/// <summary>
/// Grab all the Access Points with the same name in the hope these are all extenders
/// </summary>
/// <param name="CapFiles"></param>
/// <returns></returns>
public static SortedList <string, List <AccessPoint> > GetPossibleExtenders(CapFile[] CapFiles)
{
SortedList <string, List <AccessPoint> > AccessPoints = new SortedList <string, List <AccessPoint> >();
foreach (CapFile capFile in CapFiles)
{
SortedList <string, AccessPoint[]> PossibleExtenders = capFile.PossibleExtenders;
for (int i = 0; i < PossibleExtenders.Count; i++)
{
if (AccessPoints.ContainsKey(PossibleExtenders.Keys[i]))
{
for (int j = 0; j < PossibleExtenders.Values[i].Length; j++)
{
AccessPoint extender = PossibleExtenders.Values[i][j];
if (AccessPoints[PossibleExtenders.Keys[i]].FirstOrDefault(o => o.MacAddress == extender.MacAddress) == null)
{
AccessPoints[PossibleExtenders.Keys[i]].Add(extender);
}
}
}
else
{
AccessPoints.Add(PossibleExtenders.Keys[i], new List <AccessPoint>(PossibleExtenders.Values[i]));
}
}
}
return(AccessPoints);
}
public static Station[] GetStationsFromAP(AccessPoint TargetAP, CapFile[] CapFiles)
{
Station[] Stations = GetStations(CapFiles);
List <Station> TargetStations = new List <Station>();
foreach (Station station in Stations)
{
foreach (DataFrame frame in station.DataFrames)
{
if (frame.TargetMacAddressStr == TargetAP.MacAddress)
{
TargetStations.Add(station);
break;
}
}
}
return(TargetStations.ToArray());
}
/// <summary>
/// De-Cloak an hidden Access Point
/// </summary>
/// <param name="AP">The AP to De-Cloak</param>
/// <returns>De-Cloak successful ?</returns>
public bool DeCloakAP(AccessPoint AP, ref string SSID)
{
if (!AP.BeaconFrame.IsHidden)
{
return(false);
}
foreach (AuthRequestFrame frame in _authRequestFrames.Where(o => o.SourceMacAddressLong == AP.MacAddressLong ||
o.TargetMacAddressLong == AP.MacAddressLong))
{
if (String.IsNullOrWhiteSpace(frame.SSID))
{
continue;
}
SSID = frame.SSID;
return(true);
}
return(false);
}
/// <summary>
/// Is the Access Point dangerous ? Running Karma/Mana modules ?
/// </summary>
/// <param name="AP"></param>
/// <returns></returns>
public bool IsAccessPointDanger(AccessPoint AP)
{
List <string> names = new List <string>();
foreach (AuthRequestFrame frame in _authRequestFrames.Where(o => (o.SourceMacAddressLong == AP.MacAddressLong ||
o.TargetMacAddressLong == AP.MacAddressLong) &&
!String.IsNullOrWhiteSpace(o.SSID)))
{
if (!names.Contains(frame.SSID))
{
names.Add(frame.SSID);
}
if (names.Count > 5)
{
return(true);
}
}
return(false);
}
public void ProcessPacket(Packet packet, DateTime ArrivalDate, int Channel)
{
PacketDotNet.Ieee80211.BeaconFrame beacon = packet as PacketDotNet.Ieee80211.BeaconFrame;
PacketDotNet.Ieee80211.ProbeRequestFrame probeRequest = packet as PacketDotNet.Ieee80211.ProbeRequestFrame;
PacketDotNet.Ieee80211.QosDataFrame DataFrame = packet as PacketDotNet.Ieee80211.QosDataFrame;
PacketDotNet.Ieee80211.DeauthenticationFrame DeAuthFrame = packet as PacketDotNet.Ieee80211.DeauthenticationFrame;
PacketDotNet.Ieee80211.AssociationRequestFrame AuthRequestFrame = packet as PacketDotNet.Ieee80211.AssociationRequestFrame;
PacketDotNet.Ieee80211.DataDataFrame DataDataFrame = packet as PacketDotNet.Ieee80211.DataDataFrame;
