pax_global_header00006660000000000000000000000064142360561730014521gustar00rootroot0000000000000052 comment=e6138076760a81b91fbc728d24ece10e560e637b wig-ng-0.1/000077500000000000000000000000001423605617300125515ustar00rootroot00000000000000wig-ng-0.1/.gitignore000066400000000000000000000032401423605617300145400ustar00rootroot00000000000000# Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] *$py.class # C extensions *.so # Distribution / packaging .Python build/ develop-eggs/ dist/ downloads/ eggs/ .eggs/ lib/ lib64/ parts/ sdist/ var/ wheels/ pip-wheel-metadata/ share/python-wheels/ *.egg-info/ .installed.cfg *.egg MANIFEST # PyInstaller # Usually these files are written by a python script from a template # before PyInstaller builds the exe, so as to inject date/other infos into it. *.manifest *.spec # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .nox/ .coverage .coverage.* .cache nosetests.xml coverage.xml *.cover .hypothesis/ .pytest_cache/ # Translations *.mo *.pot # Django stuff: *.log local_settings.py db.sqlite3 # Flask stuff: instance/ .webassets-cache # Scrapy stuff: .scrapy # Sphinx documentation docs/_build/ # PyBuilder target/ # Jupyter Notebook .ipynb_checkpoints # IPython profile_default/ ipython_config.py # pyenv .python-version # pipenv # According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control. # However, in case of collaboration, if having platform-specific dependencies or dependencies # having no cross-platform support, pipenv may install dependencies that don’t work, or not # install all needed dependencies. #Pipfile.lock # celery beat schedule file celerybeat-schedule # SageMath parsed files *.sage.py # Environments .env .venv env/ venv/ ENV/ env.bak/ venv.bak/ # Spyder project settings .spyderproject .spyproject # Rope project settings .ropeproject # mkdocs documentation /site # mypy .mypy_cache/ .dmypy.json dmypy.json # Pyre type checker .pyre/ wig-ng-0.1/LICENSE000066400000000000000000000432541423605617300135660ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. wig-ng-0.1/README.md000066400000000000000000000027601423605617300140350ustar00rootroot00000000000000# wig-ng WIG (WiFi Information Gathering) is a free and open source utility for WiFi device fingerprinting. ### Installation ``` pip install wig-ng ``` ## Supported Protocols & Standards - WiFi Protected Setup (WPS) - WiFi-Direct (P2P) - Cisco Client Extension (CCX) - Apple Wireless Direct Link (AWDL) - HP Printers Proprietary Information Element ## Usage 
usage: wig-ng.py [-h] [-v] [-c count] [-a]  
                 (-i network interface | -r pcap file | -R pcap directory)  
  
optional arguments:  
  -h, --help            show this help message and exit  
  -v, --verbose         Output verbosity (incremental).  
  -c count, --concurrent count  
                        Number of PCAP capture files to process  
                        simultaneously.  
  -a, --active          Some modules can perform frame injection, this is  
                        define by setting the active mode.  
  -i network interface, --interface network interface  
                        IEEE 802.11 network interface on monitor mode.  
  -r pcap file          PCAP capture file with IEEE 802.11 network traffic.  
  -R pcap directory     Directory with PCAP capture files.
## Usage Examples **$** sudo iwconfig \ mode monitor **$** sudo ifconfig \ up **$** cd wig-ng **$** sudo python wig-ng.py -i \ ## Notes - This tool doesn't perform channel hopping, use tools such as [chopping](https://github.com/6e726d/chopping) or [airodump-ng](https://www.aircrack-ng.org/). wig-ng-0.1/setup.cfg000066400000000000000000000000501423605617300143650ustar00rootroot00000000000000[metadata] description-file = README.md wig-ng-0.1/setup.py000066400000000000000000000034611423605617300142670ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import os import glob from distutils.core import setup PACKAGE_NAME = 'wig-ng' VERSION_MAJOR = 0 VERSION_MINOR = 1 setup(name=PACKAGE_NAME, version='{}.