airman_dopey

Hey guys, I'm trying to parse some information given from etterlog in XML and am not sure how to proceed. The output I am being given is: <?xml version="1.0" encoding="UTF-8" ?> <etterlog version="0.7.4.1" date="Wed Jan 23 19:08:37 2013"> <host ip="192.168.0.1"> <mac>XX:XX:XX:XX:XX:XX</mac> <manuf></manuf> <distance>1</distance> <type>LAN host</type> </host> <host ip="192.168.0.4"> <mac>XX:XX:XX:XX:XX:XX</mac> <manuf></manuf> <distance>1</distance> <type>LAN host</type> </host> <host ip="192.168.0.102"> <mac>XX:XX:XX:XX:XX:XX</mac> <manuf></manuf> <distance>1</distance> <type>LAN host</type> <port proto="udp" addr="68" service="dhcpclient"> </port> <port proto="udp" addr="137" service="netbios-ns"> </port> <port proto="udp" addr="138" service="netbios-dgm"> </port> </host> </etterlog> What I would like to do is parse this and output it as a single line for each <host>info</host> and I am at a loss for how to accomplish this. <host ip="192.168.0.1"><mac>XX:XX:XX:XX:XX:XX</mac><manuf></manuf><distance>1</distance><type>LAN host</type></host> <host ip="192.168.0.4"><mac>XX:XX:XX:XX:XX:XX</mac><manuf></manuf><distance>1</distance><type>LAN host</type></host> <host ip="192.168.0.102"><mac>XX:XX:XX:XX:XX:XX</mac><manuf></manuf><distance>1</distance><type>LAN host</type><port proto="udp" addr="68" service="dhcpclient"></port><port proto="udp" addr="137" service="netbios-ns"></port><port proto="udp" addr="138" service="netbios-dgm"></port></host> Any ideas how to do this? I am aware that awk (or sed) will probably work here, but my skills in either are not anywhere near this type of problem. Thanks in advance

Make 2 images. One with just the left side, one with both. When you fade from the first to the second it will appear to fade in the second image without changing the first.

It appears on the video you're using a gmail account to handle the communications. Have you experienced any problems with gmail? I did a similar thing with my cracking box using one-way communication to mms to notify status working through dictionary files. My experience was after a couple of messages gmail would freeze the account due to violation of ToS. I had to switch to a yahoo account (which worked flawlessly ever since).

If the phone was rooted you could always use Kos' p2p-adb to simply bypass the lockscreen

I'm good friends with Shadow. Yes, all devices powered by Anker. As for software, we are currently writing a slew of CLI tools to extend/improve the functionality of the pineapple onto the pi. We have successfully ported a lot of the SSLStrip and URL snarfing tools. We are waiting on the API hooks reportedly in the pineapple firmware 3.0 to allow packet manipulation, and our current project is passive/active fingerprinting of all machines connecting to the pineapple to allow us to fine tune metasploit/armitage attacks on the clients. We are polishing them now, but all tools will be released on the hak5 forums. EDIT: additionally, our tools will also be usable over BT5r3 to do attacks without a pineapple, for all you guys without the hardware but want to play along ;)

Firmwares can be found here: http://cloud.wifipineapple.com/index.php?downloads Just download the 2.7.0 version, go to your pineapple's upgrade section, enter proper md5 and upload file, then flash. As for the out of space errors, sounds like you installed too many infusions to the internal memory.

Sounds interesting. Where as I am not familiar with how to accomplish what you're asking, I am curious to know if you'll be releasing these tools.

That's it. Plug it in for on, unplug for off. However, I would suggest waiting until it finishes booting (blinking light stops flashing) before powering it off. It would probably be fine, but I like to be cautious. Enjoy the new device!

Looking forward to seeing the work you guys are doing. I cannot speak for shadowblade, but I am putting that portion of our project on hold until I see how you guys did it. Also, the tools we're working on are cli versions of what is already on the pineapple. Under the applications and coding section it states that script kiddie code will be removed. Would this type of stuff qualify? What exactly is "script kiddie code"?

What are those?

HTTP at first. We can move on from there.

