1AIRBASE-NG(8) System Manager's Manual AIRBASE-NG(8)
2
6 airbase-ng - multi-purpose tool aimed at attacking clients as opposed
7 to the Access Point (AP) itself
8
10 airbase-ng options] <interface name>
11
13 airbase-ng is multi-purpose tool aimed at attacking clients as opposed
14 to the Access Point (AP) itself. Since it is so versatile and flexible,
15 summarizing it is a challenge. Here are some of the feature highlights:
16 - Implements the Caffe Latte WEP client attack
18 - Implements the Hirte WEP client attack
19 - Ability to cause the WPA/WPA2 handshake to be captured
20 - Ability to act as an ad-hoc Access Point
21 - Ability to act as a full Access Point
22 - Ability to filter by SSID or client MAC addresses
23 - Ability to manipulate and resend packets
24 - Ability to encrypt sent packets and decrypt received packets
25 The main idea is of the implementation is that it should encourage
27 clients to associate with the fake AP, not prevent them from accessing
28 the real AP.
29 A tap interface (atX) is created when airbase-ng is run. This can be
31 used to receive decrypted packets or to send encrypted packets.
32 As real clients will most probably send probe requests for common/con‐
34 figured networks, these frames are important for binding a client to
35 our softAP. In this case, the AP will respond to any probe request with
36 a proper probe response, which tells the client to authenticate to the
37 airbase-ng BSSID. That being said, this mode could possibly disrupt the
38 correct functionality of many APs on the same channel.
39
41 -H, --help
42 Shows the help screen.
43 -a <bssid>
45 If the BSSID is not explicitly specified by using "-a <BSSID>",
46 then the current MAC of the specified interface is used.
47 -i <iface>
49 Also capture and process from this interface in addition to the
50 replay interface.
51 -w <WEP key>
53 If WEP should be used as encryption, then the parameter "-w <WEP
54 key>" sets the en-/decryption key. This is sufficient to let
55 airbase-ng set all the appropriate flags by itself. If the sof‐
56 tAP operates with WEP encryption, the client can choose to use
57 open system authentication or shared key authentication. Both
58 authentication methods are supported by airbase-ng. But to get a
59 keystream, the user can try to force the client to use shared
60 key authentication. "-s" forces a shared key auth and "-S <len>"
61 sets the challenge length.
62 -h <MAC>
64 This is the source MAC for the man-in-the-middle attack. The
65 "-M" must also be specified.
66 -f <disallow>
68 If this option is not specified, it defaults to "-f allow". This
69 means the various client MAC filters (-d and -D) define which
70 clients to accept.
71 By using the "-f disallow" option, this reverses selection and
73 causes airbase to ignore the clients specified by the filters.
74 -W <0|1>
76 This sets the beacon WEP flag. Remember that clients will nor‐
77 mally only connect to APs which are the same as themselves.
78 Meaning WEP to WEP, open to open.
79 The "auto" option is to allow airbase-ng to automatically set
81 the flag based on context of the other options specified. For
82 example, if you set a WEP key with -w, then the beacon flag
83 would be set to WEP.
84 One other use of "auto" is to deal with clients which can auto‐
86 matically adjust their connection type. However, these are few
87 and far between.
88 In practice, it is best to set the value to the type of clients
90 you are dealing with.
91 -q This suppresses printing any statistics or status information.
93 -v This prints additional messages and details to assist in debug‐
95 ging.
96 -M This option is not implemented yet. It is a man-in-the-middle
98 attack between specified clients and BSSIDs.
99 -A, --ad-hoc
101 This causes airbase-ng to act as an ad-hoc client instead of a
102 normal Access Point.
103 In ad-hoc mode airbase-ng also sends beacons, but doesn't need
105 any authentication/association. It can be activated by using
106 "-A". The soft AP will adjust all flags needed to simulate a
107 station in ad-hoc mode automatically and generate a random MAC,
108 which is used as CELL MAC instead of the BSSID. This can be
109 overwritten by the "-a <BSSID>" tag. The interface MAC will then
110 be used as source mac, which can be changed with "-h
111 <sourceMAC>".
112 -Y <in|out|both>
114 The parameter "-Y" enables the "external processing" Mode. This
115 creates a second interface "atX", which is used to replay/mod‐
116 ify/drop or inject packets at will. This interface must also be
117 brought up with ifconfig and an external tool is needed to cre‐
118 ate a loop on that interface.
119 The packet structure is rather simple: the ethernet header (14
121 bytes) is ignored and right after that follows the complete
122 ieee80211 frame the same way it is going to be processed by air‐
123 base-ng (for incoming packets) or before the packets will be
124 sent out of the wireless card (outgoing packets). This mode
125 intercepts all data packets and loops them through an external
126 application, which decides what happens with them. The MAC and
127 IP of the second tap interface doesn't matter, as real ethernet
128 frames on this interface are dropped anyway.
129 There are 3 arguments for "-Y": "in", "out" and "both", which
131 specify the direction of frames to loop through the external
132 application. Obviously "in" redirects only incoming (through the
133 wireless NIC) frames, while outgoing frames aren't touched.
134 "out" does the opposite, it only loops outgoing packets and
135 "both" sends all both directions through the second tap inter‐
136 face.
137 There is a small and simple example application to replay all
139 frames on the second interface. The tool is called "replay.py"
140 and is located in "./test". It's written in python, but the lan‐
141 guage doesn't matter. It uses pcapy to read the frames and scapy
142 to possibly alter/show and reinject the frames. The tool as it
143 is, simply replays all frames and prints a short summary of the
144 received frames. The variable "packet" contains the complete
145 ieee80211 packet, which can easily be dissected and modified
146 using scapy.
