Injection Wizard
Injection Wizard is an application for injecting traffic into WEP protected Wi-Fi networks,
like aireplay-ng, but it's much more easy to use and it can work with worse conditions
(for example, more interferences, weaker transmitted/received signals, more restricted access points, etc ).
The higher the traffic of the network the earlier we will be able to crack a WEP key with tools like aircrack-ng,
airsnort, dwepcrack, weplab, WEPAttack, WEPCrack, etc. However, injecting
traffic is not easy, because you must build or capture a frame that causes a response frame in any other station
(that is, a wireless node). This application carries out automatically all the needed actions to build
a frame that causes a response in other station. These actions can be summarized in the following sequence of steps:
- The application scans Wi-Fi networks and shows a list of WEP protected networks, then
it allows the user to select one of them.
- It joins the selected network and monitors that network in order to find a data frame
- It tries to extract a keystream prefix from the captured frame and then it tries to
extend the keystream up to 40 bytes by means of the W. A. Arbaugh's
inductive chosen plaintext attack.
- It tries to find a host (for example, a connected computer, a network device, etc), which has
an IP address belonging to a predefined range, by injecting forged ARP packets.
- After finding an active host, it injects ARP packets targeted at that host.
Some of the benefits of this application are easiness of use (due to its graphical interface,
automatic operation, etc) and robustness (detection/management of network disconnections,
repetition of failed actions, etc). Moreover, the Arbaugh's inductive attack can be performed by
any Wi-Fi interface supporting injection in monitor mode, because the interface driver
doesn't need any additional patch as it's usual to happen with the Bittau's fragmentation attack.
Besides its higher applicability, this attack is generally more reliable than Chop-Chop attack
for recovering a keystream of a given size, because it doesn't have to inject any frame larger than
needed.
This application is distributed under the terms of the GNU General Public License version 2
(see the license.htm file for more details) and comes with absolutely no warranty.
The author assumes no responsibility derived from the use or the distribution of this program.
The copyright of this application is owned by Fernando Pablo Romero Navarro (May 2010). Injection Wizard
has made use of (with convenient modifications) the following free software applications:
- scapy (version 2.0.1), distributed under the license: GNU GPL version 2.
Copyright: Philippe Biondi, 2009
(http://www.secdev.org/projects/scapy).
- python-wifi (version 0.3.1), distributed under the license: GNU LGPL version 2.1.
Copyright: RĂ³man Joost, 2004-2008.
Software Requirements
For the client application (graphical interface):
- Any system with a recent Java virtual machine: JRE version 1.6 or later.
For the server application:
- A Linux box with a recent kernel, so it should support Wireless Extensions version 22 or later
(since kernel version 2.6.21) and the mac80211 stack for Wi-Fi interfaces (since kernel version
2.6.24 it is supported by many Wi-Fi adapter drivers).
- A Wi-Fi network interface driver supporting injection in monitor mode (sometimes it's required to patch
the driver for supporting this feature).
- The iw system command, if it's not provided by your Linux distribution you can get it by
installing the aircrack-ng package or by compiling the source code that can be downloaded from:
http://wireless.kernel.org/download/iw.
- A Python interpreter with version 2.5, later versions might also work.
Instructions
- Uncompress the injwiz.zip file.
- Copy the client directory on a system with a Java virtual machine
accessible from the command path (for example, launch a shell, enter the client
directory, execute the command:
java -version
and check the command outputs
the JRE version number).
- Copy the server directory on a Linux box. If the client and
server directories weren't copied on the same machine, you should edit the
runserver.sh script (in the server directory) and replace
the IP address: 127.0.0.1 with the IP address of the Linux box network interface that
is attached to the same network that the client machine (i.e. the computer that hosts
the client directory).
- Enter the server directory and run the script: ./runserver.sh
(the Python interpreter should be accessible from the command path. You can check this by
running:
python -V
from the command line and verifying that the interpreter
version is showed).
- On the client machine, enter the client directory and run either the script:
./runclient.sh (for Linux or Unix-like operating systems providing a
shell compatible with the Bourne shell and whose path for the executable file is:
/bin/sh) or runclient.bat (for Windows).
Client Configuration
- If the graphical user interface language is not English, you should edit the
client.properties file in the client directory
and then you should insert (or conveniently modify) the following text line:
language=english
.
- If you modify the IP address or the connection port in the runserver.sh
file then the Configuration -> Server submenu will be enabled by the
client application, so you can set up the same parameters for it.
-
The Interface dialog allows you to select the wireless interface that is used
for network scanning (assuming it works in Managed mode). By means of this interface
the application creates a virtual interface (that is called monX, where X is
0 or a positive integer) that works in monitor mode and allows to monitor and inject traffic.
If the interface driver, when working in monitor mode, delivers frames that contain
a field called FCS, select Yes for the the FCS parameter,
otherwise select No (if you are unsure, select Yes or find out whether
the frames contain such field by means of a network sniffer, like Wireshark or Tcpdump).