PacketDotNet.Ieee80211.RadioPacket radioFrame = packet as PacketDotNet.Ieee80211.RadioPacket;
if (packet != null && false)//LiveCaptureMode)
{
_allFrames.Add(new AnyPacketFrame(ArrivalDate, packet, Channel));
}
if (radioFrame != null)
{
PacketDotNet.Ieee80211.FrameControlField.FrameSubTypes type = ((PacketDotNet.Ieee80211.MacFrame)radioFrame.PayloadPacket).FrameControl.SubType;
if (type == PacketDotNet.Ieee80211.FrameControlField.FrameSubTypes.ManagementBeacon)
{
beacon = new PacketDotNet.Ieee80211.BeaconFrame(new PacketDotNet.Utils.ByteArraySegment(packet.Bytes));
}
else if (type == PacketDotNet.Ieee80211.FrameControlField.FrameSubTypes.Data)
{
DataFrame = new PacketDotNet.Ieee80211.QosDataFrame(new PacketDotNet.Utils.ByteArraySegment(packet.Bytes));
}
}
if (beacon != null)
{
BeaconFrame beaconFrame = new BeaconFrame(beacon, ArrivalDate, Channel);
_beacons.Add(beaconFrame);
long MacAddrNumber = Utils.MacToLong(beaconFrame.MacAddress);
//check for APs with this Mac Address
AccessPoint AP = null;
if (!_accessPoints.TryGetValue(MacAddrNumber, out AP))
{
AP = new AccessPoint(beaconFrame);
_accessPoints.Add(MacAddrNumber, AP);
}
AP.AddBeaconFrame(beaconFrame);
if (onReadAccessPoint != null)
{
onReadAccessPoint(AP);
}
}
else if (probeRequest != null)
{
ProbePacket probe = new ProbePacket(probeRequest, ArrivalDate);
Station station = null;
long MacAddrNumber = Utils.MacToLong(probe.SourceMacAddress);
if (!_stations.TryGetValue(MacAddrNumber, out station))
{
station = new Station(probe);
_stations.Add(MacAddrNumber, station);
}
station.AddProbe(probe);
if (onReadStation != null)
{
onReadStation(station);
}
}
/**/ else if (DataFrame != null)
{
DataFrame _dataFrame = new Packets.DataFrame(DataFrame, ArrivalDate, Channel);
_dataFrames.Add(_dataFrame);
if (onReadDataFrame != null)
{
onReadDataFrame(_dataFrame);
}
}
else if (DataDataFrame != null)
{
DataFrame _dataFrame = new Packets.DataFrame(DataDataFrame, ArrivalDate, Channel);
_dataFrames.Add(_dataFrame);
if (onReadDataFrame != null)
{
onReadDataFrame(_dataFrame);
}
}
else if (AuthRequestFrame != null)
{
_authRequestFrames.Add(new AuthRequestFrame(AuthRequestFrame, ArrivalDate));
}
else if (radioFrame != null)
{
}
}
public Station[] GetStationsFromAP(AccessPoint AP)
{
return(Stations.Where(o => o.DataFrames.FirstOrDefault(frame => frame.TargetMacAddressLong == AP.MacAddressLong) != null).ToArray());
}
private void device_OnPacketArrival(object sender, CaptureEventArgs e)
{
packetsProcessed++;
if (packetsProcessed == 38)
{
}
if (e.Packet.LinkLayerType == PacketDotNet.LinkLayers.Ieee80211)
{
Packet packet = PacketDotNet.Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
PacketDotNet.Ieee80211.BeaconFrame beacon = packet as PacketDotNet.Ieee80211.BeaconFrame;
PacketDotNet.Ieee80211.ProbeRequestFrame probeRequest = packet as PacketDotNet.Ieee80211.ProbeRequestFrame;
PacketDotNet.Ieee80211.QosDataFrame DataFrame = packet as PacketDotNet.Ieee80211.QosDataFrame;
PacketDotNet.Ieee80211.DeauthenticationFrame DeAuthFrame = packet as PacketDotNet.Ieee80211.DeauthenticationFrame;
PacketDotNet.Ieee80211.AssociationRequestFrame AuthFrame2 = packet as PacketDotNet.Ieee80211.AssociationRequestFrame;
