Jump to content

JesseIZ

Active Members
 View Profile  See their activity

  • Posts

    80

  • Joined

  • Last visited

  • Days Won

    1

 Content Type 

Posts posted by JesseIZ

    Wifi Pineapple MK V For sale (Netherlands)

    in Trading Post

    Posted

    Hey everyone,

    I would like to sell my Wifi Pineapple Mark V.

    What you will get

    - Everything that you would get if you bought it from the hakshop .

    - The original box.

    For € 70,- its yours .

    Email me : jesseizeboud@gmail.com or message me here .

    i will only send in the benelux!

    - Jesse Izeboud

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Jesse, did you have this working on Kali, and then ported it for the pineapple? if so, do you have the original kali script?

    I realize this is a work in progress, but due to the amount of errors people have encountered just getting it installed, I think people should try browsing through the source *before* running it to make sure there isn't anything potentially catastrophic in there like rm yournuts. just putting that out there. We all appreciate the effort.

    I made the start of the script on Kali and then ported it to the pineapple and added all the functions and i will update the post with the source code ;)

    - Jesse

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Hey Jesse,

    Hope you enjoyed the holidays, and Happy New Year! Any update in the works?

    Hey ,

    Hope you enjoyed your holidays too ;)

    I am working on a update but i dont have alot of ideas to put in the update like extra features or something .

    But i did post an announcement of Fruity Cracker on the forum .

    - Jesse

    [Script]FruityCracker Announcement

    in Mark V Infusions

    Posted

    What is FruityCracker?


    FruityCracker is a bash script that can crack wireless networks , capture wpa handshakes , Evil twin (Open,Wep,Wpa,Wpa2 ) and more features to come !


    Compatibility

    Tested Configuration: Pineapple MK5 1.0.4



    Questions or Problems

    Please Let me know what you would like to see in this script below !



    Release Date


    Unknown.


    Author : Jesse Izeboud




    Other scripts i made : FruitySniffer

    Using the Iphone 4 as a pentesting device

    in Hacks & Mods

    Posted

    Wasn't there another demo of getting metasploit and other tools on iPhones and iPads already? /rhetorical question, don't answer..

    http://www.offensive-security.com/offsec/metasploit-4-on-iphone-4s-and-ipad-2/

    As far as I know this tutorial has been around for a while in various forms for jailbreaks to the iPhone and iPads. Key difference, the one I link above, used code FROM the developers SVN (no longer used, switched to Git now) to put metasploit on the device off the official https://www.metasploit.com/svn/framework3/trunk/ repo vs the ininjas site(although the link from metasploit now warns users to get updated versions off Git and to read https://community.rapid7.com/community/metasploit/blog/2013/05/20/git-clone-metasploit-dont-svn-checkout).

    Does anyone know, if the ininjas site today, is still owned and maintained by the same people from the original tutorials/packages? Vet your sources before installing is all I am saying. They may be fine and legit, but just make sure before putting something on your device in the event you may get your own device and network scanned from the inside without knowing if the source files are legit.

    Jailbreak forums using their own pre-packaged repo files may not contain the same source as the ones maintained by Rapid7(especially if the original ininjas domain has changed hands and looks to still be the same site on the surface, but is no longer the same files or owners).

    Thing about jailbreaks, while they work, people forget to get packages from the original sources which should work, and often trust the same jailbreak sites as having the same files and get themselves owned just as fast if they are ported and backdoored versions containing extra code. Not saying they aren't one and the same as the legit sources, or that ininjas.com contains packages that shouldn't be trusted(I don't know them, not trying to badmouth their work either), but one should consider this when using jailbreaks and where they get their packages from.

    Use caution is all I'm saying when looking to put something like this on your device, when you should be able to get the files from the developer, vs prepackaged ones on another site out of convenience. If anyone can download both sources and check they are the same or do an md5 match to prove they aren't altered sources, then I'd not be worried. I tend to be a bit more cautious when it comes to things like this, but that's just me.

    Thanks for letting everybody know , i totally understand you .

    - Jesse

    Using the Iphone 4 as a pentesting device

    in Hacks & Mods

    Posted · Edited by JesseIZ

    Ouch, iPwn added sbsettings, went into safe mode.....No big deal though....this is an extra iPhone 4 I'm not using right now....guess I'll need to wait until Mobile Substrate gets updated....... I wonder if Saurik is working today ?.........lol

    This is cool though, were you able to get it all installed with no safe mode?

    I might just need to wait another day or so. I think its mobile substrate giving me problems.

    Think I will try it on my iPad 1, hmmmm...... Its only on 5.1.1....... Maybe all of it will install.

    hmm i installed everything with no safe mode .

    Let me know if it worked on your ipad 1 ;)

    - Jesse

    Using the Iphone 4 as a pentesting device

    in Hacks & Mods

    Posted · Edited by JesseIZ

    Hey!

    Tested on the iPhone 4 running Ios 7 jail broken by using evasion7

    I wanted to talk about using a iDevice (ios 7)as a pen testing device . [ Noob Friendly ]

    First off , why should you use a iDevice as a pen testing device ?

