
About 25 combat applications were reviewed. I would like to provide you with the result of a small study. Many applications did not even launch, some froze the phone, but some even worked!
All software was tested on an LG Optimus phone with Android version 2.3.
So, a brief overview of combat software on Android:
1. Shark- The same wireshark. Yes, it is also available for Android. Works flawlessly. The device started up without problems. Writes logs in *.pcap format. Adds to sdcard. The file can be easily parsed both on a Windows machine and on the phone itself using Shark Read. (Good application. Especially if the phone works as a WiFi access point)
2. DroidSheep/Facesniff- Interception of web sessions. Quite simple, but sensational applications. We cling to an open point, launch and wait... By the way, sometimes you can hang the point itself.
3. WiFiKill- An application from the must-have series. Scans the entire subnet you are on. Displays a list of devices. Select the one you don’t like, click on the checkbox and wait a couple of seconds. The device remains without Internet.
4. Set MAC address- Changes your MAC. Works well in conjunction with step 3.
5. Net Swiss Tool Free/Fing- Scans wireless networks, displays a list of connected devices. It can scan each device separately and provide a list of open ports. The vessels include ping, trace, wake on lan, arp, udp-flood. 
6. Wi-Fi Analytics- Beautiful application. Displays all available access points, SSID, mac, encryption, signal strength.
7. Hosts Editor- Allows you to edit /etc/hosts. A useful application, especially when the phone acts as a WiFi point.
8. kWS - Android Web Server- web server. Works well together with point 7.
9. RouterAttack / Route Brute Force ADS 2- Real BruteForce on Android! Each application tries to force Basic Access Authentication. The software itself is a little damp. But I got through my point, with the password 12345, quite easily and quickly. For normal operation, do not forget to download a good dictionary.
10. Router KeyGen- selects pre-installed WPA/WEP access keys for your Android smartphone from nearby routers. Works well with standard Thomson, DLink, Pirelli Discus, Eircom, Verizon FiOS.
11.Android Network Toolkit - Anti- Universal application. Network scanner, sniffer, MITM, Remote Exploits! Expandable functionality through plugins. The more functionality, the more money it costs.
Most of the applications require root rights.
This article is written for informational purposes!
“A smartphone with hacking tools? There is no such thing,” we would have told you just recently. It was possible to launch the usual tools for implementing attacks only on some Maemo. Now many tools have been ported to iOS and Android, and some hack-tools have been specially written for the mobile environment. Can a smartphone replace a laptop in penetration tests? We decided to check it out.
Android is a popular platform not only for mere mortals, but also for the right people. The number of useful utilities here is simply off the charts. For this we can thank the UNIX roots of the system, which greatly simplified the porting of many tools to Android. Unfortunately, Google does not allow some of them into the Play Store, so you will have to install the corresponding APK manually. Also, some utilities require maximum access to the system (for example, the iptables firewall), so you should take care of root access in advance.
Each manufacturer uses its own technology here, but finding the necessary instructions is quite easy. A good set of HOWTOs was put together by the LifeHacker resource (bit.ly/eWgDlu). However, if you couldn’t find a particular model here, the XDA-Developers forum (www.xda-developers.com) always comes to the rescue, where you can find various information on virtually any model of Android phone. One way or another, some of the utilities described below will work without root access. So, we present to you hacking utilities for Android.
Package Manager:
Let's start the review with an unusual package manager. The developers call it “utilities for superusers,” and this is not far from the truth. After installing BotBrew, you get a repository from where you can download a huge number of familiar tools compiled for Android. Among them: Python and Ruby interpreters for running numerous tools that are written in them, a tcpdump sniffer and an Nmap scanner for network analysis, Git and Subversion for working with version control systems, and much more.
Network scanners:
An inconspicuous smartphone, which, unlike a laptop, fits easily into a pocket and never raises suspicion, can be useful for network exploration. We have already said above how you can install Nmap, but there is another option. PIPS is a port of the Nmap scanner specifically adapted for Android, albeit an unofficial one. This means you can quickly find active devices on the network, determine their OS using fingerprinting options, perform a port scan - in short, do everything that Nmap is capable of.
l
There are two problems with using Nmap, despite all its power. Firstly, the parameters for scanning are transmitted through launch keys, which you must not only know, but also be able to enter using an inconvenient mobile keyboard. And secondly, the scanning results in the console output are not as clear as we would like. The Fing scanner does not have these shortcomings; it very quickly scans the network, does fingerprinting, and then displays in a clear form a list of all available devices, dividing them by type (router, desktop, iPhone, and so on). At the same time, for each host you can quickly view a list of open ports. Moreover, right from here you can connect, say, to FTP, using the FTP client installed in the system - very convenient.
