After getting the mac I too am poor, and my family are pretty hungry!

Hi guys,

i've recently gotten hold of a macbook and i gotta say that i'm totally lovin it.  Now I have it running pretty well with kismet (yes that's kismet), nmap, metasploiot, ettercap etc... and all seems to be working well.

My question is, do any of you pentesters out there use a mac as your main pentest platform? or  through experience have you found it to not be as flexible as Linux?

i've done a little testing in the week that i've had it and it seems to be working well but I just wondered if theres a "gotcha" just waiting to happen.

Any thoughts on this would be great.

Cheers

Syn

p.s Has anyone read Johnny Long's book on OS X Hacking and if so was it any good?

Welcome outsourcethis, and well done on the CEH.

Syn

sgt_mjc

in answer to your question, there's a few ways you could do this as i see it.  You could move the AP onto the LAN and arp poison between that and the gateway, however this does place your LAN at risk if not done properly.  An approach I like which worked well for me in the past was to set up an old box with PFSense on and 3 network interfaces.  I then put an AP onto the DMZ interface and used the PFSense box to capture all traffic that flowed from the DMZ to the outside interface.  This got me what I wanted and did not put my LAN at risk.

I'm sure there are a load more ways to do this, but this worked for me.

Hope that helps.

Syn

oh, one last thing from me on this.  I believe that there are ways of disabling the SSID broadcast altogether (if your router supports it), but be aware that any clients connecting will likely broadcast it initially. So you might want to be aware of that point.

Cheers

Syn

Thanks for the compliment on my blog, i appreciate it.

one other thing, you could play around with the DHCP scope, can you limit the leases handed out and move the subnet to something other than 192.168.1.x

This, along with your other measures makes an attackers job a little harder.

Regards

Syn

P.S or you could be plain evil, by securing it slightly so you know whoever uses it has used it knowing that they have bypassed your security, and then put an old linux box between your AP and the internet and capture all the traffic.  Sorry, i shouldn't think out loud, i'd better put that hat away again ;-)

Put it this way.  You've done enough for someone like me to move on and find another wifi access point!

i know you would have but i'll ask anyway. 

Have you changed the default password, disabled wireless administration and upgraded the firmware?

Syn

from what i hear the timeout (i actually heard it was a capture???) acts differently depending on how you access the account, i.e the wbsite locks you out, fine you can get in using your blackberry! a little more work needs to done it would seem.

I can only echo Don's comments, but also I use my blog to keep my mind on track and to help me focus, otherwise i'm like "oh nmap upgrade gotta give that a look" and "wow i didn't know hping could do that, let me try", then "metasploit can do that too. let me see".  And all this happens in the space of a few minutes so the result is nothing gets really looked at in any level of detail. 

And the problem?  Well the truth is that all these tools, techniques and websites are all so cool and interesting and it's hard to keep focused.  So i use my blog to do just that.  I pick something that interests me and try to come up with enough material in my spare time for a post each week.

hope that help.  Sorry for rambling.

Syn

Bruteforcing a waste of time?  Can anyone say "Twitter"!!!

http://blog.wired.com/27bstroke6/2009/01/professed-twitt.html

Syn

Think I heard Brett and Ovie talking about that a few weeks ago on CyberSpeak, it had gone right out of my head but i'm chuffed to see it put into play perfectly.

:-)

Cheers Chris.  I was thinking of tools to gather information that I can enumerate through a null session on Linux.

I'm a really big fan of the Cyber fiction genre such as the Stealing the Network Series, published by Syngress.

Harlan Carvey's "Window Forensics and Incident Recovery" is also one of my favourites.

Regards

Syn

Here you go.

http://www.sans.org/training/description.php?mid=1107

Regards

Syn