WifiZoo v1.3 Working & Fixed Graph/Config. Issue [Archive]

secure_it

07-04-2008, 07:21 PM

Hello to all the BT3 distro geeks,users.n00bs.thanks to respected moderators and developers of BT to make such a wonderful pen-testing & VA distro.this forum is base of all the security learning & I have learned a lot from this.I found that wifizoo scriptis a wonderful VA/PT tool.here is how I am running wifizoo script on my laptop running wireless NIC Intel 3945 a/b/g along with Discovery/Injection support.here is step by step configuration along with problem solved with logs and graph rendering in BT3 Final.

Brief about wifizoo-WifiZoo is a tool to gather wifi information passively.Among many other things Wifizoo can do the following: "-gathers useful information from unencrypted wifi traffic (ala Ferret,and dsniff, etc); like pop3 credentials, smtp traffic, http cookies/authinfo, msn messages,ftp credentials, telnet network traffic, nbt, etc."

download the following tools first

WifiZoo v1.3
http://community.corest.com/~hochoa/wifizoo/wifizoo_v1.3.tgz (http://community.corest.com/%7Ehochoa/wifizoo/wifizoo_v1.3.tgz)
scapy
http://hg.secdev.org/scapy/raw-file/tip/scapy.py
graphviz 2.18 update for BT3
http://slacky.uglyplace.org/repository/slackware-12.0/graphic/graphviz/2.18/graphviz-2.18-i486-1sl.tgz

check your wireless NIC which supports both discovery & Injection & note it.In intel 3945 it is wifi0(ipwraw driver)
e.g.
bt~#modprobe -r iwl3945
bt~#modprobe ipwraw
bt~#iwconfig

now lets start the installation

bt~#installpkg graphviz-2.18-i486-1sl.tgz (http://slacky.uglyplace.org/repository/slackware-12.0/graphic/graphviz/2.18/graphviz-2.18-i486-1sl.tgz)
bt~#tar -zxvf wifizoo_v1.3.tgz

copy the scapy.py to wifizoo_v1.3 folder

bt~#cp scapy.py wifizoo_v1.3
bt~#cd wifizoo_v1.3

edit the wifizoo.py in kwrite and find line 48 put your wireless card name here.

conf.iface = 'wifi0'
save and quit the editor

goto wifizoo_v1.3 folder & create a new folder by name log(its very imp to create log folder otherwise the script wont be able to generate graph files.

run the airodump-ng tool for discovering

bt~#airodump-ng wifi0

now run the wifizoo script in separate shell

bt~#python wifizoo.py -i wifi0

launch the internet browser
in URL bar type
http://127.0.0.1:8000

you will be presented with GUI along with many options like SSIDS(AP) List,stats,captured data etc.you can find both open & enc. protected AP's however it can sniff only clear text credentials like POP3,FTP,SMTP,MSN Data and Cookies for session-replay.
for more logs go to wifizoo log folder which we created and you can find following log files

-clients.log
-ssids.log
-probereq.log
-http.log
-httpauth.log
-cookies.log
-pop3.log
-pop3_creds.log
-smtp.log
-msn.log
-nbtdgm.log
-nbtns.log
-ftp.log
-telnet.log

I have attached the images so it would be easy for most of users to configure it.

go & check the captured data in firefox
there you will find

BSSID->Clients Graph

it will show the connectivity of each AP with its Clients in graph form.
for saving each graph format log file into an image.follow these steps:-

goto wifizoo log folder & convert the directed graph accordingly to an viewable graph image.

bt~#dot -Tpng -oclients.png clients.log

(it will create a png image for viewing)

using captured data you can replay a session cookie untill its not expired or can sniff telnet/ftp passwords like dsniff tool.

hope this would help a lot who wants to work on wifizoo script for PT.

Secure_it
(Codename:ThUndErBolT)
MS(IT),DOEACC A Level,MCSE:Security,Comptia Security+,EC CEH,Cisco CCNA,CCSP,CCIE-Security

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo1.png?t=1215216874

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo2.png?t=1215216949

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo3.png?t=1215216989

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo4.png?t=1215217022

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo5.png?t=1215217056

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo6.png?t=1215217092

http://i314.photobucket.com/albums/ll423/h4x0ri33t/wifizoo7.png?t=1215217189

anathema

07-05-2008, 09:59 AM

Great easy to follow tutorial. ;-)

Thanks.