    1. Its portable
    2. Not noticeable
    3. it looks cool :)
    4. its pretty fast
    5. IOS == Unix
    6. It can easily be used with the pineapple ;)

    Let's move on , so how do you make your iDevice into a pentesting device ?

    1. First you need jailbreak your iDevice (eg ; Evasion7)
    2. Open Cydia
    3. Adding repositories by going to "Manage" and then "Sources" and then "edit" and then "add"
    4. Then add all these repositories :: http://cydia.myrepospace.com/Boo/ http://ininjas.com/repo/ http://cydia.xsellize.com/
    5. When that's done . click on "http://ininjas.com/repo/" and scroll down until you see "Metasploit" then click on "Metasploit" and then click on "edit" and then click on "Install"
    6. When that's done go back and scroll until you see "Aircrack-ng" and the click on it and install just like previous when thats done install Auto Reconnect , Mobile terminal ,beEF, CUPP, Dsniff Suite , dsniff-fr0g , Ettercap-ng GTk , Ettercap No GTK , Evil Grade ,iAHT, iPwN ,John the Ripper, Low Orbit Ion Cannon , NBTScan, Nikto2, Nmap , Pirni ,Ruby 1.8.6 , Searchsploit , SSLstrip , Wordlists , XSSer , xterm , IWep , SET (not the one thats called Social Engineering Toolkit but the one thats called SET!!) , OpenSSH ! , iSSH
    7. I know that are alot of tools and it will take you some time but when its done you have an awesome pentesting device !
    8. When you Installed all those Tools open Mobile terminal or xterm and type "su" and fill in your password "standard password is :: alpine "
    9. then type cd /pentest and there are all your tools .
    10. Make sure you go to /pentest/exploits/SET/config and open the set_config and change the metasploit path to the path where metasploit is instaleld.
    11. If you need help setting up the other tools (should work fine) or if you have any problems feel free to leave them below .

    2013_12_25_15_05_57.png2013_12_25_15_05_15.png

    Enjoy your simple but powerful pen testing device ;)

    Merry Christmas! :)

    - Jesse

    Wifi TKIP Shared key - How to decrypt?

    in Security

    Posted

    If on your machine you have one profile in already then import a second (the new one you just got) then do a new export from your machine you should now get two profiles, the existing and the new one. If you only get one then the import probably failed.

    Thanks it worked ;)

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Found a bug with arpspoofing, I think.

    I went ahead with the first option: Sniff Mails ,Messages,and URl's and files

    Who do you want to arpspoof eg : 192.168.0.18
10.0.1.1  
Where do your want to save the output? Default = /sd/FruitySniffer/logs/logs.txt
arpspoof: invalid option -- r
Version: 2.4
Usage: arpspoof [-i interface] [-t target] host
^C

    There is no -r option in arpspoof according to the man. In this case, I'm trying to arp the whole network, so I chose my router ip (Right thing to do?)

    arpspoof -i br-lan 10.0.1.1

    I opened up vim and saw at line 101:

     arpspoof -i $Interface -r $gateway -t $target &

    I changed that to:

    arpspoof -i $Interface $target &

    Which gets things going but it just continues to arp and doesn't continue with the rest of the script:

    Nmap done: 256 IP addresses (9 hosts up) scanned in 9.56 seconds
Who do you want to arpspoof eg : 192.168.0.18
10.0.1.1
Where do your want to save the output? Default = /sd/FruitySniffer/logs/logs.txt
0:13:37:xx:xx:xx ff:ff:ff:ff:ff:ff 0806 42: arp reply 10.0.1.1 is-at 0:13:37:xx:xx:xx
0:13:37:xx:xx:xx ff:ff:ff:ff:ff:ff 0806 42: arp reply 10.0.1.1 is-at 0:13:37:xx:xx:xx
0:13:37:xx:xx:xx ff:ff:ff:ff:ff:ff 0806 42: arp reply 10.0.1.1 is-at 0:13:37:xx:xx:xx

    I hit enter to see if that would do anything for the hell of it:

    Write failed: Broken pipe
root:~ root$

    Disconnected. Might be worth checking out yamas/easy-creds and compare, my dog tired mind can't figure it out/is doing something wrong.

    As a request: An option to target an individual target via -t and the whole network would be nice via arpspoof.

    I also tried running it without arpspoof, and connected via a Karma SSID. I checked a mail via my iPhone, and sent one, browsed two sites and quit the script. I checked the logs, urlsnarf works fine, but nothing from mailsnarf.

    I apologise for this chaotic post, it's 4am here and it's been a hectic day, my brains burnt and so are my eyes! Will pick up on this tomorrow evening.

    I also quickly tried via ettercap. The wget via mediafire is a bad idea, it pulls the config file as the hmtl page for the download page, rather than the actual file. I don't think they support wget in the manner tried here. Here is my 1iQbYYX file in /etc/

    It appears you are using an older browser. For a better experience when using MediaFire, we recommend you upgrade your browser.
Help
Questions? Submit a ticket or visit our Help Center.
Additional help links: Contact Us Help with Web Help with Mobile Help with Desktop
Call us at 1-877-688-0068 to speak to a live representative.
YOUR SUPPORT CODE:

CLOSE
MediaFire
Overview Share Connect Backup Trusted More

    etc

    Time to sleep! :)

    Hi!