147 This can be compared to ettercap filters, but is more powerful,
149 as a real programming language can be used to build complex
150 logic for filtering and packet customization. The downside on
151 using python is, that it adds a delay of around 100ms and the
152 cpu utilizations is rather large on a high speed network, but
153 its perfect for a demonstration with only a few lines of code.
154 -c <channel>
156 This is used to specify the channel on which to run the Access
157 Point.
158 -X, --hidden
160 This causes the Access Point to hide the SSID and to not broad‐
161 cast the value.
162 -s When specfiied, this forces shared key authentication for all
164 clients.
165 The soft AP will send an "authentication method unsupported"
167 rejection to any open system authentication request if "-s" is
168 specified.
169 -S It sets the shared key challenge length, which can be anything
171 from 16 to 1480. The default is 128 bytes. It is the number of
172 bytes used in the random challenge. Since one tag can contain a
173 maximum size of 255 bytes, any value above 255 creates several
174 challenge tags until all specified bytes are written. Many
175 clients ignore values different than 128 bytes so this option
176 may not always work.
177 -L, --caffe-latte
179 Airbase-ng also contains the new caffe-latte attack, which is
180 also implemented in aireplay-ng as attack "-6". It can be used
181 with "-L" or "caffe-latte". This attack specifically works
182 against clients, as it waits for a broadcast arp request, which
183 happens to be a gratuitous arp. See this for an explanation of
184 what a gratuitous arp is. It then flips a few bits in the sender
185 MAC and IP, corrects the ICV (crc32) value and sends it back to
186 the client, where it came from. The point why this attack works
187 in practice is, that at least windows sends gratuitous arps
188 after a connection on layer 2 is established and a static ip is
189 set, or dhcp fails and windows assigned an IP out of
190 169.254.X.X.
191 "-x <pps>" sets the number of packets per second to send when
193 performing the caffe-latte attack. At the moment, this attack
194 doesn't stop, it continuously sends arp requests. Airodump-ng is
195 needed to capture the replies.
196 -N, --cfrag
198 This attack listens for an ARP request or IP packet from the
199 client. Once one is received, a small amount of PRGA is
200 extracted and then used to create an ARP request packet targeted
201 to the client. This ARP request is actually made of up of multi‐
202 ple packet fragments such that when received, the client will
203 respond.
204 This attack works especially well against ad-hoc networks. As
206 well it can be used against softAP clients and normal AP
207 clients.
208 -x <nbpps>
210 This sets the number of packets per second that packets will be
211 sent (default: 100).
212 -y When using this option, the fake AP will not respond to broad‐
214 cast probes. A broadcast probe is where the specific AP is not
215 identified uniquely. Typically, most APs will respond with probe
216 responses to a broadcast probe. This flag will prevent this hap‐
217 pening. It will only respond when the specific AP is uniquely
218 requested.
219 -0 This enables all WPA/WPA2/WEP Tags to be enabled in the beacons
221 sent. It cannot be specified when also using -z or -Z.
222 -z <type>
224 This specifies the WPA beacon tags. The valid values are:
225 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104.
226 -Z <type>
228 same as -z, but for WPA2
229 -V <type>
231 This specifies the valid EAPOL types. The valid values are:
232 1=MD5 2=SHA1 3=auto
233 -F <prefix>
235 This option causes airbase-ng to write all sent and received
236 packets to a pcap file on disk. This is the file prefix (like
237 airodump-ng -w).
238 -P This causes the fake access point to respond to all probes
240 regardless of the ESSIDs specified.
241 -I <interval>
243 This sets the time in milliseconds between each beacon.
244 -C <seconds>
246 The wildcard ESSIDs will also be beaconed this number of sec‐
247 onds. A good typical value to use is "-C 60" (require -P).
248 -n <hex>
250 ANonce (nonce from the AP) to use instead of a randomized one.
251 It must be 64 hexadecimal characters.
252 Filter options:
254 --bssid <MAC>, -b <MAC>
256 BSSID to filter/use.
257 --bssids <file>, -B <file>
259 Read a list of BSSIDs out of that file.
260 --client <MAC>, -d <MAC>
262 MAC of client to accept.
263 --clients <file>, -D <file>
265 Read a list of client's MACs out of that file.
266 --essid <ESSID>, -e <ESSID>
268 Specify a single ESSID. For SSID containing special characters,
269 see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spa‐
270 ces_double_quote_and_single_quote_etc_in_ap_names
271 --essids <file>, -E <file>
273 Read a list of ESSIDs out of that file. It will use the same
274 BSSID for all AP which can generate some interesting output in
275 Airodump-ng like: http://www.chimplabs.com/blog/2015/09/24/unin‐
276 tentional-fun-with-aircrack-ng-at-derbycon-5-0/
277
279 This manual page was written by Thomas d'Otreppe. Permission is
280 granted to copy, distribute and/or modify this document under the terms
281 of the GNU General Public License, Version 2 or any later version pub‐
282 lished by the Free Software Foundation On Debian systems, the complete
283 text of the GNU General Public License can be found in /usr/share/com‐
284 mon-licenses/GPL.
285
287 aireplay-ng(8)
288 airmon-ng(8)
289 airodump-ng(8)
290 airodump-ng-oui-update(8)
291 airserv-ng(8)
292 airtun-ng(8)
293 besside-ng(8)
294 easside-ng(8)
295 tkiptun-ng(8)
296 wesside-ng(8)
297 aircrack-ng(1)
298 airdecap-ng(1)
299 airdecloak-ng(1)
300 airolib-ng(1)
301 besside-ng-crawler(1)
302 buddy-ng(1)
303 ivstools(1)
304 kstats(1)
305 makeivs-ng(1)
306 packetforge-ng(1)
307 wpaclean(1)
308 airventriloquist(8)
309Version 1.5.2 December 2018 AIRBASE-NG(8)