I've played around with wifizoo and ferret before, but I just thought I would follow this guide to see if anything new would be discovered.

It was well written and the direct download links just make things easier, also the screenshots will help as a picture tells a thousand words as they say.

chivar.of.makati.ph

07-08-2008, 10:14 AM

great walkthrough u got here. i was able to sniff some packets floating around. but i only have some question regarding "cookies" do i need another network interface to use since my ath0/wifi0 is busy and being used by wifizoo... do i need eth0 enabled or something??

chivar.of.makati.ph

07-08-2008, 10:18 AM

and also is it possible to route the wifi url (ht tp://127.0.0.1:8000) to other?? like i.e. 192.168.1.101:8000 .. so in effect it could be used by my other laptop as well??

ReckaH

07-08-2008, 10:24 AM

great tutorial

Thanks for you time to make it :D

secure_it

07-08-2008, 05:45 PM

great walkthrough u got here. i was able to sniff some packets floating around. but i only have some question regarding "cookies" do i need another network interface to use since my ath0/wifi0 is busy and being used by wifizoo... do i need eth0 enabled or something??

There is no need for another wireless interface and there is no relation with ethernet interface here because wifizoo script deals with wireless sniffing and cookie stealing or sessioon reply(WIRELSS Only)

and also is it possible to route the wifi url (ht tp://127.0.0.1:8000) to other?? like i.e. 192.168.1.101:8000 .. so in effect it could be used by my other laptop as well??

umm not tested it yet but you may go ahead and try edit the python scripts.whenever I find solution I will update the post.thanks for comments

great tutorial

Thanks for you time to make it :D

Thanks dude.

twocent$

07-09-2008, 03:54 PM

[QUOTE=secure_it;90428]Hello to all the BT3 distro geeks,users.n00bs.thanks to respected moderators and developers of BT to make such a wonderful pen-testing & VA distro.this forum is base of all the security learning & I have learned a lot from this.I found that wifizoo scriptis a wonderful VA/PT tool.here is how I am running wifizoo script on my laptop running wireless NIC Intel 3945 a/b/g along with Discovery/Injection support.here is step by step configuration along with problem solved with logs and graph rendering in BT3 Final.

Thanks for the great tut. Worked straight off for a noob like me. had to change:

bt~#cp scapy.py wifizoo_v1.2 to bt~#cp scapy.py wifizoo_v1.3

Thanks again.

phoenix910

07-17-2008, 08:52 AM

and also is it possible to route the wifi url (ht tp://127.0.0.1:8000) to other?? like i.e. 192.168.1.101:8000 .. so in effect it could be used by my other laptop as well??

It will automatically be listening on both the localhost address (127.0.0.1) and it's network address (say 10.1.1.4). So you could connect to it from another computer via http://10.1.1.4:8000

~phoenix910

chivar.of.makati.ph

07-20-2008, 07:50 AM

hey i havent viewed this thread in a while :) thanks sir phoenix910

edit:
nope it didnt work... though im thinking there's something i did wrong.. i stopped my wifi0 interface to set it to monitor mode from managed mode so it disconnects from my ap and didn't have a valid ip :(

phoenix910

07-20-2008, 08:36 AM

Yeah, you'll need a valid IP on that network ;) So get a second NIC, or connect via Ethernet.

~phoenix910

w116tjb

08-13-2008, 09:44 AM

and also is it possible to route the wifi url (ht tp://127.0.0.1:8000) to other?? like i.e. 192.168.1.101:8000 .. so in effect it could be used by my other laptop as well??

There's no need to do this... When you set up your wireless interface, it will split it into two interfaces, ath0 and ath1. One is monitor mode and the other managed mode. You capture the wireless traffic using your monitor interface and you are able to associate with the open access point with your managed interface to connect with the captured information.

I think the original poster forgot a step, I may be wrong though, I didn't read it too closely. You'll need to set your proxy address to 127.0.0.1:8080. That way it will look inside your own computer for the information before checking the internet. Great tutorial though. Very well written.

secure_it

08-15-2008, 12:02 PM

There's no need to do this... When you set up your wireless interface, it will split it into two interfaces, ath0 and ath1. One is monitor mode and the other managed mode. You capture the wireless traffic using your monitor interface and you are able to associate with the open access point with your managed interface to connect with the captured information.

