Using Mark 5 Phishing for logins

[acdc]

Thanks to Hak5 for bring the Mark V to the masses--would like to see more examples of various hacks thus I assume this is what the forums are for so, here are some questions.

I went to the link below and thinks its a good tutorial but think the person left out a bunch of Stuff and has it wrong on the whole Whitelist thing they mentioned in the guide--I think they met to say you need to black list-----

file:///home/q/Downloads/Phishing%20for%20Facebook%20logins%20with%20the%20WiFi%20Pineapple%20Mark%20V%20from%20HAK5%20%28Setup%20Guide%29%20|%20.%20.%20TheSecurityBlogger%20.%20.%20..html

====================================================

While these are Mundane ---I think Hak5 should address them or put out a printed living document on the various options

Questions: I want to create a rouge AP ( for edutional purposes only ) to get those in my vacinity ( class rooms) outside perimieter to connect through my Mark V. As in article above I want to use the 3 tools TCPDUMP ( need wireshark ro look at dump file??? ) WIFI manager and SSLstrip PLus using Karma the follwing questions arise hoe top get feed back.

I am running a laptop, with a WIFI router connection ( rouge AP ) and Pineapple connected to my laptop

1) Where in the WIFI setup tabs do I " Share " the network?

2) Should both Wlano --my wifi and Wlan1 my wired --should both be enabled?

3)In Wifi Manager Should both Physicial interfaces be enabled?

>DO you have to click "start Monitor" for both interfaces or do you need only to monitor the wireless?

4)On my laptop under network connections should the setting be on ad hoc or infrastructure?

5)When using TCPdump--what should be selcted in the drop menu , Wlano,Mono,LO,Etho,Br-lan ??? What is Br -Lan

6)TcpDump--SHould Verbose be used? Does Dont resolve host names or Dont resolve Portnames should it be used?

7)When I click SSlstrip log file it just displays a black page in a window webbrowser--this requires using the back button to get back into mark V pannel --

KARMA

As I read the forum--with the above scanrio-- I want or HAVE to Blacklist my SSID ??? Correct???

AND I also have to Blacklist my MAC addresses??? Both Wireless ( which is under SSID ) AND Wired MAC ??? I am unclear on this

Thank you in advance for your replies!

Edited March 18, 2014 by acdc

[mw3demo]

Not sure you are going to get much help on how to capture your friends facebook passwords, at school, on here. You can check out Chris's channel on youtube though! https://www.youtube.com/user/sunstudiophotography/videos

Edited March 18, 2014 by mw3demo

[thesugarat]

acdc,

You're looking at the living document that catalogs these types of questions so your first stop should be the search feature on the forums. 99% of what you want to know is already here you just have to find it. The other 1% isn't pineapple related (question 4....) and wikipedia is your friend. But, just so I don't come across as a total dick, here are a few pointers.

"I am running a laptop, with a WIFI router connection ( rouge AP ) and Pineapple connected to my laptop" --- this configuration you're going to have to explain a little more clearly. You're laptop is connected to an AP and you want to do internet connection sharing or (ICS) with the pineapple connected to your laptop via the ethernet cable? Or are you saying your laptop is already connected to a different rouge AP? Just confused...

1. Use the WiFi Manager infusion carefully... Don't get me wrong it is very powerful and very useful, but depending on your intended configuration for your pineapple odds are it isn't where you're going to turn on ICS. There is a script that works on linux machines called wp5.sh that helps setup ICS. There are also tutorials on www.wifipineapple.com for ICS and several forum posts. Different OS = different ICS methods (Apple OSX being the worst to setup and Linux being the easiest due to the wp5.sh script) so be prepared for that.

2. wlan0 is your Pineapple's Access Point hardware (and Karma), wlan1 is the other wireless radio used for Client Mode connections (or deauthing via Jammer, just not at the same time), eth0 is your wired connection aka ethernet cable. And just to skip ahead a little br-lan is a 'bridged' connection that bridges the WAN side to the LAN side in the pineapple. Essentially your wlanX can see the eth0 side.

3. Until you're very familiar don't do use the WiFi Manager monitor mode buttons... Again, both are wireless and no you don't "need" to do this there. If an infusion requires monitor mode you'll have the option in the infusion. (Jammer, WPS, etc. have the option.)

4. You're killing me with this one.... Again, not pineapple related, it's basic WiFi functionality. adhoc allows a device to device or device to multiple device connection without using a Wireless Access Point. And Infrastructure is the normal mode everyone is familiar with aka it's an Access Point that allows others to connect to it. And seeing as how you aren't setting up an AP on your laptop I'm not sure why it's a question...

5. For TCPdump it depends on your configuration but if you want people to connect to your Pineapple's AP and get internet and you want to collection the info on what they see, it would be the bridge or br-lan mentioned above. And yes you'll need to grab the pcap file and view it in your laptop with wireshark or an equivalent program.

6. Personally I think those options would slow things down but try it with and then try it without and decide for yourself.

7. That could be any number of things... If you continue to have problems there is a Mark 5 Infusions forum section with posts for each of the infusions.

If you are using Karma I don't think Blacklisting your pineapples SSID is necessary but if you are connecting to a specific AP for your pineapples internet you might blacklist that SSID and the MAC of your WIRELESS laptop/tablet/equipment. Only wireless devices are impacted by Karma so blacklisting your wired ethernet MAC is not needed.

And for full disclosure you want to look into HSTS and the recent updates companies have made against Karma and sslstrip they are now much less effective these days. So getting any credentials might be difficult to say the least... You may want to look at the creation of Phishing pages. All this said with the assumption you follow all local laws and/or have the permission of those involved.