Most wireless interfaces drivers (included in recent kernel versions), when working in
monitor mode, add a Radiotap header to captured frames (you can check this with a network sniffer),
so you should select this option for the Header in Monitor Mode parameter, unless you are sure
that your driver don't do it. In the latter case, it could happen that no header in monitor mode was added
by your driver, therefore you must select the None option for this parameter (however, note
that some network sniffers might remove this kind of header when capturing frames, so if you want to check
this feature, I recommend that you use Wireshark). In any other case, select the Auto
option.
(NOTE: No other class of header in monitor mode, like Prism header, is supported).
- On the Subnet dialog, you must input into the two fields of the Subnet Prefix
parameter the first two numbers of a valid private IP address (for example: 192.168, 172.16, 169.254, 10.0, etc).
These two numbers will be interpreted as the IP address prefix of the WEP protected subnetwork.
The Scan Type parameter allows to execute a complete
scanning of hosts belonging to the target subnetwork (for example, it searches for hosts with IP addresses
beginning with X.Y.0.1 and ending with X.Y.255.254, where X and Y
are the configured subnet prefix numbers, until any host responds or the address range is exhausted).
Alternatively, the application allows to carry out a partial scanning, so only the
IP addresses with the most common suffixes are probed (for example, addresses ending with Z.1,
where 0 <= Z < 256, are first to be scanned, then if no response is received, it goes on with
the range: Z.254, next is Z.100, etc).
-
- The Errors dialog allows to fix the Retries parameter, which
determines the number of times a frame will be resent in case the expected response isn't
received. It also allows to fix the Time out parameter, which limits the maximum time
the application will wait for the response to a frame previously sent. Generally, the higher
the value of both parameters, the worse the communication channel conditions that can be tolerated
by the application (though trading off performance). However, if conditions get worse below certain
threshold, the communication will break down even though the maximum values for both parameters
were set up.
- The Configuration -> Save submenu allows to save the application's current configuration,
so it will be available for the next session.
Frequently Asked Questions
- Can my Wi-Fi network interface inject?
Many drivers, based on the
mac80211 stack, have built-in support for injection in monitor mode
(except some of the most recent). Other older drivers (non-
mac80211-based) can also inject if the
suitable patches are applied to them. You can find a large amount of information about Wi-Fi interface drivers
and how to patch them (when necessary) on the
aircrack-ng wiki:
(
http://www.aircrack-ng.org/doku.php).
Anyway, you can check this feature by means of the injection test provided by the
aircrack-ng suite:
sudo aireplay-ng --test monX
(assuming
monX is a virtual interface in monitor mode).
- Why can't I connect to the network called "anyESSID"?
It is possible, although very rarely, that a Wi-Fi network relies on shared key authentication
(it doesn't almost improve the security with respect to basic authentication). Unfortunately,
this application doesn't implement any attack against this sort of authentication, so it cannot
inject traffic into such network. Another possibility could be that the application tried to
connect to an access point that has a MAC address filter enabled. In such case, you should
replace the MAC address of your Wi-Fi interface with the MAC address of a legitimate user's interface
(for example, by executing the command: ifconfig <interface> hw ether <userMAC>
).
Finally, it might happen that the transmitted signal doesn't arrive at the access point with enough strength
for being decoded. In such case, you should raise the transmitted signal power (for example, raise the
output power: iwconfig <interface> txpower <XX>dbm
, however not all the drivers
allow to change the output power in this way; if your Wi-Fi interface has attached an antenna, try to
change its orientation, but if you can't manage it in this way, you should get a higher gain antenna).
- why does the keystream extension attack stop itself when reaching the "n-th" byte?
Radio signals propagate in complex ways (reflection, refraction, diffraction, etc) and conditions of radio
frequency environments can change very quickly. Thus, a signal transmitted by an access point/network interface
might arrive at a network interface/access point with enough strength for being decoded during certain interval,
however the power of the received signal could be drastically reduced a few seconds later. In addition, as the
attack goes forward, larger frames are transmitted, which are more likely to be received with errors.
The workarounds are the same than in the previous case (that is, when you don't have enough signal power to connect
to a network, but data transmission may require a higher increase in power than network connection).
- Why does the application display a wrong signal-to-noise ratio or a wrong link quality for
all the detected networks?
The way to measure these parameters and theirs measurement units depend on each particular driver.
Also, things become more complicated because some drivers don't implement correctly some functions
(defined by the Wireless Extensions interface) that yield the values of these parameters.
Contact
If you have any question, suggestion or comment, you may contact the author by means of the following
e-mail address: fernpromero(at)gmail(dot)com (please, replace each parenthesis and its content with
the corresponding character).
If you regard this application as useful for any purpose whatsoever or you would like to contribute to
improving or adding some features, you may make a donation by clicking this link: