Turning raspberry pi into badass sniffer

rogueberry.md

Build a Raspberry Pi WiFi AP

TUTES

• http://www.pi-point.co.uk/documentation/
• http://www.daveconroy.com/using-your-raspberry-pi-as-a-wireless-router-and-web-server/
• https://learn.adafruit.com/setting-up-a-raspberry-pi-as-a-wifi-access-point/connect
• (good) https://github.com/bendemott/raspberrypi-wifi

Find chipset

# lsusb
# sudo dmesg

see if AP mode is supported: iw list (Supported interface modes)

install aptitude install rfkill zd1211-firmware hostapd hostap-utils iw dnsmasq

Your wireless interface must be set statically for hostap, edit your /etc/network/interfaces file to look like this (or copy and paste!):

auto lo
iface lo inet loopback
iface eth0 inet dhcp
iface wlan0 inet static
  address 192.168.1.1
  netmask 255.255.255.0

restart: ifdown wlan0; ifup wlan0

Hostapd /etc/hostapd/hostapd.conf (it may not already exist but this will create it, anyway) to look like this:

interface=wlan0
driver=nl80211
ssid=test
channel=1

dnsmasq

The final step is to configure dnsmasq so you can obtain an IP address from your new Pi-Point. Edit your /etc/dnsmasq.conf file to look like this:

# Never forward plain names (without a dot or domain part)

domain-needed
 


# Only listen for DHCP on wlan0

interface=wlan0



# create a domain if you want, comment it out otherwise

#domain=Pi-Point.co.uk



# Create a dhcp range on your /24 wlan0 network with 12 hour lease time
dhcp-range=192.168.1.5,192.168.1.254,255.255.255.0,12h



# Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.

#dhcp-option=252,"\n"

IP forward

$ sudo su
# echo 1 > /proc/sys/net/ipv4/ip_forward

Then, update /etc/sysctl.conf and uncomment this line net.ipv4.ip_forward=1

IP tables

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables-save > /etc/iptables.up.rules

To load them at boot, we need to create a script in /etc/network/if-pre-up.d/iptables with the following contents:

#!/bin/sh
# Configure Wifi Access Point.
#
### BEGIN INIT INFO
# Provides: WifiAP
# Required-Start: $remote_fs $syslog $time
# Required-Stop: $remote_fs $syslog $time
# Should-Start: $network $named slapd autofs ypbind nscd nslcd
# Should-Stop: $network $named slapd autofs ypbind nscd nslcd
# Default-Start: 2
# Default-Stop:
# Short-Description: Wifi Access Point configuration
# Description: Sets forwarding, starts hostap, enables NAT in iptables
### END INIT INFO 

# turn on forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# enable NAT
iptables -t nat -A POSTROUTING -j MASQUERADE

# start the access point
hostapd -B /etc/hostapd/hostapd.conf

WiFi Chipsets

Ralink RT5370

Cards

(Atheros) https://www.centralpoint.nl/netwerkkaarten-adapters/tp-link/150mbps-high-gain-wireless-usb-art-tl-wn722n-num-426471/

(RTL8811AU) (Realtek) https://www.centralpoint.nl/netwerkkaarten-adapters/startech~com/usb-20-ac600-mini-dubbelband-draadloze-ac-netwerkadapter-1t1r-80211ac-wifi-adapter-art-usb433wacdb-num-3587860/

(RT3072L) https://www.centralpoint.nl/netwerkkaarten-adapters/gembird/wifi-usb-20-ieee-80211b-g-n-300-mbps-wps-36-g-art-wnp-ua-002-num-3863193/

(RTL8192EU) (Realtek) https://www.centralpoint.nl/netwerkkaarten-adapters/gembird/mini-usb-wifi-ontvanger-300mbps-art-wnp-ua-005-num-3863195/

Proxy traffic

https://github.com/mitmproxy/mitmproxy/

Transparent Proxy Now that the wireless gateway is set up, we proceed to get set up for transparently proxying HTTP traffic from the connected clients. We first need to use iptables to forward TCP traffic from ports 80 and 443 (or whatever port your application needs) to the local port where the proxy is listening on (e.g. 8080).

iptables -t nat -A PREROUTING -i $inf -p tcp --dport 80 -j REDIRECT --to-ports $toPort
iptables -t nat -A PREROUTING -i $inf -p tcp --dport 443 -j REDIRECT --to-port $toPort