I think the original poster forgot a step, I may be wrong though, I didn't read it too closely. You'll need to set your proxy address to 127.0.0.1:8080. That way it will look inside your own computer for the information before checking the internet. Great tutorial though. Very well written.
True if you are monitoring on same channel on which your other interface is connected with AP.
e.g. if ath0 is connected with AP on channel 11 then you can put ath1 in monitor mode on channel 11 only.

Fishy80

09-22-2008, 10:57 PM

I believe the link to that scapy.py is down, any chance of a good link for the scapy.py?

secure_it

09-23-2008, 05:18 AM

Links are working perfectly.problem is with your connection.

Fishy80

09-23-2008, 04:29 PM

strange, when I download it, it says its scapy.py except this is the files contents...<body bgcolor="#f0f0f8"> -->
<body bgcolor="#f0f0f8"> --> -->
 </script> </object> </blockquote> </pre>
</table> </table> </table> </table> </table> <body bgcolor="#f0f0f8">
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="heading">
<tr bgcolor="#6622aa">
<td valign=bottom>  
  <big><big>KeyError</big></big></td
><td align=right valign=bottom
>Python 2.4.4: /usr/bin/python Tue Sep 23 22:36:53 2008</td></tr></table>

A problem occurred in a Python script. Here is the sequence of
function calls leading up to the error, in the order they occurred.
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///home/cartel/pbi/secdev.org/hg/cgi/hgwebdir.cgi">/home/cartel/pbi/secdev.org/hg/cgi/hgwebdir.cgi</a> </td></tr>
<tr><td><tt>   43  
</tt></td></tr>
<tr><td><tt>   44 def make_web_app(): 
</tt></td></tr>
<tr><td><tt>   45     return hgwebdir("/home/cartel/pbi/secdev.org/hg/hgweb.conf") 
</tt></td></tr>
<tr><td><tt>   46  
</tt></td></tr>
<tr><td bgcolor="#ffccee"><tt>   47 wsgicgi.launch(wsgiapplication(make_web_app)) 
</tt></td></tr>
<tr><td>wsgicgi = <module 'mercurial.hgweb.wsgicgi' from '/usr/loc...hon2.4/site-packages/mercurial/hgweb/wsgicgi.py'>, wsgicgi.launch = <function launch>, wsgiapplication = <class 'mercurial.hgweb.request.wsgiapplication'>, make_web_app = <function make_web_app></td></tr></table>
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///usr/local/lib/python2.4/site-packages/mercurial/hgweb/wsgicgi.py">/usr/local/lib/python2.4/site-packages/mercurial/hgweb/wsgicgi.py</a> in launch(application=<mercurial.hgweb.request.wsgiapplicat ion object>)</td></tr>
<tr><td><tt>   59         return write 
</tt></td></tr>
<tr><td><tt>   60  
</tt></td></tr>
<tr><td bgcolor="#ffccee"><tt>   61     result = application(environ, start_respo nse) 
</tt></td></tr>
<tr><td><tt>   62     try: 
</tt></td></tr>
<tr><td><tt>   63         for data in result: 
</tt></td></tr>
<tr><td>result undefined, application = <mercurial.hgweb.request.wsgiapplication object>, environ = {'DOCUMENT_ROOT': '/home/cartel/pbi/secdev.org/hg/htdocs/', 'GATEWAY_INTERFACE': 'CGI/1.1', 'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'HTTP_ACCEPT_CHARSET': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'HTTP_ACCEPT_ENCODING': 'gzip,deflate', 'HTTP_ACCEPT_LANGUAGE': 'en-us,en;q=0.5', 'HTTP_CACHE_CONTROL': 'no-cache', 'HTTP_CONNECTION': 'keep-alive', 'HTTP_HOST': 'hg.secdev.org', 'HTTP_KEEP_ALIVE': '300', ...}, start_response = <function start_response></td></tr></table>
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///usr/local/lib/python2.4/site-packages/mercurial/hgweb/request.py">/usr/local/lib/python2.4/site-packages/mercurial/hgweb/request.py</a> in __call__(self=<mercurial.hgweb.request.wsgiapplication object>, wsgienv={'DOCUMENT_ROOT': '/home/cartel/pbi/secdev.org/hg/htdocs/', 'GATEWAY_INTERFACE': 'CGI/1.1', 'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'HTTP_ACCEPT_CHARSET': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'HTTP_ACCEPT_ENCODING': 'gzip,deflate', 'HTTP_ACCEPT_LANGUAGE': 'en-us,en;q=0.5', 'HTTP_CACHE_CONTROL': 'no-cache', 'HTTP_CONNECTION': 'keep-alive', 'HTTP_HOST': 'hg.secdev.org', 'HTTP_KEEP_ALIVE': '300', ...}, start_response=<function start_response>)</td></tr>
<tr><td><tt>   16  
</tt></td></tr>
<tr><td><tt>   17     def __call__(self, wsgienv, start_respons e): 
</tt></td></tr>
<tr><td bgcolor="#ffccee"><tt>   18         return _wsgirequest(self.destmaker(), wsg ienv, start_response) 
</tt></td></tr>
<tr><td><tt>   19  
</tt></td></tr>
<tr><td><tt>   20 class _wsgioutputfile(object): 
</tt></td></tr>
<tr><td>global _wsgirequest = <class 'mercurial.hgweb.request._wsgirequest'>, self = <mercurial.hgweb.request.wsgiapplication object>, self.destmaker = <function make_web_app>, wsgienv = {'DOCUMENT_ROOT': '/home/cartel/pbi/secdev.org/hg/htdocs/', 'GATEWAY_INTERFACE': 'CGI/1.1', 'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'HTTP_ACCEPT_CHARSET': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'HTTP_ACCEPT_ENCODING': 'gzip,deflate', 'HTTP_ACCEPT_LANGUAGE': 'en-us,en;q=0.5', 'HTTP_CACHE_CONTROL': 'no-cache', 'HTTP_CONNECTION': 'keep-alive', 'HTTP_HOST': 'hg.secdev.org', 'HTTP_KEEP_ALIVE': '300', ...}, start_response = <function start_response></td></tr></table>
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///usr/local