When it comes to analyzing a specific host, the NetAudit utility can be indispensable. It works on any Android device (even non-rooted) and allows you not only to quickly identify devices on the network, but also to examine them using a large fingerprinting database to determine the operating system, as well as CMS systems used on the web server. There are now more than 3,000 digital fingerprints in the database.
If, on the contrary, you need to work at a lower level and carefully examine the operation of the network, then you cannot do without Net Tools. This is an indispensable set of utilities for the work of a system administrator, which allows you to fully diagnose the operation of the network to which the device is connected. The package contains more than 15 different types of programs, such as ping, traceroute, arp, dns, netstat, route.
Wi-fi monitor mode in android:
All WiFi modules have a special monitor mode. This mode can also be used for sniffing, intercepting and cracking passwords. However, in Android devices, due to hardware limitations, access to this mode is closed. The fact is that most Android smartphones use the same ones from Broadcom - bcm4329 or bcm4330, which do not work in a completely standard way.
The website contains instructions for activating monitor mode on Nexus One (Cyanogen 7) and GS2 (Cyanogen 9). Ready-made packages can be downloaded.
To run the code on other devices, you need to download the source code yourself and compile the package.
TRAFFIC MANIPULATIONS:
The tcpdump-based sniffer honestly logs all data into a pcap file, which can then be studied using familiar utilities like Wireshark or Network Miner. Since no capabilities for MITM attacks are implemented in it, it is rather a tool for analyzing your traffic. For example, this is a great way to study what programs installed on your device from dubious repositories convey.
If we talk about combat applications for Android, then one of the most sensational is FaceNiff, which implements interception and injection into intercepted web sessions. By downloading the APK package with the program, you can run this hack tool on almost any Android smartphone and, by connecting to a wireless network, intercept accounts of a variety of services: Facebook, Twitter, VKontakte, and so on - more than ten in total. Session hijacking is carried out using the ARP spoofing attack, but the attack is only possible on unprotected connections (FaceNiff is not able to wedge into SSL traffic). To curb the flow of scriptkidies, the author limited the maximum number of sessions to three.
l
If the creator of FaceNiff wants money for using it, then DroidSheep is a completely free tool with the same functionality. True, you won’t find the distribution kit on the official website (this is due to Germany’s harsh laws regarding security utilities), but it can be found on the Internet without any problems. The main task of the utility is to intercept user web sessions of popular social networks, implemented using the same ARP Spoofing. But there’s a problem with secure connections: like FaceNiff, DroidSheep flatly refuses to work with the HTTPS protocol.
This utility also demonstrates the insecurity of open wireless networks, but on a slightly different level. It does not intercept user sessions, but allows HTTP traffic to pass through itself using a spoofing attack, performing specified manipulations with it. Starting from ordinary pranks (replacing all the pictures on the site with trollfaces, flipping all the images or, say, replacing Google results) and ending with phishing attacks, when the user is given fake pages of such popular services as facebook.com, linkedin.com, vkontakte.ru and many others.
If you ask which hack utility for Android is the most powerful, then Anti probably has no competitors. This is a real hacker combine. The main task of the program is to scan the network perimeter. Next, various modules enter the battle, with the help of which a whole arsenal is implemented: eavesdropping on traffic, carrying out MITM attacks, and exploiting found vulnerabilities. True, there are also disadvantages. The first thing that catches your eye is that the exploitation of vulnerabilities is carried out only from the central program server, which is located on the Internet, as a result of which targets that do not have an external IP address can be forgotten.
TRAFFIC TUNNELING:
Okay, but how can you ensure the security of your data that is transmitted over an open wireless network? In addition to VPN, which Android supports out of the box, you can create an SSH tunnel. For this purpose, there is a wonderful SSH Tunnel utility, which allows you to route the traffic of selected applications or the entire system as a whole through a remote SSH server.
It is often necessary to send traffic through a proxy or SOX, and in this case ProxyDroid will help out. It's simple: you choose which application traffic you want to tunnel, and specify a proxy (HTTP/HTTPS/SOCKS4/SOCKS5 are supported). If authorization is required, ProxyDroid also supports this. By the way, the configuration can be linked to a specific wireless network by making different settings for each of them.
