/// <summary> /// Grab all the Access Points with the same name in the hope these are all extenders /// </summary> /// <param name="CapFiles"></param> /// <returns></returns> public static SortedList <string, List <AccessPoint> > GetPossibleExtenders(CapFile[] CapFiles) { SortedList <string, List <AccessPoint> > AccessPoints = new SortedList <string, List <AccessPoint> >(); foreach (CapFile capFile in CapFiles) { SortedList <string, AccessPoint[]> PossibleExtenders = capFile.PossibleExtenders; for (int i = 0; i < PossibleExtenders.Count; i++) { if (AccessPoints.ContainsKey(PossibleExtenders.Keys[i])) { for (int j = 0; j < PossibleExtenders.Values[i].Length; j++) { AccessPoint extender = PossibleExtenders.Values[i][j]; if (AccessPoints[PossibleExtenders.Keys[i]].FirstOrDefault(o => o.MacAddress == extender.MacAddress) == null) { AccessPoints[PossibleExtenders.Keys[i]].Add(extender); } } } else { AccessPoints.Add(PossibleExtenders.Keys[i], new List <AccessPoint>(PossibleExtenders.Values[i])); } } } return(AccessPoints); }
public static Station[] GetStationsFromAP(AccessPoint TargetAP, CapFile[] CapFiles) { Station[] Stations = GetStations(CapFiles); List <Station> TargetStations = new List <Station>(); foreach (Station station in Stations) { foreach (DataFrame frame in station.DataFrames) { if (frame.TargetMacAddressStr == TargetAP.MacAddress) { TargetStations.Add(station); break; } } } return(TargetStations.ToArray()); }
/// <summary> /// De-Cloak an hidden Access Point /// </summary> /// <param name="AP">The AP to De-Cloak</param> /// <returns>De-Cloak successful ?</returns> public bool DeCloakAP(AccessPoint AP, ref string SSID) { if (!AP.BeaconFrame.IsHidden) { return(false); } foreach (AuthRequestFrame frame in _authRequestFrames.Where(o => o.SourceMacAddressLong == AP.MacAddressLong || o.TargetMacAddressLong == AP.MacAddressLong)) { if (String.IsNullOrWhiteSpace(frame.SSID)) { continue; } SSID = frame.SSID; return(true); } return(false); }
/// <summary> /// Is the Access Point dangerous ? Running Karma/Mana modules ? /// </summary> /// <param name="AP"></param> /// <returns></returns> public bool IsAccessPointDanger(AccessPoint AP) { List <string> names = new List <string>(); foreach (AuthRequestFrame frame in _authRequestFrames.Where(o => (o.SourceMacAddressLong == AP.MacAddressLong || o.TargetMacAddressLong == AP.MacAddressLong) && !String.IsNullOrWhiteSpace(o.SSID))) { if (!names.Contains(frame.SSID)) { names.Add(frame.SSID); } if (names.Count > 5) { return(true); } } return(false); }
public void ProcessPacket(Packet packet, DateTime ArrivalDate, int Channel) { PacketDotNet.Ieee80211.BeaconFrame beacon = packet as PacketDotNet.Ieee80211.BeaconFrame; PacketDotNet.Ieee80211.ProbeRequestFrame probeRequest = packet as PacketDotNet.Ieee80211.ProbeRequestFrame; PacketDotNet.Ieee80211.QosDataFrame DataFrame = packet as PacketDotNet.Ieee80211.QosDataFrame; PacketDotNet.Ieee80211.DeauthenticationFrame DeAuthFrame = packet as PacketDotNet.Ieee80211.DeauthenticationFrame; PacketDotNet.Ieee80211.AssociationRequestFrame AuthRequestFrame = packet as PacketDotNet.Ieee80211.AssociationRequestFrame; PacketDotNet.Ieee80211.DataDataFrame DataDataFrame = packet