    Thanks for testing it !

    I am trying to fix it all . i dont get arpspoof to run in the background so you need to open 2 ssh session for it to work right now srry ;(

    - Jesse

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Hi Jesse, thanks for doing this. I wonder if you have plans to convert this into an Infusion. Most of the code you have is straight forward and having the system within the web interface goes along with the debs idea to keep things as simple as possible. I have mucked around with developing my own infusions with not bad luck. Open source is nice since we can look at how other (much better) debs do things within the interface. Anyway, keep it up, thanks for contributing.

    PT

    Hey,

    This script wont work as an infusion because it requires user interaction so i would have to make alot of scripts for each function which is possible but not easy to do and i am not good in writing php but maybe i can make it into an infusion ;)

    - Jesse

    Rogue AP

    in WiFi Pineapple Mark V

    Posted

    Still learning more about the pineapple and loving this device so far. I'm also still learning quite a bit about assessing wireless networks too, and I hope this isn't the wrong place to post my question.

    To my knowledge, Karma on the wifi pineapple doesn't bring up a rogue AP as long as the probe request is for a wireless network that uses encryption, correct?

    That being said, I ran across an article that referred to bringing up a rogue AP and making someone connect to his instead of their original one. The confusing part for me is that the victim's original wireless AP is encrypted with WEP, so how does bumping him off his force him to connect to their rogue AP, despite the signal being stronger? Is it possible to bring up a rogue AP with encryption (and trick clients into connecting to it), but just not supported by Karma? I thought the reason Karma didn't bring up rogue APs that use encryption was because clients wouldn't connect to it.

    Here's an exerpt from the article:

    Rogue AP with encryption doesnt work right now (maybe later) because the BSSID has to be changed and with open networks only the SSID has to be changed if i am correct.

    - jesse

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Hey Jesse! Really appreciate your work! Just got home, I'll bug test this for the next couple hours/day on my network, and report back. One thing I rememeber on the way out (quickly tried the dependencies check), is sslstrip has a tendency to stay on even after CTRL + C/(0)"Clean up Manually". I had to stop SSLStrip manually via the pineapple web interface, and then rerun the script to stop errors.

    I'll look into it deeper, commited to bug testing this all the way through.

    Curiously (I am going to start with a fresh install to be sure.), when I "ls" inside /sd/ the Fruity folder is nowhere to be seen, but it is there if I use the "Go to folder" function. I have no idea if this is because of my setup or the folder gets hidden somehow? I'm going to throughly go over it over tonight.

    Keep it up!

    Hey ,

    No problem , many awesome things to come ;)

    Please let me know when you bugtested it .

    Enjoy

    - Jesse

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Second method works. I might have an idea why the first way doesn't work. The filehost intentionally corrupts the zip to stop wget downloads? Dependency check has a bug:

    Version : Alpha v1.0 


Select from the following functions

Hit ctrl + c at any time to quit and clean up
  0    Clean up manually 
  1    Sniff  Mails ,Messages,and URl's and files
  2    DNS Spoof, Capture All Packets
  3    Sniffing with Ettercap
  4    Install Dependencies
  5    Sniffing passwords over HTTPS(SSL) + HTTP FTP, IMAP , SMTP and more 
  6    Exit 
choice : 4
Installing Dependencies
./FruitySniffer.sh: line 388: sudo: command not found
./FruitySniffer.sh: line 389: sudo: command not found
./FruitySniffer.sh: line 390: sudo: command not found
./FruitySniffer.sh: line 391: sudo: command not found
./FruitySniffer.sh: line 392: sudo: command not found
Done!
Press RETURN for menu

    Fixed the bug !

    You can download it right now ;)

    - Jesse

    [Script] FruitySniffer Alpha v1.0

    in Mark V Infusions

    Posted

    Second method works. I might have an idea why the first way doesn't work. The filehost intentionally corrupts the zip to stop wget downloads? Dependency check has a bug:

    Version : Alpha v1.0 


Select from the following functions

Hit ctrl + c at any time to quit and clean up
  0    Clean up manually 
  1    Sniff  Mails ,Messages,and URl's and files
  2    DNS Spoof, Capture All Packets
  3    Sniffing with Ettercap
  4    Install Dependencies
  5    Sniffing passwords over HTTPS(SSL) + HTTP FTP, IMAP , SMTP and more 
  6    Exit 
choice : 4
Installing Dependencies
./FruitySniffer.sh: line 388: sudo: command not found
./FruitySniffer.sh: line 389: sudo: command not found
./FruitySniffer.sh: line 390: sudo: command not found
./FruitySniffer.sh: line 391: sudo: command not found
./FruitySniffer.sh: line 392: sudo: command not found
Done!
Press RETURN for menu

    Fixing the bug right now!

    And thanks for the info ;)

    - Jesse

×
×
  • Create New...