{}'.format(VERSION_MAJOR, VERSION_MINOR), description='WIG-ng is a free and open source utility for WiFi device fingerprinting.', url='https://github.com/6e726d/wig-ng', author='Andres Blanco', author_email='6e726d@gmail.com', console = [{'script': PACKAGE_NAME}], license='GPLv2', platforms=['Unix'], packages=['wig', 'wig.consumers', 'wig.producers', 'wig.helpers', 'wig.helpers.network', 'wig.helpers.output'], scripts=glob.glob(os.path.join('wig', 'wig-ng.py')), install_requires=['pcapy', 'impacket', 'setproctitle'], classifiers=[ 'Development Status :: 4 - Beta', 'Programming Language :: Python :: 3', ], download_url="https://github.com/6e726d/wig-ng/archive/refs/tags/0.1.tar.gz" )wig-ng-0.1/wig/000077500000000000000000000000001423605617300133375ustar00rootroot00000000000000wig-ng-0.1/wig/__init__.py000066400000000000000000000014511423605617300154510ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . #wig-ng-0.1/wig/consumers/000077500000000000000000000000001423605617300153555ustar00rootroot00000000000000wig-ng-0.1/wig/consumers/__init__.py000066400000000000000000000014511423605617300174670ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . #wig-ng-0.1/wig/consumers/awdl.py000066400000000000000000000215541423605617300166650ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import struct import traceback from queue import Empty from multiprocessing import Event from wig.helpers import ieee80211 from wig.helpers.output import writer from wig.helpers.Processes import WigProcess from impacket import ImpactDecoder from impacket import dot11 class AppleWirelessDirectLink(WigProcess): """ TODO: Documentation """ __module_name__ = "Apple Wireless Direct Link" VENDOR_SPECIFIC = 0x7f APPLE_OUI = b"\x00\x17\xf2" SUBTYPE_MASTER_INDICATION_FRAME = 0x03 TLV_SERVICE_REQUEST = 0x01 TLV_SERVICE_RESPONSE = 0x02 TLV_DATA_PATH_STATE = 0x0c TLV_ARPA = 0x10 TLV_VERSION = 0x15 TLV_TYPES = { 0x00: "SSTH Request", TLV_SERVICE_REQUEST: "Service Request", TLV_SERVICE_RESPONSE: "Service Response", 0x03: "Unknown", 0x04: "Synchronization Parameters", 0x05: "Election Parameters", 0x06: "Service Parameters", 0x07: "HT Capabilities (IEEE 802.11 subset)", 0x08: "Enhanced Data Rate Operation", 0x09: "Infra", 0x0a: "Invite", 0x0b: "Debug String", TLV_DATA_PATH_STATE: "Data Path State", 0x0d: "Encapsulated IP", 0x0e: "Datapath Debug Packet Live", 0x0f: "Datapath Debug AF Live", TLV_ARPA: "Arpa", 0x11: "IEEE 802.11 Container", 0x12: "Channel Sequence", 0x13: "Unknown", 0x14: "Synchronization Tree", TLV_VERSION: "Version", 0x15: "Bloom Filter", 0x16: "NAN Sync", 0x17: "Election Parameters v2", } DEVICE_CLASS = { 0x01: "macOS", 0x02: "iOS", 0x08: "tvOS", } country_label = 'country' name_label = 'name' class_label = 'class' service_request_label = 'service request' service_response_label = 'service response' def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.decoder = ImpactDecoder.Dot11Decoder() self.decoder.FCS_at_end(False) self.__devices__ = dict() def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ return [ieee80211.TYPE_MGMT] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ return [ieee80211.TYPE_MGMT_SUBTYPE_ACTION] def run(self): """ TODO: Documentation """ self.set_process_title() try: self.malformed = 0 while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) try: self.decoder.decode(frame) except Exception as e: self.__output__.put({'Exception': traceback.format_exc()}) self.malformed +=1 continue frame_control = self.decoder.get_protocol(dot11.Dot11) if frame_control.get_subtype() in self.get_frame_subtype_filter(): mgt_frame = self.decoder.get_protocol(dot11.Dot11ManagementFrame) # Management frames shouldn't be fragmented. # At least the ones we are processing. seq_ctl = mgt_frame.get_sequence_control() fragment_number = seq_ctl & 0x000F if fragment_number == 0: data = mgt_frame.get_body_as_string() self.process_body(mgt_frame, data) except Empty: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def process_body(self, mgt_frame, data): """ TODO: Documentation """ device_mac = ieee80211.get_string_mac_address_from_array(mgt_frame.get_source_address()) __data = self.process_airplay_data(data) if __data: if device_mac not in self.__devices__.keys(): if self.name_label in __data: info_items = dict() info_items['Name'] = __data[self.name_label] if self.class_label in __data: info_items['Class'] = __data[self.class_label] if self.country_label in __data: info_items['Country'] = __data[self.country_label] if self.service_request_label in __data: idx = 0 for item in __data[self.service_request_label]: info_items['Service Request %d' % idx] = repr(item) idx += 1 if self.service_response_label in __data: idx = 0 for item in __data[self.service_response_label]: info_items['Service Response %d' % idx] = repr(item) idx += 1 aux = writer.get_device_information_dict(device_mac.upper(), self.__module_name__, info_items) self.__output__.put(aux) # Apple Devices has MAC randomization, so we should use the device name to identify them. self.