as PacketDotNet.Ieee80211.DataDataFrame; PacketDotNet.Ieee80211.RadioPacket radioFrame = packet as PacketDotNet.Ieee80211.RadioPacket; if (packet != null && false)//LiveCaptureMode) { _allFrames.Add(new AnyPacketFrame(ArrivalDate, packet, Channel)); } if (radioFrame != null) { PacketDotNet.Ieee80211.FrameControlField.FrameSubTypes type = ((PacketDotNet.Ieee80211.MacFrame)radioFrame.PayloadPacket).FrameControl.SubType; if (type == PacketDotNet.Ieee80211.FrameControlField.FrameSubTypes.ManagementBeacon) { beacon = new PacketDotNet.Ieee80211.BeaconFrame(new PacketDotNet.Utils.ByteArraySegment(packet.Bytes)); } else if (type == PacketDotNet.Ieee80211.FrameControlField.FrameSubTypes.Data) { DataFrame = new PacketDotNet.Ieee80211.QosDataFrame(new PacketDotNet.Utils.ByteArraySegment(packet.Bytes)); } } if (beacon != null) { BeaconFrame beaconFrame = new BeaconFrame(beacon, ArrivalDate, Channel); _beacons.Add(beaconFrame); long MacAddrNumber = Utils.MacToLong(beaconFrame.MacAddress); //check for APs with this Mac Address AccessPoint AP = null; if (!_accessPoints.TryGetValue(MacAddrNumber, out AP)) { AP = new AccessPoint(beaconFrame); _accessPoints.Add(MacAddrNumber, AP); } AP.AddBeaconFrame(beaconFrame); if (onReadAccessPoint != null) { onReadAccessPoint(AP); } } else if (probeRequest != null) { ProbePacket probe = new ProbePacket(probeRequest, ArrivalDate); Station station = null; long MacAddrNumber = Utils.MacToLong(probe.SourceMacAddress); if (!_stations.TryGetValue(MacAddrNumber, out station)) { station = new Station(probe); _stations.Add(MacAddrNumber, station); } station.AddProbe(probe); if (onReadStation != null) { onReadStation(station); } } /**/ else if (DataFrame != null) { DataFrame _dataFrame = new Packets.DataFrame(DataFrame, ArrivalDate, Channel); _dataFrames.Add(_dataFrame); if (onReadDataFrame != null) { onReadDataFrame(_dataFrame); } } else if (DataDataFrame != null) { DataFrame _dataFrame = new Packets.DataFrame(DataDataFrame, ArrivalDate, Channel); _dataFrames.Add(_dataFrame); if (onReadDataFrame != null) { onReadDataFrame(_dataFrame); } } else if (AuthRequestFrame != null) { _authRequestFrames.Add(new AuthRequestFrame(AuthRequestFrame, ArrivalDate)); } else if (radioFrame != null) { } }
public Station[] GetStationsFromAP(AccessPoint AP) { return(Stations.Where(o => o.DataFrames.FirstOrDefault(frame => frame.TargetMacAddressLong == AP.MacAddressLong) != null).ToArray()); }
private void device_OnPacketArrival(object sender, CaptureEventArgs e) { packetsProcessed++; if (packetsProcessed == 38) { } if (e.Packet.LinkLayerType == PacketDotNet.LinkLayers.Ieee80211) { Packet packet = PacketDotNet.Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data); PacketDotNet.Ieee80211.BeaconFrame beacon = packet as PacketDotNet.Ieee80211.BeaconFrame; PacketDotNet.Ieee80211.ProbeRequestFrame probeRequest = packet as PacketDotNet.Ieee80211.ProbeRequestFrame; PacketDotNet.Ieee80211.QosDataFrame DataFrame = packet as PacketDotNet.Ieee80211.QosDataFrame; PacketDotNet.Ieee80211.DeauthenticationFrame DeAuthFrame = packet as PacketDotNet.Ieee80211.DeauthenticationFrame; PacketDotNet.Ieee80211.AssociationRequestFrame AuthFrame2 = packet as PacketDotNet.Ieee80211.AssociationRequestFrame; PacketDotNet.Ieee80211.DataDataFrame DataDataFrame = packet as PacketDotNet.Ieee80211.DataDataFrame; if (beacon != null) { BeaconFrame beaconFrame = new BeaconFrame(beacon, e.Packet.Timeval.Date); _beacons.Add(beaconFrame); long MacAddrNumber = MacToLong(beaconFrame.MacAddress); //check for APs with this Mac Address AccessPoint AP = null; if (!