WIRELESS NETWORK:
The built-in wireless network manager is not very informative. If you need to quickly get a complete picture of nearby access points, then the Wifi Analyzer utility is an excellent choice. It will not only show all nearby access points, but will also display the channel on which they operate, their MAC address and, most importantly, the type of encryption used (having seen the coveted letters “WEP”, we can assume that access to the secure network is provided ). In addition, the utility is ideal if you need to find where the desired access point is physically located, thanks to a visual signal strength indicator.
This utility, as its developer states, can be useful when the wireless network is filled to capacity with clients, and it is at this moment that a good connection and stable connection is needed. WiFiKill allows you to disconnect clients from the Internet either selectively or based on a specific criterion (for example, it is possible to make fun of all the Yabloko members). The program simply performs an ARP spoofing attack and redirects all clients to themselves. This algorithm is stupidly simply implemented on the basis of iptables. This is the control panel for fast food wireless networks.
WEB APPLICATION AUDIT:
Manipulating HTTP requests from a computer is a piece of cake; there are a huge number of utilities and browser plugins for this. In the case of a smartphone, everything is a little more complicated. HTTP Query Builder will help you send a custom HTTP request with the parameters you need, for example, the desired cookie or a changed User-Agent. The result of the request will be displayed in a standard browser.
If the site is password protected using Basic Access Authentication, then you can check its reliability using the Router Brute Force ADS 2 utility. Initially, the utility was created to brute force passwords on the router admin panel, but it is clear that it can be used against any other resource with similar protection . The utility works, but is clearly crude. For example, the developer does not provide for brute force, but only brute force using a dictionary.
Surely you have heard about such a program for disabling web servers as Slowloris. The principle of its operation is to create and hold the maximum number of connections with a remote web server, thus preventing new clients from connecting to it. So, AnDOSid is an analogue of Slowloris right in your Android device! It's sad, but two hundred connections is often enough to render one in four Apache websites unstable.
VARIOUS USES:
When working with many web applications and analyzing their logic, it is quite common to encounter data transmitted in encoded form, namely Base64. Encode will help you decode this data and see what exactly is stored in it. Perhaps, by substituting quotes, encoding them back into Base64 and substituting them in the URL of the site you are researching, you will get the coveted database query error.
If you need a hexadecimal editor, then there is one for Android too. With HexEditor you can edit any files, including system files, if you elevate the program's rights to superuser. An excellent replacement for a standard text editor, allowing you to easily find the desired piece of text and change it.
REMOTE ACCESS:
Once you have access to a remote host, you need to be able to use it. And for this we need clients. Let's start with SSH, where ConnectBot is already the de facto standard. In addition to a convenient interface, it provides the ability to organize secure tunnels via SSH connections.
A useful program that allows you to connect to a remote desktop via RDP or VNC services. I’m very glad that these are two clients in one; there is no need to use different tools for RDP and VNC.
A MIB browser specially written for Android, with which you can manage network devices using the SNMP protocol. It can be useful for developing an attack vector on various routers, because the standard community string (in other words, an access password) for management via SNMP has not yet been canceled.
IPHONE
The iOS platform is no less popular among security utility developers. But if in the case of Android, root rights were needed only for some applications, then on Apple devices, jailbreaking is almost always required. Fortunately, even for the latest iDevices firmware (5.1.1) there is already a jailbreak tool. Along with full access, you also get an alternative application manager, Cydia, which already contains many utilities.
OPERATING THE SYSTEM:
The first thing I want to start with is installing the terminal. For obvious reasons, it is not included in the standard delivery of the mobile OS, but we will need it to run console utilities, which we will discuss further. The best implementation of a terminal emulator is MobileTerminal - it supports multiple terminals at once, gestures for control (for example, for sending
Another, more complex option to gain access to the device's console is to install OpenSSH on it (this is done through Cydia) and connect to it locally through an SSH client. If you use the right client like iSSH, which has amazing touchscreen control, you can work with the local console and remote hosts from one place.
DATA INTERCEPTION:
Now that you have access to the console, you can try the utilities. Let's start with Pirni, the first full-fledged sniffer for iOS. The structurally limited Wi-Fi module built into iDevices cannot be switched to the promiscuous mode necessary for normal data interception. So for sniffing, classic ARP spoofing is used, with the help of which all traffic is passed through the device itself. The standard version of the utility is launched from the console, but there is a more advanced version - Pirni Pro, which boasts a graphical interface. Moreover, it can parse HTTP traffic on the fly and even automatically extract interesting data from it (for example, logins and passwords), using regular expressions that are specified in the settings.
