Apple WPS Query

README.MD

pip install protobuf
python wloc.py <some_bssid>

Credits: https://github.com/hubert3/iSniff-GPS/tree/master/iSniff_GPS

BSSIDApple_pb2.py

# -*- coding: utf-8 -*-
# Generated by the protocol buffer compiler.  DO NOT EDIT!
# NO CHECKED-IN PROTOBUF GENCODE
# source: BSSIDApple.proto
# Protobuf Python Version: 5.27.0
"""Generated protocol buffer code."""
from google.protobuf import descriptor as _descriptor
from google.protobuf import descriptor_pool as _descriptor_pool
from google.protobuf import runtime_version as _runtime_version
from google.protobuf import symbol_database as _symbol_database
from google.protobuf.internal import builder as _builder
_runtime_version.ValidateProtobufRuntimeVersion(
    _runtime_version.Domain.PUBLIC,
    5,
    27,
    0,
    '',
    'BSSIDApple.proto'
)
# @@protoc_insertion_point(imports)

_sym_db = _symbol_database.Default()




DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x10\x42SSIDApple.proto\"\x9b\x03\n\x0cWifiDetected\x12\r\n\x05\x62ssid\x18\x01 \x02(\t\x12(\n\x08location\x18\x02 \x01(\x0b\x32\x16.WifiDetected.Location\x1a\xd1\x02\n\x08Location\x12\x10\n\x08latitude\x18\x01 \x01(\x03\x12\x11\n\tlongitude\x18\x02 \x01(\x03\x12\x18\n\x10valeur_inconnue3\x18\x03 \x01(\x03\x12\x18\n\x10valeur_inconnue4\x18\x04 \x01(\x03\x12\x18\n\x10valeur_inconnue5\x18\x05 \x01(\x03\x12\x18\n\x10valeur_inconnue6\x18\x06 \x01(\x03\x12\x18\n\x10valeur_inconnue7\x18\x07 \x01(\x03\x12\x18\n\x10valeur_inconnue8\x18\x08 \x01(\x03\x12\x18\n\x10valeur_inconnue9\x18\t \x01(\x03\x12\x19\n\x11valeur_inconnue10\x18\n \x01(\x03\x12\x19\n\x11valeur_inconnue11\x18\x0b \x01(\x03\x12\x19\n\x11valeur_inconnue12\x18\x0c \x01(\x03\x12\x19\n\x11valeur_inconnue21\x18\x15 \x01(\x03\"\x8d\x01\n\x0f\x42lockBSSIDApple\x12\x18\n\x10valeur_inconnue0\x18\x01 \x01(\x03\x12\x1b\n\x04wifi\x18\x02 \x03(\x0b\x32\r.WifiDetected\x12\x18\n\x10valeur_inconnue1\x18\x03 \x01(\x05\x12\x18\n\x10valeur_inconnue2\x18\x04 \x01(\x05\x12\x0f\n\x07\x41PIName\x18\x05 \x01(\t')

_globals = globals()
_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'BSSIDApple_pb2', _globals)
if not _descriptor._USE_C_DESCRIPTORS:
  DESCRIPTOR._loaded_options = None
  _globals['_WIFIDETECTED']._serialized_start=21
  _globals['_WIFIDETECTED']._serialized_end=432
  _globals['_WIFIDETECTED_LOCATION']._serialized_start=95
  _globals['_WIFIDETECTED_LOCATION']._serialized_end=432
  _globals['_BLOCKBSSIDAPPLE']._serialized_start=435
  _globals['_BLOCKBSSIDAPPLE']._serialized_end=576
# @@protoc_insertion_point(module_scope)

wloc.py

#!/usr/bin/python

# Mostly taken from paper by François-Xavier Aguessy and Côme Demoustier
# http://fxaguessy.fr/rapport-pfe-interception-ssl-analyse-donnees-localisation-smartphones/

import sys
import requests
import BSSIDApple_pb2

def QueryBSSID(query, more_results=True):
    liste_wifi = BSSIDApple_pb2.BlockBSSIDApple()
    bssid_list = query

    for bssid in bssid_list:
        wifi = liste_wifi.wifi.add()
        wifi.bssid = bssid
    liste_wifi.valeur_inconnue1 = 0
    if more_results:
        liste_wifi.valeur_inconnue2 = 0 # last byte in request == 0 means return ~400 results, 1 means only return results for BSSIDs queried
    else:
        liste_wifi.valeur_inconnue2 = 1
    chaine_liste_wifi = liste_wifi.SerializeToString()
    longueur_chaine_liste_wifi = len(chaine_liste_wifi)
    headers = {'Content-Type':'application/x-www-form-urlencoded', 'Accept':'*/*', "Accept-Charset": "utf-8","Accept-Encoding": "gzip, deflate",\
            "Accept-Language":"en-us", 'User-Agent':'locationd/1753.17 CFNetwork/711.1.12 Darwin/14.0.0'}
    data = b"\x00\x01\x00\x05"+b"en_US"+b"\x00\x13"+b"com.apple.locationd"+b"\x00\x0a"+b"8.1.12B411"+b"\x00\x00\x00\x01\x00\x00\x00" + chr(longueur_chaine_liste_wifi).encode() + chaine_liste_wifi
    r = requests.post('https://gs-loc.apple.com/clls/wloc',headers=headers,data=data)
    liste_wifi = BSSIDApple_pb2.BlockBSSIDApple() 
    liste_wifi.ParseFromString(r.content[10:])
    return liste_wifi


if __name__ == '__main__':
    print(QueryBSSID([sys.argv[1]]))