_accessPoints.TryGetValue(MacAddrNumber, out AP)) { AP = new AccessPoint(beaconFrame); _accessPoints.Add(MacAddrNumber, AP); } AP.AddBeaconFrame(beaconFrame); } else if (probeRequest != null) { ProbePacket probe = new ProbePacket(probeRequest, e.Packet.Timeval.Date); Station station = null; long MacAddrNumber = MacToLong(probe.SourceMacAddress); if (!_stations.TryGetValue(MacAddrNumber, out station)) { station = new Station(probe); _stations.Add(MacAddrNumber, station); } station.AddProbe(probe); } else if (DataFrame != null) { DataFrame _dataFrame = new Packets.DataFrame(DataFrame, e.Packet.Timeval.Date); //invalid packets are useless, probably encrypted if (_dataFrame.IsValidPacket) { _dataFrames.Add(_dataFrame); } } else if (DataDataFrame != null) { } } }
public void ProcessPacket(Packet packet, DateTime ArrivalDate) { PacketDotNet.Ieee80211.BeaconFrame beacon = packet as PacketDotNet.Ieee80211.BeaconFrame; PacketDotNet.Ieee80211.ProbeRequestFrame probeRequest = packet as PacketDotNet.Ieee80211.ProbeRequestFrame; PacketDotNet.Ieee80211.QosDataFrame DataFrame = packet as PacketDotNet.Ieee80211.QosDataFrame; PacketDotNet.Ieee80211.DeauthenticationFrame DeAuthFrame = packet as PacketDotNet.Ieee80211.DeauthenticationFrame; PacketDotNet.Ieee80211.AssociationRequestFrame AuthRequestFrame = packet as PacketDotNet.Ieee80211.AssociationRequestFrame; PacketDotNet.Ieee80211.DataDataFrame DataDataFrame = packet as PacketDotNet.Ieee80211.DataDataFrame; if (beacon != null) { BeaconFrame beaconFrame = new BeaconFrame(beacon, ArrivalDate); _beacons.Add(beaconFrame); long MacAddrNumber = Utils.MacToLong(beaconFrame.MacAddress); //check for APs with this Mac Address AccessPoint AP = null; if (!_accessPoints.TryGetValue(MacAddrNumber, out AP)) { AP = new AccessPoint(beaconFrame); _accessPoints.Add(MacAddrNumber, AP); } AP.AddBeaconFrame(beaconFrame); if (onReadAccessPoint != null) { onReadAccessPoint(AP); } } else if (probeRequest != null) { ProbePacket probe = new ProbePacket(probeRequest, ArrivalDate); Station station = null; long MacAddrNumber = Utils.MacToLong(probe.SourceMacAddress); if (!_stations.TryGetValue(MacAddrNumber, out station)) { station = new Station(probe); _stations.Add(MacAddrNumber, station); } station.AddProbe(probe); if (onReadStation != null) { onReadStation(station); } } else if (DataFrame != null) { DataFrame _dataFrame = new Packets.DataFrame(DataFrame, ArrivalDate); _dataFrames.Add(_dataFrame); if (onReadDataFrame != null) { onReadDataFrame(_dataFrame); } } else if (DataDataFrame != null) { DataFrame _dataFrame = new Packets.DataFrame(DataDataFrame, ArrivalDate); _dataFrames.Add(_dataFrame); if (onReadDataFrame != null) { onReadDataFrame(_dataFrame); } } else if (AuthRequestFrame != null) { _authRequestFrames.Add(new AuthRequestFrame(AuthRequestFrame, ArrivalDate)); } }