Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 96 guests and 1 member online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Wirelessarrow colubris wireless tech
EH-Net
May 26, 2012, 06:33:32 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: colubris wireless tech  (Read 5860 times)
0 Members and 2 Guests are viewing this topic.
rebrov
Full Member
***
Offline Offline

Posts: 128



View Profile
« on: June 17, 2011, 08:47:15 AM »

well im trying to intercept AP signal transmitting around my home i found out with wireshark that its colubris Access point its hidden completely i can't find it via airodump or anything just wireshark ....

searched on google for while found out its the most security over wireless access points so....in real life like this im just intercepting communication between two spots the user i think and man in the middle and the access point how to connect to this access point ??

what is the next steps in this pentesting operation ...?
Logged
hayabusa
Hero Member
*****
Offline Offline

Posts: 1304



View Profile
« Reply #1 on: June 17, 2011, 09:14:49 AM »

If you use kismet (Linux) you should see it, typically, IF someone else attaches to it and uses it.  While SSID's aren't broadcast when they're hidden, they still HAVE to transmit in the packets, with authenticated machines / machines that KNOW about the AP, to talk to it, and kismet will then pick them up.
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCP , GPEN, C|EH
rebrov
Full Member
***
Offline Offline

Posts: 128



View Profile
« Reply #2 on: June 17, 2011, 10:24:44 AM »

If you use kismet (Linux) you should see it, typically, IF someone else attaches to it and uses it.  While SSID's aren't broadcast when they're hidden, they still HAVE to transmit in the packets, with authenticated machines / machines that KNOW about the AP, to talk to it, and kismet will then pick them up.

ya buddy i know that but i believe they sending to each others in encrypted data

but the question can't i connect to any access point with just the mac ?

and what if no one appear to connected to it not in kismet at least !! ?
Logged
hayabusa
Hero Member
*****
Offline Offline

Posts: 1304



View Profile
« Reply #3 on: June 17, 2011, 11:11:47 AM »

You could force a deauthentication against an already authenticated client, and get the SSID that way (that's how I would get the SSID, by forcing a client to resend the SSID in an authentication packet.)  This is also how you go about speeding the process with WEP cracking, etc, as you need enough weak IV's to crack the key, and by deauth'ing attached clients, repeatedly, you force them to resend the SSID and data enough to crack it.

That way, because the client is not yet associated, fully, with the AP's encryption in play, the SSID will be transmitted in the clear, as it would anytime a new client would associate to the AP.

Edit:  To answer your last queston:

and what if no one appear to connected to it not in kismet at least !! ?

IF nobody's connected, yet, and you don't already have the SSID, you'll have to wait until someone tries to connect...
« Last Edit: June 17, 2011, 11:13:27 AM by hayabusa » Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCP , GPEN, C|EH
rebrov
Full Member
***
Offline Offline

Posts: 128



View Profile
« Reply #4 on: June 18, 2011, 05:06:12 AM »

You could force a deauthentication against an already authenticated client, and get the SSID that way (that's how I would get the SSID, by forcing a client to resend the SSID in an authentication packet.)  This is also how you go about speeding the process with WEP cracking, etc, as you need enough weak IV's to crack the key, and by deauth'ing attached clients, repeatedly, you force them to resend the SSID and data enough to crack it.

That way, because the client is not yet associated, fully, with the AP's encryption in play, the SSID will be transmitted in the clear, as it would anytime a new client would associate to the AP.

Edit:  To answer your last queston:

and what if no one appear to connected to it not in kismet at least !! ?

IF nobody's connected, yet, and you don't already have the SSID, you'll have to wait until someone tries to connect...

when im sniffing with wireshark i see communication happining with 3 sides i think with that access point but with airodunp or kismet u dont see anything how is that possible that there's some one connecting to this AP but doesn't appear on airodump  ??

and if that was encrypted video streaming ...wireshark doen't decrypt that

and check this page out to know what im trying to say and to think the way im thinking Smiley http://www.connect802.com/colubris.htm

thanks buddy
Logged
chrisj
Hero Member
*****
Offline Offline

Posts: 997


View Profile
« Reply #5 on: June 18, 2011, 08:28:38 PM »

I'm not getting how you see it in Wireshark but not in anything else. All airodump does, is dumps all the packets that the wireless card sees. Sort of like TCPDump, but wireless.

My thoughts: Are you using the hardware that can talks the same freqs as the ap and clients? a/b/g/n? Something else?

Are you sure, since you're only seeing it in 1 packet capture device, that it's not a false positive?

are you sure it's actually the AP, and not someone's client trying to connect to an ap?

If the data is encrypted, you'll still see it transverse the air with the sniffers, you just won't be able to read it.
Logged

OSWP, Sec+
hayabusa
Hero Member
*****
Offline Offline

Posts: 1304



View Profile
« Reply #6 on: June 18, 2011, 09:16:02 PM »

Whew...  So I'm not the only one confused by his dilemma.  We're glad to keep helping, rebrov.  But something doesn't make sense, unless we're ALL misunderstanding you...
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCP , GPEN, C|EH
rebrov
Full Member
***
Offline Offline

Posts: 128



View Profile
« Reply #7 on: June 19, 2011, 08:53:02 AM »

well i'll try to get more info next time to help u guys understand me more Smiley thanks for replying so far anyway Smiley
Logged
chrisj
Hero Member
*****
Offline Offline

Posts: 997


View Profile
« Reply #8 on: June 19, 2011, 05:26:58 PM »

I'm curious, so I look forward to more info.
Logged

OSWP, Sec+
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.14 seconds with 19 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.