Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 54 guests and 2 members online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow General Certificationarrow tool to dissociate wireless clients?
EH-Net
May 19, 2013, 09:12:08 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: tool to dissociate wireless clients?  (Read 6692 times)
0 Members and 1 Guest are viewing this topic.
SephStorm
Hero Member
*****
Offline Offline

Posts: 530


View Profile WWW
« on: September 15, 2012, 12:14:12 PM »

We have people connecting to a WAP that we are in charge of, but dont have admin access to, the service provider tells us that individuals are using the WiFi to download stuff, assuredly movies and other such stuff. Is there a tool that could dissociate wireless clients?
Logged

jinwald12
Jr. Member
**
Offline Offline

Posts: 77



View Profile
« Reply #1 on: September 15, 2012, 12:31:30 PM »

Mdk3 will suit your needs if scripted, or you can look into http://openwips-ng.org/index.html however it is immature at  this time.
Logged

where did all the fun go?
m0wgli
Full Member
***
Offline Offline

Posts: 246


View Profile
« Reply #2 on: September 15, 2012, 02:59:54 PM »

Why can't the AP be secured?

If it's someone whose supposed to be using the AP that is responsible for the questionable behaviour as identified by the ISP, then no wireless security measure is going to help anyhow. 

An acceptable use policy may be some cover from any comeback on yourselves from it's abuse (I'm not a lawyer, so don't take that advice as absolute).

If it's someone that's not supposed to be using it, the problem with any disassociation method is that it will be MAC based as far as I'm aware. Whats to stop them from changing their MAC address and regaining access?

Anyhow, in addition to the advice already given, Aireplay from the Aircrack suite can also achieve this.



Logged

Security + | OSWP | eCPPT | CSTA
SecurityMonkey
Jr. Member
**
Offline Offline

Posts: 89



View Profile WWW
« Reply #3 on: September 15, 2012, 04:19:34 PM »

You could try using Aircrack-ng to send deauthentication packets to kick the device offline....

http://www.aircrack-ng.org/doku.php?id=deauthentication
Logged

chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #4 on: September 15, 2012, 05:27:21 PM »

The problem with aircrack, the device will try to re-connect.

How are you required to be in charge of it, if you don't have admin access to it. What do they expect you to do, to be in charge of it?

Is the ISP in charge of it?

Maybe overkill, but figure out where those people are connecting from, if possible. Deploy fake WAPs in those locations. Access points without internet access. Same name, stronger signal than the real WAP. Look into authentication options if you can.
Logged

OSWP, Sec+
shadowzero
Full Member
***
Offline Offline

Posts: 120


It's a UNIX system, I know this!


View Profile
« Reply #5 on: September 15, 2012, 05:35:06 PM »

Disassociating clients is just a temporary measure that the client can easily work around. Better to just secure the AP itself to prevent these people from connecting. If the ISP expects you to secure it, tell them to give you admin access, or have them send someone with admin access to deal with it.
Logged
jjwinter
Jr. Member
**
Offline Offline

Posts: 75


View Profile
« Reply #6 on: September 15, 2012, 09:29:36 PM »

Wireless issues aside, you could deploy Untangle behind the AP and filter any torrent-like activity, and block other undesirable stuff. You could also present an Acceptable Use policy users must click on.

I ran into a similar situation at a public library that offers free open wifi. The Untangle box made all the would-be torrent folks pick up and move on.





Logged
SephStorm
Hero Member
*****
Offline Offline

Posts: 530


View Profile WWW
« Reply #7 on: September 16, 2012, 02:06:03 AM »

This is a basic rundown, we are using  temporary site, and there is a contract here that provides for wireless access. When we originally came to the site, the wifi was decent. We noticed significant issues as time went on, from users only being able to load 1-2 pages, ect. Well, the bosses called the company who did a survey. They stated it was users downloading from the living area while they were at the work site. Now I suggested that they ask the company to block the commonly used torrent ports and such, ultimately I am not in contact with the company myself, but my understanding is that the contract puts them in charge of the wired and wireless AP's, but we as the customer have some sort of support.
Logged

jjwinter
Jr. Member
**
Offline Offline

Posts: 75


View Profile
« Reply #8 on: September 16, 2012, 11:44:17 AM »

So you have responsibility for AP's you have no control over? What is your role there?

Trying to tackle this from "boot people off with deauth tools" seems like too much hassle.
Logged
Jamie.R
Sr. Member
****
Offline Offline

Posts: 429


View Profile
« Reply #9 on: September 17, 2012, 03:32:11 AM »

I would try secure the wireless to be honest as its the best way the other alternative is to use air crack and write de auth script
Logged

OSWP | Hackingdojo Nidan | eCPPT
SephStorm
Hero Member
*****
Offline Offline

Posts: 530


View Profile WWW
« Reply #10 on: September 17, 2012, 12:22:52 PM »

The closest example I could give would be if your company goes to a hotel for a conference, they provide wireless access for your use, but you dont control the APs.
Logged

chrisj
Hero Member
*****
Offline Offline

Posts: 1163


View Profile WWW
« Reply #11 on: September 17, 2012, 03:58:58 PM »

At which point it shouldn't be your problem, it should be the providers. Is the app and cable / dsl / whatever modem built in, or can you put a device between them?

if you can put something between them, I'd say go with the Untagled solution that jjwinter suggested.

Also have the person in charge let them know that what they are doing isn't authorized and there will be penalties for being caught.
Logged

OSWP, Sec+
DataDwarf
Newbie
*
Offline Offline

Posts: 27



View Profile
« Reply #12 on: September 17, 2012, 06:28:34 PM »

There is NetCut, which is windows only:

http://www.arcai.com/netcut-faq/62-what-is-netcut.html

and recently released WiFiKiller for android:

http://thehackernews.com/2012/09/eject-any-wifi-device-from-network.html
Logged
BillV
Hero Member
*****
Offline Offline

Posts: 1892


View Profile WWW
« Reply #13 on: October 01, 2012, 07:16:05 PM »

I don't think I noticed anyone recommend this, but what's stopping you from unplugging the WAP in question and plugging your own in? Seems that'd solve all the problems.
Logged
SephStorm
Hero Member
*****
Offline Offline

Posts: 530


View Profile WWW
« Reply #14 on: October 02, 2012, 01:15:54 PM »

quite right, thank you all for the suggestions. I'm not sure what they did, but the internet has worked much better recently.
Logged

Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.077 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.