__devices__[device_mac] = __data[self.name_label] def process_airplay_data(self, data): """Process AirPlay Data.""" idx = 0 try: # Verify Vendor Specific if data[0] != self.VENDOR_SPECIFIC: return 0 idx += 1 # Verify Apple OUI if data[idx:idx+len(self.APPLE_OUI)] != self.APPLE_OUI: return None idx += len(self.APPLE_OUI) # AWDL Fixed Parameters # awdl_type = struct.unpack("B", data[idx])[0] idx += 1 awdl_version = data[idx] idx += 1 # Verify AWDL Version if awdl_version != 0x10: return awdl_subtype = data[idx] # Verify AWDL Subtype if awdl_subtype != self.SUBTYPE_MASTER_INDICATION_FRAME: return idx += 10 result = {} raw_data = data[idx:] remaining_data = raw_data while len(remaining_data) > 4: tlv_type = remaining_data[0] tlv_length = struct.unpack("H", remaining_data[1:3])[0] tlv_data = remaining_data[3:tlv_length+3] if tlv_type == self.TLV_DATA_PATH_STATE: if tlv_length > 5: country_code = tlv_data[2:4] result[self.country_label] = country_code elif tlv_type == self.TLV_ARPA: str_length = tlv_data[1] result[self.name_label] = tlv_data[2:2+str_length] elif tlv_type == self.TLV_VERSION: device_class = tlv_data[1] if device_class in self.DEVICE_CLASS: result[self.class_label] = self.DEVICE_CLASS[device_class] elif tlv_type == self.TLV_SERVICE_REQUEST: if not self.service_request_label in result: result[self.service_request_label] = [] result[self.service_request_label].append(tlv_data) elif tlv_type == self.TLV_SERVICE_RESPONSE: if not self.service_response_label in result: result[self.service_response_label] = [] result[self.service_response_label].append(tlv_data) remaining_data = remaining_data[tlv_length+3:] return result except Exception as e: self.__output__.put({'Exception': traceback.format_exc()}) def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/consumers/base.py000066400000000000000000000332011423605617300166400ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import time import traceback import pcapy from queue import Empty from collections import OrderedDict from multiprocessing import Event, Queue, TimeoutError from wig.helpers import ieee80211 from wig.helpers.network import interfaces from wig.helpers.output import writer from wig.helpers.Processes import WigProcess from wig.producers.base import FINITE_TYPE, INFINITE_TYPE from wig.consumers.wps import WiFiProtectedSetup from wig.consumers.uncommon import InformationElementsStats from wig.consumers.hp import HewlettPackardVendorSpecificTypeZero from wig.consumers.awdl import AppleWirelessDirectLink from wig.consumers.p2p import WiFiDirect from wig.consumers.ccx import CiscoClientExtensions class Mediator(WigProcess): """ The objective of the intermediary consumer class is to push specific type/subtype IEEE 802.11 frames to different frame processing classes. """ def __init__(self, frames_queue, output_queue, producer_type, injection_queue=None): WigProcess.__init__(self) self.__queue__ = frames_queue self.__output_queue__ = output_queue self.__injection_queue__ = injection_queue self.__stop__ = Event() self.__producer_type__ = producer_type self.__timeout_event__ = Event() self.consumers_list = [FramesStats, InformationElementsStats, CiscoClientExtensions, WiFiProtectedSetup, WiFiDirect, HewlettPackardVendorSpecificTypeZero, AppleWirelessDirectLink] def run(self): """ Process data from the frames queue and write them to specific queues. """ self.set_process_title() if self.__producer_type__ == INFINITE_TYPE: self.run_from_infinite_producers() else: self.run_from_finite_producers() def run_from_finite_producers(self): """ This method handles the state when processing data from finite producers. """ # Consumers initialization consumer_list = list() for consumer in self.consumers_list: consumer_queue = Queue() consumer_instance = consumer(consumer_queue, self.__output_queue__) consumer_instance.start() consumer_list.append((consumer_instance, consumer_queue)) try: while not self.__stop__.is_set(): try: if self.__timeout_event__.is_set(): # We are working with a finite producer, such as pcap # file, we wait for a couple of seconds if the queue is # empty we assume producers have finish and we stop # processing. frame = self.__queue__.get(timeout=30) else: # The timeout_event is not set, we still have producers # pending to start. We need to wait. frame = self.__queue__.get(timeout=300) except Empty: break for item in consumer_list: consumer = item[0] consumer_queue = item[1] # Check consumer filters frame_type = ieee80211.get_frame_type(frame) if frame_type in consumer.get_frame_type_filter(): frame_subtype = ieee80211.get_frame_subtype(frame) if frame_subtype in consumer.get_frame_subtype_filter(): consumer_queue.put(frame) # If filters are empty we put the frame into the queue. if not consumer.get_frame_type_filter() and \ not consumer.get_frame_subtype_filter(): consumer_queue.put(frame) # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass except Exception as e: # self.__output_queue__.put({'Exception': str(e)}) self.