What can the pineapple still do?

[buckboy223]

I am asking is this because security is changing rapidly. You can no longer use ssltrip on the sites that contain juicy info because of hsts and I heard Karma will no longer be effective for newer devices do to driver patches.

That being said can it do:

Ssl split to get around the hsts

Create evil twin?

Cookie collect/session hijack?

Run airmon-ng or the aircrack suite?

Apr spoof a connect Ap?

[cooper]

I think it boils down to this:

Can you do it with your own computer?

If the answer is yes, then you can almost always also do it with your Pineapple.

The only caveat is if whatever you can do with your computer requires some impressive CPU horsepower for obvious reasons, which is typically circumvented by storing the work for later processing and letting a separate machine take care of it when it's available. If that scenario doesn't fit in with your chosen attack vector, only then will the Pineapple not suffice.

Whatever else remains is simply a product of the difficulty of getting something to run on the Pineapple, which while anything but trivial, is simply a matter of time, really.

[cheeto]

Wps cracking with reaver works.

Sslstrip works but does not allow the victim computer to access https.

However sslstrip does decode the https, just can't navigate.

These limitations that are emerging are not a problem with the mkv but rather the scripts. I'm sure something new will emerge and when it does, so will the infusion.

[Foxtrot]

the issue with karma is because of new devices changing the way their probes work. Nothing really to do with drivers.

If you looked around a little you'd find plenty of posts on things that are in development and being revealed at defcon.

[SYMBIOTE]

If you capture traffic (either live or tcpdump) you most likely don't obtain nothing due to the fact that most of the time devices falling with karma are mobile phones that use specific apps like facebook or google!

So the best target is a laptop.... but!!!....

Most of the laptops will never leave their houses , and being never connected to a unencrypted network they will never fall with karma!

So here are the everyday scenarios:

You get a lot of mobile device outside, but you can't see shit.

You scan for laptop with point to point but they won't fall for karma.

.....?????? except for some very , very lucky case where a laptop is used in a public spot .... is pretty much useless

If a gap will be spottet in the ios-android apps , then pineapple will come to new life...

If pineapple is able to be in wep-wpa-wpa2 spoof the probe request and accept the client whatever it send for password... then will become a great tool ,

if both even better!

But is time to face the actual reality , no big deal.

[cooper]

And now consider the corporate espionage angle.

You work at MegaCorp. Most people there have several wifi-enabled devices because let's face it, no manager these days would be cought dead anywhere without some sort of high-end gizmo to keep track of things and everybody else just gets a laptop so they can easily move around. The company internal network is clamped down fairly tight, but Wifi was inevitable since management outright demanded it and since one is an avid Apple fanboi and one is an absolute Android fan the solution was a fairly lenient BYOD policy. The workplace has windows that are specially coated to keep the sun out and incidentally keep the 2.4 GHz frequency in.

So let's say that you learn that someone, let's call him... Target, is playing some politic games, trying to push the long-serving but cynical enterprise architect out and get himself to ascend to that position. You know the name of the wifi network he connects to. You know the password. And you have a legitimate and working path onto the wired network to get any traffic you manage to MITM onto the corporate network.

In other news, since the chipset in my laptop will not allow both wired and wireless connectivity at the same time (piece of shit intel Centrino...) and the fact that I've just learned some interesting things about the intentions of my manager regarding a certain co-worker, tomorrow is going to be official "Bring your Pineapple to work day". Gives a whole new meaning to the concept of BYOD.

[tabbek]

I like to think of the pineapple as less of a 'catch-all' drag net (give me all the wifi thingz!) and more of a well baited fish hook, best tasked for specific projects, like a situationally tailored company MITM.

While yes catch-all can be amusing (metro-bus city wide tour with karma!) it doesn't frequently get you much of actual interest.

A specific situation, case in point exploiting the connection behavior noted by Cooper, can be VERY powerful.

.. and yes, faraday cages do get built into some office buildings these days... /noCellServiceRant

[cooper]

*cough*femtocell*cough*

Sorry, I have a cold.

[tabbek]

Yah, they got some for the carrier that provides the company issued cell phones, but even those multiple cells in the building have issues with the interior walls being shielded as well...

And then there are the poor saps like me who use a different carrier. Non business? lol dont care!