Yes it is a type m

Hey guys, So Shadowblade72 and I have been working on push-button scripts to be used on a computer/rPi to offload a lot of the work the pineapple normally does. We are also working on expanding said tools to attack wired/wireless networks among other things. We fully plan on finalizing these tools and releasing them here on the Hak5 forums for everyone to use when we are done. One of the problems we are having ATM is attempting to modify/sniff traffic using Ettercap between eth0 (connected to the pineapple) and wlan0 (connected to the AP). Does anyone know of a way of doing this? We have researched and attempted bridged mode in Ettercap and creating a new interface with the bridge mode already enabled to sniff that. Both will not work. As far as Ettercap goes we are successfully Arp Poisoning and applying filters, we have modified etter.conf accordingly, but still cannot find out how to do the bridged mode properly. For the bridged interface, apparently you cannot connect a wired to a wireless. So bubcus there. If anyone can simply point us in the right direction it would be greatly appreciated. Not looking to be spoonfed as we are trying to learn as we go.

Agreed. Most people tend to set up their new devices at home, and as such set their home networks as their first wifi listed. From personal testing any other network added default to higher on the list. By taking advantage of deauth attacks you can usually force people to connect to your pineapple.

Regarding finding sslstrip I was able to do the following: PID=$(pgrep -f "python sslstrip") To find the port number it is running on: Port=$(ps -ef | grep -m 1 "python sslstrip.py" | awk -F '-l ' '{ print $2 }') Now if I can find a way to determine if the IPTables have been modified. Thank you for the alternative PS options. I'll check them out. =) EDIT: Finally got it. Thanks!

Hey guys, I am working on CLI tools to augment the pineapple. One of those tools is to have SSLStrip running on a computer (and ultimately the RPi). Initially this was just a way to learn about the tools provided, but I realized this could be something others may benefit from so I plan on releasing my code. One of the things I am struggling with is when I run my SSLStrip script I want to check prior to any questions asked if SSLStrip is currently running on the machine. My current code for running SSLStrip is this: echo -e "Preparing system for SSLStrip...\c" iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 1000 >/dev/null cd /pentest/web/sslstrip python sslstrip.py -l 1000 & echo "Done" #Followed by the cleanup portion killall sslstrip iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain (Note that I am simply cutting a portion of the code for demonstration purposes. The script looks a bit better than this) What I want to do is see if this has been done prior to running it again and spitting out errors regarding the port number. I have ran "pgrep sslstrip" and nothing has appeared, and looking through the help command of IPTables I cannot see how to check if this has already been done. Thank you for any assistance. -EDIT- I just ran ps -ef and discovered "python sslstrip.py" so that will work. How would I check for the IPTables portion?

I agree with a lot of the people here. I am relieved a bit knowing that it is a one time connection when upgrading the firmware. Imagine the troubles it could cause if you're on a pentest with your device trying to phone home. However, I do feel this feature should have a conspicuous way of viewing the report prior to sending; maybe having to scroll to the bottom of it to send it. I think we can speculate this until we're blue in the face, but I for one will sit and wait to see the actual update before I base any final opinions.

Also have the SSH online problem. No USB inserted at all after upgrade. EDIT: Also having the USB issue. Cannot seem to access the drive while SSH'ed in, drive is not mapping to /usb.

If you really want to start to understand the technology then I would suggest looking into installing or running Ubuntu (or similar Linux distro) from a USB stick. Learn how it works. The pineapple is based off of similar tech. Understand one, you will know where to look for the other. That is the best thing if you REALLY want to get into this kind of stuff.

I'm curious on this as well. I noticed with my own testing with the phishing pages it was hit or miss with me for redirecting the traffic. Hopefully someone else chimes in who is a bit more knowledgeable.

I had this problem with the DNS spoof. Try setting it to "172.16.42.1 *.*" and see if that helps

Look up the ln command. I believe -s is used for symbolic links. So you can do "ln -s /usb/www /www" to make a symbolic link. Me personally, I prefer to drop the html file on the pineapple and use a symbolic link to the needed files, but you'll figure out what works for you.

Also looking forward to checking this out. Hopefully it is still in the works....

Thanks for the replies guys. Telot, is that drive sturdy enough? It looks to me like it would be easy to break if using the pineapple in a mobile deployment

Does anyone else have problems powering both the Pineapple Mkiv and the SanDisk Cruzer Fit 4Gb using the pineapple juice? For some reason every time I try to power over the battery pack the usb doesn't mount the drive properly. Trying to figure out if I have a bad battery pack, pineapple, or sandisk