PacketDotNet.Ieee80211.DataDataFrame DataDataFrame = packet as PacketDotNet.Ieee80211.DataDataFrame;
if (beacon != null)
{
BeaconFrame beaconFrame = new BeaconFrame(beacon, e.Packet.Timeval.Date);
_beacons.Add(beaconFrame);
long MacAddrNumber = MacToLong(beaconFrame.MacAddress);
//check for APs with this Mac Address
AccessPoint AP = null;
if (!_accessPoints.TryGetValue(MacAddrNumber, out AP))
{
AP = new AccessPoint(beaconFrame);
_accessPoints.Add(MacAddrNumber, AP);
}
AP.AddBeaconFrame(beaconFrame);
}
else if (probeRequest != null)
{
ProbePacket probe = new ProbePacket(probeRequest, e.Packet.Timeval.Date);
Station station = null;
long MacAddrNumber = MacToLong(probe.SourceMacAddress);
if (!_stations.TryGetValue(MacAddrNumber, out station))
{
station = new Station(probe);
_stations.Add(MacAddrNumber, station);
}
station.AddProbe(probe);
}
else if (DataFrame != null)
{
DataFrame _dataFrame = new Packets.DataFrame(DataFrame, e.Packet.Timeval.Date);
//invalid packets are useless, probably encrypted
if (_dataFrame.IsValidPacket)
{
_dataFrames.Add(_dataFrame);
}
}
else if (DataDataFrame != null)
{
}
}
}
public void ProcessPacket(Packet packet, DateTime ArrivalDate)
{
PacketDotNet.Ieee80211.BeaconFrame beacon = packet as PacketDotNet.Ieee80211.BeaconFrame;
PacketDotNet.Ieee80211.ProbeRequestFrame probeRequest = packet as PacketDotNet.Ieee80211.ProbeRequestFrame;
PacketDotNet.Ieee80211.QosDataFrame DataFrame = packet as PacketDotNet.Ieee80211.QosDataFrame;
PacketDotNet.Ieee80211.DeauthenticationFrame DeAuthFrame = packet as PacketDotNet.Ieee80211.DeauthenticationFrame;
PacketDotNet.Ieee80211.AssociationRequestFrame AuthRequestFrame = packet as PacketDotNet.Ieee80211.AssociationRequestFrame;
PacketDotNet.Ieee80211.DataDataFrame DataDataFrame = packet as PacketDotNet.Ieee80211.DataDataFrame;
if (beacon != null)
{
BeaconFrame beaconFrame = new BeaconFrame(beacon, ArrivalDate);
_beacons.Add(beaconFrame);
long MacAddrNumber = Utils.MacToLong(beaconFrame.MacAddress);
//check for APs with this Mac Address
AccessPoint AP = null;
if (!_accessPoints.TryGetValue(MacAddrNumber, out AP))
{
AP = new AccessPoint(beaconFrame);
_accessPoints.Add(MacAddrNumber, AP);
}
AP.AddBeaconFrame(beaconFrame);
if (onReadAccessPoint != null)
{
onReadAccessPoint(AP);
}
}
else if (probeRequest != null)
{
ProbePacket probe = new ProbePacket(probeRequest, ArrivalDate);
Station station = null;
long MacAddrNumber = Utils.MacToLong(probe.SourceMacAddress);
if (!_stations.TryGetValue(MacAddrNumber, out station))
{
station = new Station(probe);
_stations.Add(MacAddrNumber, station);
}
station.AddProbe(probe);
if (onReadStation != null)
{
onReadStation(station);
}
}
else if (DataFrame != null)
{
DataFrame _dataFrame = new Packets.DataFrame(DataFrame, ArrivalDate);
_dataFrames.Add(_dataFrame);
if (onReadDataFrame != null)
{
onReadDataFrame(_dataFrame);
}
}
else if (DataDataFrame != null)
{
DataFrame _dataFrame = new Packets.DataFrame(DataDataFrame, ArrivalDate);
_dataFrames.Add(_dataFrame);
if (onReadDataFrame != null)
{
onReadDataFrame(_dataFrame);
}
}
else if (AuthRequestFrame != null)
{
_authRequestFrames.Add(new AuthRequestFrame(AuthRequestFrame, ArrivalDate));
}
}