The well-known sniffer Intercepter-NG has recently had a console version that works on iOS and Android. It already implements grabbing passwords transmitted over a variety of protocols, intercepting instant messenger messages, and also resurrecting files from traffic. At the same time, network scanning functions and high-quality ARP Poison are available. To work, you must first install the libpcap package via Cydia. All startup instructions boil down to setting the correct rights: chmod +x intercepter_ios. Next, if you run the sniffer without parameters, a clear interactive interface will appear.
It’s hard to believe, but this sophisticated tool for implementing MITM attacks was finally ported to iOS. After a tremendous amount of work, we managed to make a full-fledged mobile port. To save yourself from dancing with a tambourine around dependencies during self-compilation, it is better to install an already built package using Cydia, after adding heworm.altervista.org/cydia as a data source. The kit also includes the etterlog utility, which helps to extract various types of useful information from the collected traffic dump (for example, FTP accounts).
WIRELESS NETWORK ANALYSIS:
In older versions of iOS, craftsmen ran aircrack and could break the WEP key, but we checked: the program does not work on new devices. Therefore, to study Wi-Fi, we will have to be content with only Wi-Fi scanners. WiFi Analyzer analyzes and displays information about all available 802.11 networks around you, including information about SSID, channels, vendors, MAC addresses and encryption types. With such a program it is easy to find the physical location of the point if you suddenly forget it, and, for example, look at the written WPS PIN required for connection.
NETWORK SCANNARS:
What program does any penetration tester use anywhere in the world, regardless of goals and objectives? Network scanner. And in the case of iOS, this will most likely be the most powerful Scany toolkit. Thanks to a set of built-in utilities, you can quickly get a detailed picture of network devices and, for example, open ports. In addition, the package includes network testing utilities such as ping, traceroute, nslookup.
However, many people prefer Fing. The scanner has quite simple and limited functionality, but it is quite enough for the first acquaintance with the network of, say, a cafeteria :). The results display information about available services on remote machines, MAC
addresses and names of hosts connected to the scanned network.
It would seem that everyone has forgotten about Nikto, but why? After all, you can easily install this web vulnerability scanner, written in a script language (namely Perl), via Cydia. This means that you can easily launch it on your jailbroken device from the terminal. Nikto will be happy to provide you with additional information on the tested web resource. In addition, you can add your own search signatures to its knowledge database with your own hands.
REMOTE CONTROL:
Many network devices (including expensive routers) are managed using the SNMP protocol. This utility allows you to scan subnets for available SNMP services with a previously known community string value (in other words, standard passwords). Note that searching for SNMP services with standard community strings (public/private) in an attempt to gain access to device management is an integral part of any penetration test, along with
identification of the perimeter itself and identification of services.
Two utilities from the same manufacturer are designed to connect to a remote desktop using the RDP and VNC protocols. There are many similar utilities in the App Store, but these are the ones that are especially easy to use.
PASSWORD RESTORE:
The legendary program that helps millions of hackers around the world “remember” their password has been ported to iOS. Now you can search passwords for services such as HTTP, FTP, Telnet, SSH, SMB, VNC, SMTP, POP3 and many others directly from your iPhone. True, for a more effective attack, it is better to stock up on good brute force dictionaries.
Everyone knows firsthand the vulnerability of using standard passwords. PassMule is a kind of directory that contains all kinds of standard logins and passwords for network devices. They are conveniently organized by vendor name, product, and model, so finding the one you need won't be difficult.
EXPLOITATION OF VULNERABILITIES:
METASPLOIT
www.metasploit.com
It’s hard to imagine a more hacking utility than Metasploit, and that’s what concludes our review today. Metasploit is a package of various tools whose main task is to exploit vulnerabilities in software. Imagine: about 1000 reliable, proven and necessary exploits in the daily life of a pentester - right on your smartphone! With the help of such a tool you can really establish yourself in any network. Metasploit not only allows you to exploit flaws in server applications - tools are also available to attack client applications (for example, through the Browser Autopwn module, when a combat payload is inserted into client traffic). There is no mobile version of the toolkit, but you can install the standard package on an Apple device using
