brannondorsey / sniff-probes Goto Github PK

View Code? Open in Web Editor NEW

241.0 16.0 42.0 5 KB

Plug-and-play bash script for sniffing 802.11 probes requests :nose:

License: MIT License

Awk 39.09% Shell 60.91%

probe-requests hacking wifi packet-capture network-monitoring

sniff-probes's Introduction

Sniff Probes

Plug-and-play bash script for sniffing 802.11 probes requests.

What are Probe Requests?

Probe requests are an 802.11 WIFI packet type that function to automatically connect network devices to the wireless access points (APs) that they have previously associated with. Whenever a phone, computer, or other networked device has Wi-Fi enabled, but is not connected to a network, it is constantly "probing"; openly broadcating the network names (SSIDs) of previously connected APs. Because wireless access points have unique and often personal network names, it is easy to identify the device owner by recognizing the names of networks they frequently connect to.

For a creative application of probe request capture, see ProbeKit.

Sniffing Probe Requests

# Type "ifconfig" to list available network devices.
# Wireless devices generally start with a "w"
IFACE=wlan0 ./sniff-probes.sh

00:00:19 -88dBm 00:0a:e2:1f:28:ab "cvteststation01"
00:00:19 -89dBm 00:0a:e2:1f:28:ab "cvteststation01"
00:00:22 -85dBm 5c:aa:fd:20:23:41 "Sonos_pZkIex0zatRvhdJTAifLzmatdh"
00:00:42 -86dBm f4:f5:d8:28:bc:26 "NETGEAR85-5G"
00:00:46 -89dBm f4:f5:d8:28:bc:26 "NETGEAR85-5G"
00:00:48 -84dBm f4:f5:d8:06:19:40 "Pamplona Running Club"
00:01:00 -92dBm 54:60:09:40:56:32 "seawhale"
00:01:13 -87dBm 38:63:bb:d1:6a:b7 "offline"
00:01:25 -83dBm 5c:aa:fd:20:23:41 "Sonos_pZkIex0zatRvhdJTAifLzmatdh"

Requires tcpdump and gawk (GNU awk). Both of these packages are installed on many *nix systems by default, but if they aren't you will have to install them manually. Your wireless device must also support monitor mode. Here is a list of WiFi cards that support monitor mode (2018).

Prints timetamp, signal strength, sender MAC address and SSID to screen. Saves output as a space-delimeted "csv" to probes.txt by default.

Additional options:

IFACE=wlan0 OUTPUT=output.txt CHANNEL_HOP=1 ./sniff-probes.sh

CHANNEL_HOP=1 enables channel hoping on IFACE every two seconds. This is used to increase the number of probes captured. Disabled by default.

sniff-probes's People

Contributors

Stargazers

Watchers

sniff-probes's Issues

request for improvement

hi, thanks for the great script.
I need little help for text processing.
I want to save the output into JSON format.
but I don't have good knowledge of awk.
please save the whole output in JSON.

channel cannot hop beyond 11

I have changed the localization and timezone to Australia where channel 12 and 13 are supported. However, when I tried to hop channel from 1 to channel 13, and ran the script, the result was always monitoring a fixed channel (normally channel 1), but not hopping between channels.

Though hop channels from 1 to 11 works fine for me.

Error Sniff-probes

Hello, im ussing a beaglebone black ,i have put an interface in monitor mode and the program has executed. i get the following error
bash: ./sniff-probes.sh: Permission denied

Im ussing sudo

"Argument list too long"

pi@raspberrypi:~/sniff-probes $ sudo IFACE=wlan1 ./sniff-probes.sh
tcpdump: wlan1: SIOCGIWPRIV: Argument list too long

Update docs for gawk

This sniff-probes.sh relies on gawk, not awk. Update documentation and add a line to check for the presence of gawk in sniff-probes.sh.

Monitor Mode Issue

Hopefully I am not missing something stupid here.

wlan1 IEEE 802.11b ESSID:"" Nickname:"<WIFI@REALTEK>" Mode:Monitor Frequency:2.412 GHz Access Point: Not-Associated Sensitivity:0/0 Retry:off RTS thr:off Fragment thr:off Power Management:off Link Quality:0 Signal level:0 Noise level:0 Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0 Tx excessive retries:0 Invalid misc:0 Missed beacon:0

Device is in Monitor mode.

pi@raspberrypi:~/sniff-probes $ sudo IFACE=wlan1 ./sniff-probes.sh tcpdump: wlan1: That device doesn't support monitor mode
Is my result. And I know the device support monitor mode, as I can run

sudo airodump-ng wlan1

and it is monitoring

` BSSID STATION PWR Rate Lost Frames Notes Probes

(not associated) 5C:AA:FD:E8:B7:51 -46 0 - 1 101 3 Sonos_nshh42
(not associated) 84:3A:4B:33:B7:A2 -68 0 - 1 0 3
(not associated) 00:13:25:B0:04:79 -75 0 - 1 172 5
(not associated) F4:30:B9:7A:7D:BE -80 0 - 1 0 2 STEPPING FOR
(not associated) F2:BD:F1:20:07:9C -82 0 - 1 0 1
(not associated) 50:76:AF:57:87:94 -83 0 - 1 0 1

Any thoughts?`

Capture probe requests

Hy...Is there any way to capture probe requests in windows in python without using wireshark or any other software?
Kindly help.

tcpdump: Unable to write output: Broken pipe + syntax errors?

I've run into a slight problem... I get a bunch of errors while running this. Here's the log...

IFACE=wlan1mon ./sniff-probes.sh awk: parse-tcpdump.awk: line 2: syntax error at or near , awk: parse-tcpdump.awk: line 7: syntax error at or near , awk: parse-tcpdump.awk: line 13: syntax error at or near , tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan1mon, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 256 bytes tcpdump: Unable to write output: Broken pipe

I'm using an Edimax EW-7811Un in monitor mode using updated drivers, but it will do the same thing with my Ralink RT5370 card on this Pi Zero W.

Any help?

Delete this please.

Thought I was typing in terminal.... this is embarrassing.