I tried it from multiple computers/connections...

I'm pretty sure that's not working correctly.. (had to cut some of the code out, as there is a 10000 character limit)

Fishy80

09-23-2008, 04:31 PM

also
the link to graphviiz is just not working,"address not found" I also tried that from multiple connections, is this really just a freak internet phenomenom in my area?

w116tjb

09-25-2008, 12:17 PM

strange, when I download it, it says its scapy.py except this is the files contents...<body bgcolor="#f0f0f8"> -->
<body bgcolor="#f0f0f8"> --> -->
 </script> </object> </blockquote> </pre>
</table> </table> </table> </table> </table> <body bgcolor="#f0f0f8">
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="heading">
<tr bgcolor="#6622aa">
<td valign=bottom>  
  <big><big>KeyError</big></big></td
><td align=right valign=bottom
>Python 2.4.4: /usr/bin/python Tue Sep 23 22:36:53 2008</td></tr></table>

A problem occurred in a Python script. Here is the sequence of
function calls leading up to the error, in the order they occurred.
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///home/cartel/pbi/secdev.org/hg/cgi/hgwebdir.cgi">/home/cartel/pbi/secdev.org/hg/cgi/hgwebdir.cgi</a> </td></tr>
<tr><td><tt>   43  
</tt></td></tr>
<tr><td><tt>   44 def make_web_app(): 
</tt></td></tr>
<tr><td><tt>   45     return hgwebdir("/home/cartel/pbi/secdev.org/hg/hgweb.conf") 
</tt></td></tr>
<tr><td><tt>   46  
</tt></td></tr>
<tr><td bgcolor="#ffccee"><tt>   47 wsgicgi.launch(wsgiapplication(make_web_app)) 
</tt></td></tr>
<tr><td>wsgicgi = <module 'mercurial.hgweb.wsgicgi' from '/usr/loc...hon2.4/site-packages/mercurial/hgweb/wsgicgi.py'>, wsgicgi.launch = <function launch>, wsgiapplication = <class 'mercurial.hgweb.request.wsgiapplication'>, make_web_app = <function make_web_app></td></tr></table>
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///usr/local/lib/python2.4/site-packages/mercurial/hgweb/wsgicgi.py">/usr/local/lib/python2.4/site-packages/mercurial/hgweb/wsgicgi.py</a> in launch(application=<mercurial.hgweb.request.wsgiapplicat ion object>)</td></tr>
<tr><td><tt>   59         return write 
</tt></td></tr>
<tr><td><tt>   60  
</tt></td></tr>
<tr><td bgcolor="#ffccee"><tt>   61     result = application(environ, start_respo nse) 
</tt></td></tr>
<tr><td><tt>   62     try: 
</tt></td></tr>
<tr><td><tt>   63         for data in result: 
</tt></td></tr>
<tr><td>result undefined, application = <mercurial.hgweb.request.wsgiapplication object>, environ = {'DOCUMENT_ROOT': '/home/cartel/pbi/secdev.org/hg/htdocs/', 'GATEWAY_INTERFACE': 'CGI/1.1', 'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'HTTP_ACCEPT_CHARSET': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'HTTP_ACCEPT_ENCODING': 'gzip,deflate', 'HTTP_ACCEPT_LANGUAGE': 'en-us,en;q=0.5', 'HTTP_CACHE_CONTROL': 'no-cache', 'HTTP_CONNECTION': 'keep-alive', 'HTTP_HOST': 'hg.secdev.org', 'HTTP_KEEP_ALIVE': '300', ...}, start_response = <function start_response></td></tr></table>
