Taylor Jolin

Hacker | Musician | Innovator | Dreamer
Download Resume Contact Me

Category: Technology

28May

Packing Sniffing with Airodump-ng

Airodump-ng is part of the Airocrack-ng suite. It is a packet sniffer designed to capture packets while in monitor mode.

DISCLAIMER: As I have said before, I am not responsible if you choose to do something stupid and get yourself arrested. Hack legally and hack friendly!

How to use Airodump-ng

  1. First we must enable monitor mode on our interface. If you do not know how, read through this.
  2. Next, enter the following command to begin the program: airodump-ng INTERFACE_NAME
    NOTE: This program will run until you force it to quit.

Now analyze the data you retrieve. You will see a list of BSSIDs or Network Names.

Below is a list and explanation of what you will see.

BSSIDPWRBeacons# Data# /sCHMBENCCipherAuthESSID
Nodes MAC AddressSignal StrenghFrames sent by network to broadcast its existanceNumber of Data packetsNumber of packets collect in past 10 secondsChannel network broadcasts onMaximum Bandwidth SupportedEncryption TypeCipher used in network encryptionAuthentication used in networkName of network

NOTE: The best adapter to use to sniff packets across networks is the Alfa Network AWUS036AC* series. The one I am using is the AWUS036ACS, which is small and fits neatly into my bag. I also have a multitude of antennas to use for wireless sniffing.

How to listen to 5 Ghz channels

By default, Airodump-ng only listens to 2.4 Ghz channels, so to enable the 5 Ghz scanning do the following:

  1. Start Airodump-ng by using the band argument: airodump-ng --band a INTERFACE_NAME

You can also specify multiple bands using the band argument. For example;
airodump-ng --band abg INTERFACE_NAME

NOTE: Your wireless card needs to support this feature. Also keep in mind that this requires a great deal of power and slows resources.

28May

How to enter Monitor Mode for WiFi Hacking

Monitor mode allows you to sniff packets and capture them in real time. Using a program such as Wireshark, you can then rebuild and analyze these packet captures.

  1. First check the status of the wireless and see what mode it is in using: iwconfig
  2. Next we must disable our selected interface using: ifconfig INTERFACE-NAME down
  3. This step may be optional, but in most cases you will want to kill tasks that could be a detriment to the packet capture. Do this using: airmon-ng check kill
    • NOTE: Running the previous command will display some suggested apps to kill prior to running the capture. To kill these apps use: kill PID
  4. Now we will enable monitor mode. To do so use the following: iwconfig INTERFACE_NAME mode monitor
  5. Finally, you must re-enable the interface using: ifconfig INTERFACE_NAME up
  6. Test to make sure you are in monitor mode using: iwconfig
27May

Anonymous – How To Change Your MAC Address

In this short tutorial, I will teach you how to change your computers MAC address in order to remain anonymous while pen testing a network.

DISCLAIMER: I am not responsible for any illegal use of this technique.

NOTE: I am not using Kali Linux for my pen testing rig. I am using Ubuntu 22 and have built it out with all of the tools that I require to do my pen testing. This technique should work on newer Debian based distributions.

Why change the MAC Address

  • To maintain anonymity while performing network penetration testing.
  • To impersonate other devices on the network
  • Bypassing filters

How to change the MAC Address

  1. First, use ifconfig to list all interfaces on the machine.
  2. Find the interface you wish to choose the MAC address of.
    • note the MAC address and interface name
  3. In order to proceed with changing the MAC of your chosen interface, you must disable it first before changing it’s MAC address.
    • ifconfig INTERFACE-NAME down
  4. Now we can change the hardware address, or ether address
    • ifconfig INTERFACE-NAME hw ether 00:00:00:00:00:00
    • NOTE: you can use any address but it must start with 00
  5. Now we must re-enable the interface for it to work
    • ifconfig INTERFACE-NAME up
    • NOTE: The MAC Address will only remain until the computer is restarted. Once it is restarted it will revert back to the original hardware address.

27May

Pentesting Methodology – Recon

This workflow is in no way associated with any other framework. This is my personal general approach to hacking a machine or network.

Physical Attacks

Do you have physical access to the network or a machine? If so there are a ton of physical attacks that can be waged on a network or machine.

One attack that is fairly easy to do is outlined below. I refer to it as the SETHC Attack. Remember, you need physical access to the machine you are attacking for this hack to work.

  1. First, you need to find an boot disk of some sort. Linux Distro, Hiren’s Boot CD, anything that gives access to the file directory. Once you have your boot disc in order, insert it into the computer and reboot. Enter the Bios’ boot mode and select the media that you wish to boot to (i.e. your boot disc).
  2. Once booted, use the file manager and locate a file called SETHC.EXE. It will be located in C:\Windows\System32\
  3. Make a copy of the file and name it whatever you like.
  4. Find the executable for the CMD Prompt, CMD.EXE, which is also in that folder. Copy it and rename it SETHC.EXE
  5. Reboot the computer and let it boot into Windows.
  6. At the login screen, hit the SHIFT button 5 times and a CMD window will appear.
  7. Type in the following to reset the local administrator account:
    • net user administrator password
    • NOTE: password should be changed to your desired password
  8. Login to the computer with the local admin account.

Host or Asset Discovery

There are two types of tests that can be ran, an internal or external test. An internal test would look for hosts on the internal network whereas an external test would look for assets on the perimeter of the network.

  • Recon – The first thing you should do when approaching any device is to perform a port scan. With the right port scanning tool, you can learn all sorts of information about the host device. I prefer to use NMAP but there are a wealth of others. You can even call NMAP from Metasploit and run it. Once we have a target thoroughly mapped out and we have found all of the information we can, we can then move on to looking for vulnerabilities or known exploits.

In the event that you find multiple hosts on the network, try to do an OS discovery to see what is what and if it may be of any interest later on. One could usually assume that Linux, Mac, and Windows servers have some sort of misconfiguration somewhere. This goes the same for networking appliances such as firewalls, switches, routers, etc…

21Dec

So what is Log4j and why do we care?

Well, first, we need to understand what Log4j is. Essentially, Log4j is the logging function that is built-in in Java applications. This current vulnerability is affecting Apache servers; however, I feel that it will spread to a larger domain of targets aside from web servers.

On December 9th, the initial vulnerability was discovered, and software and hardware makers scrambled to issue patches for their products. A few days later, however, Hideki Okamoto of Akamai Technologies and other researchers found additional vulnerabilities within the patches.

So why is this a big deal? Well, Java is a colossal language and has a presence in a large number of consumer products. This vulnerability allows for the remote execution of code. When exploited, Log4J enables the attacker to remotely inject code into services that use the Log4j library with system-level privileges.

So what do we do? Updating Java is not enough. One thing you can do is update to Log4j2 version 2.16. If you cannot update, you can mitigate this vulnerability by setting either the system property log4j2.formatMsgNoLookups or the environmental variable LOG4J_FORMAT_MSG_NO_LOOKUPS to TRUE.

28Nov

Trying out Logic Pro X…

I have become a total Mac enthusiast over the past few years and this is even further down the rabbit hole. I used to use Reaper as my primary DAW but decided to try Logic out finally. I love the editing features of Logic and am now a full convert. This mix in this post is using Logic Pro with the built in EQs and Compressors.

On the master track I have used the Slate Virtual Mix Rack. The guitar tracks are pretty straight forward; my Ibanez 8 string into my old, trusty AxeFX Ultra.