Jump to content

olympus_mons

Active Members
 View Profile  See their activity

  • Posts

    18

  • Joined

  • Last visited

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

olympus_mons's Achievements

Apprentice

Apprentice (3/14)

  • One Year In Rare
  • One Month Later Rare
  • Collaborator Rare
  • Reacting Well Rare
  • Week One Done Rare

Recent Badges

  1. olympus_mons
    I am going to factory reset and go from there. I will also try the suggestion from dark_pyrro. I would really like to get this working, I know alternatives exists such as Airgeddon but there is something really cool about whipping this device out ya bag on a pen test 🙂 Thanks for the replies. Any other suggestions would be greatly appreciated.
  2. olympus_mons
    I haven't no, I am not sure why this person has massively over complicated the scenario by adding in Evilginx either! I am not sure what is being achieved by adding - <BODY onload="document.forms['member_signup'].submit()"> wont this just auto submit the form therefore not give the user to enter details?
  3. olympus_mons started following Evil WPA Access Point... , Evil Portal issues - You are not authorized , Pineapple - Rogue AP and 1 other
  4. olympus_mons
    Hi all, I have burnt through so many hours of personal time and work time trying to sort this. I have followed various articles and YouTube videos, so I thought it might be worth posting here also. Basically, I want to use the Pineapple on one of my pen tests I want to clone the SSID of my customer, then broadcast the cloned SSID as a fake SSID with an Evil Portal hanging off the back of it. I have managed to customise some of the Kleo portals to my liking, I customised images and CSS, nothing to complex but the outcome is very effective. My issue is this: - Connect to the open AP that the Pineapple is broadcasting - works fine - The Captive Portal page opens - works fine - Enter credentials and press the submit button - works fine - An alert on the Pineapple appears saying a user has successfully connected and the entered credentials are visible in the log file - works fine - After pressing the submit button either from a mobile device or a desktop device, a screen appears with a plain text message saying "You are not authorized" - On a mobile device, I press cancel, then a pop up appears with two options, one saying connect without internet and one saying connect to another network - If I press connect without internet, the mobile device connects to the SSID being broadcast by the Pineapple, therefore the mobile device is connected to SSID being broadcast by the Pineapple. I cannot for the life in me work out why the Pineapple is insisting that after entering something into the text fields then pressing the submit button that a message should be displayed saying "You are not authorized". I have had a look at the php files on the pineapple in /www/captiveportal and I see various functions being called, one of them being something like onerror() but why is the error happening in the first place therefore why is the onerror() function being called which is what is displaying the "You are not authorized" plain text on the screen. All I want is to grab the creds then dump the user out of the captive portal. I cannot use the Pineapple in a pen test when its only half working like this. Has anyone got a solution to this please? I am using the Starbucks portal by the way. Many thanks.
  5. olympus_mons
    which video are you referring to please? I do not have the enterprise pineapple, I just have the normal mark 7, will the content of the video still apply?
  6. olympus_mons
    apologies for the delayed response and for the poor use of terminology, when I say WPA key I mean the pre shared key users use to connect to the AP. I am sure I watched a video showing the Pineapple blocking access to the legitimate AP until the user entered the proper / actual pre shared key. The way in which the Pineapple knew the pre shared key being entered was the proper / actual pre shared key was by comparing the pre shared key captured in the handshake with the pre shared key entered by the user. The Pineapple compared the two encrypted values meaning the captured pre shared key still needed to be cracked with aircrack or hashcat etc. Does this sound familiar? I think airgeddon can do this, its an Evil Twin AP as opposed to an Evil Portal. I am just not sure how useful and Evil Portal will be during a pentest, however, I feel an Evil AP / Rogue AP will be very useful...
  7. olympus_mons
    Many thanks for this, I will give this a go 👍 Sure I saw a video somewhere that showed the pineapple catching the encrypted WPA key and then comparing that captured WPA key to the WPA key manually entered into a captive portal by the user, then if the encrypted WPA keys matched, the user would be redirected back to the actual AP. Or am I talking rubbish?
  8. olympus_mons
    Hi all, I am getting very confused with terminology. When I click PineAP > Access Points, I see three options, they are as follows... - Management Access Point - Open Access Point - Evil WPA Access Point I have kind of got the Evil Portal module working but I am wondering what the Evil WPA Access Point is for. The Open Access Point is used with the Evil Portal module but what is the Evil WPA Access Point used for? Also, what is the purpose of the Management Access Point? I thought this was for managing the Pineapple but I notice management can be done via the Open Access Point. I am really struggling and the book that came with the Pineapple really does not help. Thanks in advance,
×
×
  • Create New...