sud0nick
-
Posts
1,056 -
Joined
-
Last visited
-
Days Won
66
Posts posted by sud0nick
-
-
If you have an Android based phone try using JuiceSSH. That's what I use to get into my Pineapple and other devices from my phone. Also, if you can, try to grab a copy of the portal without any of the modifications for nodogsplash and send it to me. I want to load it up in my test environment and see what's causing the problem.
EDIT:
There may be a problem with the HTML of the splash page you are trying to copy. I just ran another test and everything copied perfectly for me, images, HTML, and CSS.
-
Try something for me, Cheeto.
SSH into your Pineapple while connected to the AP with the captive portal and run the following commands.
cd /pineapple/components/infusions/portalauth/ python includes/scripts/portalclone.py TestPortal /sd/portals/
Place the error you get here so I can see it. Also check /sd/portals/ for the TestPortal directory. Let me know what actually copied into it and if the splash.html file has any content in it.
-
I just uploaded v2.0 of Portal Auth. It will hopefully be available within the next 24 hours. Here is a copy of the changelog
[->] Added the ability to clone a captive portal. The portal can be activated upon cloning and managed with Evil Portal II. [->] Updated user interface. [->] Added Injects tab to allow user-defined JavaScript and HTML for injecting into a cloned portal. [->] Included JS and HTML injects for creating a basic username & password form. [->] Included a standard auth.php file for capturing credentials.
Some things to note:
1. When cloning a site if a linked item does not have a file extension (I've only seen CSS files like this) the cloner will automatically label it as a CSS file.
2. When specifying a portal archive you need to ALWAYS place a forward slash at the end of the path.
3. You will only see the options to auto-authenticate and clone a portal if one is detected. If not you will only see the check for portal button.
If there are any issues please let me know ASAP. I tested this version to fullest extent I could but I can't account for every possibility. I want to make sure this works for everyone so please bring every issue to my attention.
Enjoy!
-
Go to www.wifipineapple.com and create an account under the User Portal. You can then submit your infusion there.
-
I think that adding an option to add username password fields might be important because some Captive portals simply don't require that you type anything at all. Some are just 1 click access to internet.
So cloning a page that does not require any input from the user and modifying it to a point where you do need to input information might be a plus.
By the way, the Library idea is BRILLIANT!
I'm not sure if you're reading my previous posts correctly. Inputting the username and password fields will be done by default. The injectHTML and injectJS files will come with working code. You will be able to modify it to suite your needs. The injectHTML file will include username and password fields but not the form tags. The script will find the form in the portal, clear it, and inject the code from injectHTML.
-
Also, once a portal is cloned/ripped, it would be nice if we could save it to sd/portals this way we can have it in the Evil portal library.
If you look at my previous posts you will see this is the idea. Evil Portal stores portals in /sd/portals so that is where Portal Auth will store cloned portals. You will also have the option of copying it to /etc/nodogsplash/htdocs immediately so it will be your current active portal.
-
I can't speak for any of the models you listed nor for simulators, as I have never used them, but in my opinion the best thing to do is just get out there and fly. Using a cheap model that works like more advanced models is the best way to go. When you crash it won't be a big deal and it probably won't take much damage. I looked up the Skytech M62 and I think that would be a great one for you to start with. Just don't go crazy and try to fly it really high and far (especially on a windy day) and wait until your comfortable with the basics before you start doing any aerobatics.
-
Its all you man, I've had this in my que of stuff to get done but I'm the busiest person in the world right now with work and I just started teaching night classes. I will ask though if you can make it super clear that the portal will be replaced if the user chooses that so this way I don't get the users coming to me saying "my portal got deleted!"
Of course. I will actually set it up to alert the user if they name the newly copied portal something that already exists. That way they know that one will be replaced instead of added.
-
I don't have an answer for you but rather a question.
Are you Mr. Smash or Mrs. Mash?
-
If you pay in cash it would be really difficult to trace you. By the time anyone figures out you are doing something wrong those bills will be long gone and they won't be able to match it to a bank or company that passed them out. Video surveillance may be an issue but you can easily buy a computer on an online yard sale (again, with cash). Geolocation is not a problem because of the anonymous VPN. The egress point of all traffic would appear to come from elsewhere. Even if it was traced back to the original location we come back to my point of being in a city far from your home. You would travel for a legitimate purpose then do your hacking during that time. Who cares if the MAC address is logged at the switch/router. All that proves is that device was there (among hundreds of other devices) but does not prove who used it.
The only thing I don't have an answer for is securing your TBs worth of data. There are many solutions to this today but as we all know, today's solution is tomorrow's vulnerability.
-
I don't know how easy it would be to implement but after rereading your post I can see how it would be a good idea.
-
My best guess?