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///usr/local/lib/python2.4/site-packages/mercurial/hgweb/request.py">/usr/local/lib/python2.4/site-packages/mercurial/hgweb/request.py</a> in __call__(self=<mercurial.hgweb.request.wsgiapplication object>, wsgienv={'DOCUMENT_ROOT': '/home/cartel/pbi/secdev.org/hg/htdocs/', 'GATEWAY_INTERFACE': 'CGI/1.1', 'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'HTTP_ACCEPT_CHARSET': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'HTTP_ACCEPT_ENCODING': 'gzip,deflate', 'HTTP_ACCEPT_LANGUAGE': 'en-us,en;q=0.5', 'HTTP_CACHE_CONTROL': 'no-cache', 'HTTP_CONNECTION': 'keep-alive', 'HTTP_HOST': 'hg.secdev.org', 'HTTP_KEEP_ALIVE': '300', ...}, start_response=<function start_response>)</td></tr>
<tr><td><tt>   16  
</tt></td></tr>
<tr><td><tt>   17     def __call__(self, wsgienv, start_respons e): 
</tt></td></tr>
<tr><td bgcolor="#ffccee"><tt>   18         return _wsgirequest(self.destmaker(), wsg ienv, start_response) 
</tt></td></tr>
<tr><td><tt>   19  
</tt></td></tr>
<tr><td><tt>   20 class _wsgioutputfile(object): 
</tt></td></tr>
<tr><td>global _wsgirequest = <class 'mercurial.hgweb.request._wsgirequest'>, self = <mercurial.hgweb.request.wsgiapplication object>, self.destmaker = <function make_web_app>, wsgienv = {'DOCUMENT_ROOT': '/home/cartel/pbi/secdev.org/hg/htdocs/', 'GATEWAY_INTERFACE': 'CGI/1.1', 'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'HTTP_ACCEPT_CHARSET': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'HTTP_ACCEPT_ENCODING': 'gzip,deflate', 'HTTP_ACCEPT_LANGUAGE': 'en-us,en;q=0.5', 'HTTP_CACHE_CONTROL': 'no-cache', 'HTTP_CONNECTION': 'keep-alive', 'HTTP_HOST': 'hg.secdev.org', 'HTTP_KEEP_ALIVE': '300', ...}, start_response = <function start_response></td></tr></table>
<table width="100%" cellspacing=0 cellpadding=0 border=0>
<tr><td bgcolor="#d8bbff"><big> </big><a href="file:///usr/local

I tried it from multiple computers/connections...

I'm pretty sure that's not working correctly.. (had to cut some of the code out, as there is a 10000 character limit)

Agreed. I was pointed to that same file. It doesn't seem to compile correctly.

wick86

09-25-2008, 02:27 PM

also
the link to graphviiz is just not working,"address not found" I also tried that from multiple connections, is this really just a freak internet phenomenom in my area?

here is a working link for graphviiz
http://darkstar.ist.utl.pt/slackware/addon/slacky/slackware-12.1/graphic/graphviz/2.18/graphviz-2.18-i486-1sl.tgz

lumberg

09-30-2008, 08:36 AM

[QUOTE=wick86;100752]here is a working link for graphviiz

These Links Are Not Work Graphiz And Scapy are Not Working

SWFu64

09-30-2008, 12:35 PM

graphviz

http://repository.slacky.eu/slackware-12.0/graphic/graphviz/2.18/graphviz-2.18-i486-1sl.tgz

scapy

http://www.secdev.org/projects/scapy/files/scapy.py

Fishy80

10-14-2008, 05:42 AM

just fyi thats about the oldest scapy there is... uploaded back in december of 2006

but, it IS a working link =)