EdLesMann

This is the next step of my journey for those that helped me out earlier. Thanks! I am starting a new topic since the goal of the first topic has been completed. http://forums.hak5.org/index.php?showtopic=23571 I was able to hack in to the pineapple and adjust all the network settings. I followed echoblack's guide since that was where my friend had started. http://forums.hak5.org/index.php?showtopic=15200 I used his scripts and I was able to get it working! There are a few issues with the script that I am going to try to hack on and correct, but it works as it should. I have three things I would like to ask about. All of this was done on a fully updated Kubuntu 11.10 laptop. 1) SSLstrip. I enabled this function from the script, but SSLscript crashed on me everytime I started it up. I have both python 2.6 and 2.7 installed. As a test I updated SSLstrip. I pulled the latest sslstrip from here: https://github.com/moxie0/sslstrip After I adjusted the pineapple.sh script to point to the 0.9 instead of 0.7. SSLstrip stopped crashing, but it didn't behave the way I thought it should. Browsing https://google.com, https://duckduckgo.com and even the https verison of wikipedia didn't trigger anything. I logged into https://mail.google.com and I saw it was redirected to http://mail.google.com /and/ I got a message in my logfile showing my email/password/ect! Horray, part of it works! SSLStrip also kicks out this nasty block of errors: File "/usr/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 529, in connectionLost protocol.connectionLost(reason) File "/usr/lib/python2.7/dist-packages/twisted/web/http.py", line 455, in connectionLost self.handleResponseEnd() File "/usr/src/sslstrip-0.9-2-1/sslstrip/ServerConnection.py", line 119, in handleResponseEnd HTTPClient.handleResponseEnd(self) File "/usr/lib/python2.7/dist-packages/twisted/web/http.py", line 466, in handleResponseEnd self.handleResponse(B) File "/usr/src/sslstrip-0.9-2-1/sslstrip/ServerConnection.py", line 134, in handleResponse self.shutdown() File "/usr/src/sslstrip-0.9-2-1/sslstrip/ServerConnection.py", line 154, in shutdown self.client.finish() File "/usr/lib/python2.7/dist-packages/twisted/web/http.py", line 866, in finish "Request.finish called on a request after its connection was lost; " exceptions.RuntimeError: Request.finish called on a request after its connection was lost; use Request.notifyFinish to keep track of this. Is this important? I don't know. pineapple.sh only checks for python 2.6, is it a problem that it uses 2.7? Again, I don't know. I don't see anything in the sslstrip docs saying I have to use python2.6, but maybe I am missing something obvious. Also, why would it not strip the https from the search engines/wiki? 2) Upgrades. According to the software webpages, my pineapple is running Jasager v.2 (meaning I am WAY out of date) and X-WRT 8.09 (which has an update to 8.09.02). I looked and found several update guides, but they seem to want me to run a windows binary. I don't have windows at all. Just Debian Lenny (Desktop), and Kubuntu 11.10 (laptop). Should I attempt an upgrade? What would be the easiest way for me to do so? I have a decent amount of Linux knowledge, but this pineapple/wireshark/sslstrip is pretty much all new to me and I tend to have to look up a lot of terminology. 3) Wireshark. Lastly, I captured traffic from the eth0 port with wireshark. I have used wireshark _loads_ of times in the past for my past job...with a very specific purpose...so I only know like 3 things about wireshark...it is rather sad how little I know about a program I have used so much. Has Hak5 done a good review of wireshark that I can use to brush up? A search on youtube brings up a bunch of wireshark videos. Anyone have recommended materials I should check out? Thanks for the help everyone!

Hello All. I greatly apologize for the long delay. This week was rather absurd. I did manage to get into the device. I connected to the device over wireless and ran nmap. Found a SSH port on the device. Thankfully the default pineapple password for root worked and I was able to log in. The IP on the eth0 was hard set to 10.1.1.1 for some odd reason. I have not had time to do much with the device yet outside of the SSH scan/login. If all goes well I will have some time this week. I am catching up on my Hak5 episodes and I just saw the episode with the teaser for the new Pineapple V3. Maybe I will take the challenge on updating the firmware to the latest. I do appreciate the help and suggestions. I will most likely be back asking questions when I have problems. :-D Thanks again everyone.

Hello all! A friend picked up a pineapple well over a year ago. He had it working and goofed around with it until his laptop drive crapped out and he lost his scripts he used to work with it. He tinkered with it for a while with his new laptop and lost interest. It has been sitting in his closet for ~10 months or so until he decided to throw it out. I snagged it. I believe I have the original parts. The white box with the Jasager pineapple sticker ( Model: MR3201A-38NQ ), a power cable, a 4-AA battery connector, and a piece of paper with some basic instructions which appear to no longer apply... When I plug in power, I can see a new wireless network show up called "Pineapples" as well as a few others like "Default" but trying to connect to them times out. The instructions say the IP should be 192.168.1.1 and he said he used echoblacks guide originally [1] which uses an IP of 10.110.0.2. However, when I set my IP manually (10.110.0.1 or 192.168.1.10 and netmask 255.255.255.0) and connect over LAN I can't see anything at either IP. I tried a normal cat5 cable as well as a crossover cable (not sure which I should use so I tried both). [1] http://forums.hak5.org/index.php?showtopic=15200 Last night I left the cat5 cable plugged in with an IP of 10.0.0.1 netmask 255.0.0.0 and ran nmap ping sweep for port 22 across 10.0.0.0/8 but it found nothing. I must admit I am a complete newb when it comes to the pineapple. I am working on my second day hacking on this thing and I am at a loss as to what to try next. It appears to still be working, but I can't figure out how to get into it and he doesn't remember because he scripted everything. Does anyone have any ideas? Thanx. Ed