Buy a computer in a random city not near your home. Pay only with cash and immediately wipe the drive. Use Tails as your OS and never connect it to the internet from a privately owned (by you) network. Use anonymous VPN software to do your work online (again, from public APs in cities far from where you live). Never EVER log into any personal websites or anything that can identify you. I'm probably missing a few things but I think you get the point.
-
The point of using a MAC address is that it never changes. ESSIDs can change whenever someone wants the network to broadcast under a different name.
-
I've used SDR# and found my older Microsoft wireless mouse and keyboard operated at about 27 MHz. I wonder what the newer ones operate at.
-
Some ideas for Portal Auth:
provide users with a simple construction tool like: add email or password form with submit button so as to submit all the information to auth.log.
There will be two files holding the code to inject: injectJS.txt and injectHTML.txt. You will be able to modify these and the code will automatically be placed in the portal as it is cloned. As for creating buttons to include multiple forms, I don't think this is necessary. The form will already be set up in the portal. My script clears the form of the portal and injects your HTML into it but it does not create a whole new form. Besides newbi3's infusion, bobthebuilder, already does this and you could copy and paste the code from there.
The default injectHTML file will include an email and password field with a button that is linked to a javascript function. In the JS function will be a post request that is sent to auth.php. If you guys think its a good idea I can include a standard auth.php script and place it in the appropriate directory. Then I could make that editable as well from the infusion.
Remember, though, this is not a portal editing infusion. It copies a portal, configures it to work with nodogsplash, and sets it up to work immediately with Evil Portal. If you want to edit a portal you will either have to use Evil Portal II or SSH into your Pineapple. There is no need for me to rebuild what newbi3 has already done.
-
He simply means access the web site being served by apache over the network. For example, if your server's IP is 192.168.1.20 open your browser and type
http://192.168.1.20/
-
I am building it to work specifically with Evil Portal. You will not HAVE to modify anything but you will be able to. I am building a new tab into the infusion where you can customize the HTML form and JS that you want to inject into the portal you clone. All images will be downloaded automatically and placed in the appropriate directory (I'm still working on doing the same for CSS stylesheets). You will be able to save portals to the location that Evil Portal saves them and activate them immediately if you so desire. I'll post the whole change log here right before I submit the update.
-
Wow, I didn't think I would get so much done so soon. I have a fully functional script now that pulls a portal, injects user defined HTML forms (while clearing the other forms) and user defined JS (this is where $authtarget will be), downloads all images to the images directory, replaces all image links within the HTML with $imagesDir, and saves the file as splash.html. The user will also be able to set whether they want to store the portal for later or use immediately. I expect to have an update pushed by the end of the weekend.
-
Just recording ideas down, but since you are already discovering by automation. Or could even be a seperate infusion all together.
But why not have an option to clone the auth portal, and have it be recreated with modified data to go along with say, evilportal or just dnsspoof?
If this is out of the scope here, or just a rediculous idea, just discard this lol
I could see this being a part of either evil portal or portalauth. As you said DataHead, I could easily use the code I have already written to accomplish this. I'm going to do this for myself anyway but would be glad to hand the code over to newbi3 and let him add it to evil portal if he wishes. If not I will add it to my infusion. I'm thinking along the lines of this process:
1. Pull HTML from portal
2.
Replace the value of all action attributes, in form tags, with $authtargetRemove value of action attributes and leave redirection up to the JavaScript.
3. Inject username and password fields
4. Inject an AJAX call to log the credentials
5. Place in portal directory on Pineapple.
The basics are simple. Then I might add some options to insert images like the Facebook or GMail icon in order to make it look more official when asking for creds from a specific site.
-
I saw this today and I was going to post it but got lazy, lol. It seems like a cool project.
-
-
Why not use jQuery and make this process simpler? You could assign the button to a class then use that to reference it in a javascript function like so:
<button class="send_info_button">Submit</button>
$('.send_info_button').on("click",function(){ $.post('/path/to/script/', {$dataToSend},function(){ window.location = $authtarget; }); });If you need help referencing jquery.min.js look at my post in the Evil Portal support thread here: https://forums.hak5.org/index.php?/topic/33554-support-evil-portal/page-2
-
There seems to be an issue with autossh tile. When I click the checkbox to enable, the pineapple loading spinner shows then goes away. When I manually start the service via cli, it works. If i start it via cli and then refresh the webui, it is checked.
Confirmed! I´m also unable to enable AutoSSH, generate a Key or change the Ports.
I'm having this problem as well but I can still SSH into the Pineapple...should this be happening?
-
There is no infusion for it (yet) but Cheeto has talked about it a couple of times.
can't verify after upgrade
in WiFi Pineapple Mark V
Posted
Maybe you just said this wrong but the boxes are not for turning the LEDs on and off but to verify their state. This tells the software that you are physically looking at the Pineapple which means it is most likely your property.