Not getting an AP Probe Response

[vapor99]

I know it's early (WIP), but I thought I'd mention that the program will only get an AP Probe Response if someone is joining the network. If the target is already associated to the AP, it needs to get deauthed before listening for a Probe Response.

[vdministrator]

I have the same problem!

[Hackndo]

You're right, that's why I have step 5 in main(), with deauth jamming on the real AP channel.
While jamming with deauth on real AP channel, my fake AP is beaconing continuously on fake channel so that the client sees it and probe requests it. But that is not working. Client keeps probe requesting the real AP on jammed channel. That's the part I can't figure out.

Maybe I shouldn't wait for a probe request, and directly send probe responses on fake channel ? I'll give it a try.

[Hackndo]

Answer is here : https://hackerone.com/reports/286740

The adversary uses Channel Switch Announcements to force victims into connecting to the cloned AP on channel 1.

I need to us CSA

[vapor99]

Have to find the CSA struct. Maybe in hostapd repo ieee.h somewhere.

[ldbfpiaoran]

i see it need wlan1 and wlan0
I would like to ask waln0 is the external network card, then what is waln1?
think you very much!

[Hackndo]

You need two wifi cards that can be used in monitor mode. If you only have one, you need to purchase another one (awus036h for example). But this PoC is WIP, so not working for now.

[ldbfpiaoran]

I use a laptop, if I use a laptop with its own wireless network card and an external card, can you?
And my wireless network card is 8187
thank you very much

[Hackndo]

Just check the paper for details. As I said, you need two wifi cards that can monitor traffic. Internal/external is irrelevant.

[Hackndo]

Commit #f962b19

[ldbfpiaoran]

I saw you updated csa, then want to ask you, this poc can be achieved, use it to attack it,Or is it just a vulnerability verification

[Hackndo]

Its goal is to be a full PoC, not just a vulnerability verification (scapy has a module for that)

[ldbfpiaoran]

谢谢，那您的意思是现在这个poc是可以使用的，还是在完善之中?，我的英语很糟糕，请原谅

[Hackndo]

It's not finished. It will be finished when I remove "WIP" tag from project name (see TODO list in the Readme)

[ldbfpiaoran]

Thank you very much, my leader wanted me to study this vulnerability, but I have absolutely no contact with this protocol, I prefer web security, but spent the day yesterday studying /~https://github.com/vanhoefm/krackattacks- Test-ap-ft in the tool, they found only poc, until encountered your project, I am pleased to meet you, if you can become friends

[Hackndo]

Succeeded to have a Key Reinstallation from the client, but it seems very unstable. Need to work out how to make it more accurate.

[Blkzer0]

Does the target ap have to have csa enabled in order to get an ap probe response?

[Hackndo]

I'm not sure I got your question. Target AP doesn't need to have anything enabled. Client has to understand CSA requests though.

[Blkzer0]

ok im just trying to understand this better, so for the ap probe response to work correctly, someone needs to join the targets ap thats why there is a jammer. Could it be the jammer that doesnt kick everyone off the ap long enough for you to catch the response probe?
For example, i had a few cases where i couldnt get a handshake thru regular means like sending deauth to target ap with aireplay so i had to use mdk3 instead to capture a handshake. Im not sure why but i suspected it to be because of the anti-ap packet spoof feature.

[Hackndo]

Could it be the jammer that doesnt kick everyone off the ap long enough for you to catch the response probe?

I'm only kicking the targeted client, and it's working, it's just unstable, as I said before 😉
Unfortunately I don't have much time to spend on this project. I'll try to improve it later though

[ldbfpiaoran]

hey, I see a exploit on github ,This may be of some help for you. The address is /~https://github.com/NoahhhRyan/krackattacks-test. and doc address is http://www.freebuf.com/articles/wireless/153255.html.Good lucky!

[Hackndo]

Hello,

Thank you for sharing. I saw that and it has plenty of useful information, but it's neither implementing MitM not crypto attack.

Useful paper is channel-base MitM for those who wanna try to make this script work better.

[ldbfpiaoran]

Haha, this agreement is not very understand, I wish you an early completion of your exploit

[Tomotaa]

I enforce it, an error occurred that "Could not retreive an AP Probe response“.What should I do next?

[sergeyzapor]

Is it possible to use the code for WPA-TKIP?

[Hackndo]

@Tomotaa : It might be necessary to force AP Probe Response with a manual deauth
@sergeyzapor : It is not the same thing, and TKIP is already vulnerable to some easier and well known vulnerabilities/attacks. An example here

[ldbfpiaoran]

@sergeyzapor The poc is Imperfect.So It's hard to attack successfully.Also the
author did not update it.

[Lexus89]

Are there any plans to update this PoC to increase stability? Would be really great!

[koerle]

Are there any plans to update this? Last updating is long times ago~ I hope it can be finished,pls~

[Hackndo]

Hi, no i don't have time to update it. But please feel free to do so !

[Rainzer]

I would like to ask if it is necessary to save AP Probe response.

[Hackndo]

Not maintained anymore.