__output_queue__.put({'Exception': traceback.format_exc()}) finally: # We need to wait for consumers to finish. self.__output_queue__.put({' ': 'Waiting for modules to finish. Please wait...'}) while True: try: if consumer_list: for item in consumer_list: consumer = item[0] consumer_queue = item[1] if consumer_queue.empty(): consumer.shutdown() consumer_list.remove(item) else: break # Wait between checks to avoid high cpu consumption. time.sleep(5) # except KeyboardInterrupt: # traceback.print_stack() except Exception as e: # self.__output_queue__.put({'Exception': str(e)}) self.__output_queue__.put({'Exception': traceback.format_exc()}) def run_from_infinite_producers(self): """ This method handles the state when processing data from infinite producers. """ # Consumers initialization consumer_list = list() for consumer in self.consumers_list: consumer_queue = Queue() if self.__injection_queue__: consumer_instance = consumer(consumer_queue, self.__output_queue__, self.__injection_queue__) else: consumer_instance = consumer(consumer_queue, self.__output_queue__) consumer_instance.start() consumer_list.append((consumer_instance, consumer_queue)) try: while not self.__stop__.is_set(): # We are working with a infinite producer, such as network # interface cards, we wait until a frame is put from the # producers. frame = self.__queue__.get() for item in consumer_list: consumer = item[0] consumer_queue = item[1] # Check consumer filters frame_type = ieee80211.get_frame_type(frame) if frame_type in consumer.get_frame_type_filter(): frame_subtype = ieee80211.get_frame_subtype(frame) if frame_subtype in consumer.get_frame_subtype_filter(): consumer_queue.put(frame) # If filters are empty we put the frame into the queue. if not consumer.get_frame_type_filter() and \ not consumer.get_frame_subtype_filter(): consumer_queue.put(frame) # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass except Exception as e: # self.__output_queue__.put({'Exception': str(e)}) self.__output_queue__.put({'Exception': traceback.format_exc()}) finally: for item in consumer_list: consumer = item[0] if consumer.is_alive(): consumer.shutdown() try: # Wait for 30 seconds for consumer to shutdown and join. consumer.join(30) except TimeoutError: # Force consumer to terminate. self.__output_queue__.put({'Timeout Error': 'Forcing %s to terminate.' % consumer.__class__.__name__}) consumer.terminate() def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() def timeout_event(self): """ This method sets the __timeout_event__ to change the queue timeout. This was added to fix the race condition that happends between a new producer starts and the queue timeout monitoring in the mediator. """ self.__timeout_event__.set() class OutputManager(WigProcess): """ TODO: Documentation """ def __init__(self, output_queue): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = output_queue def run(self): """ TODO: Documentation """ self.set_process_title() print("") # Add empty line when starting to write output. while not self.__stop__.is_set(): try: output = self.__queue__.get(timeout=5) self.print_item(output) except Empty: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def print_item(self, output_items): """ TODO: Documentation """ for k, v in output_items.items(): if len(k.strip()) == 0: print("%s" % v) else: print("%s: %s" % (k, v)) print("") # Add empty line on bottom of item output. def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() class FrameInjectionManager(WigProcess): """ TODO: Documentation """ def __init__(self, input_queue, ifaces): WigProcess.__init__(self) self.__stop__ = Event() self.__ifaces__ = ifaces self.__queue__ = input_queue def run(self): """ TODO: Documentation """ self.set_process_title() self.__pds__ = list() for iface in self.__ifaces__: self.__pds__.append(pcapy.open_live(iface, interfaces.PCAP_SNAPLEN, interfaces.PCAP_PROMISC, interfaces.PCAP_TIMEOUT)) while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) for pd in self.__pds__: pd.sendpacket(frame) except Empty: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() class FramesStats(WigProcess): """ TODO: Documentation """ __module_name__ = "Frame Stats" def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.__total_frames_count__ = 0 self.__type_management_count__ = 0 self.__type_control_count__ = 0 self.__type_data_count__ = 0 self.__type_unknown_count__ = 0 def run(self): """ TODO: Documentation """ self.set_process_title() try: while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) self.__total_frames_count__ += 1 frame_type = ieee80211.get_frame_type(frame) if frame_type == 0: self.__type_management_count__ += 1 elif frame_type == 1: self.__type_control_count__ += 1 elif frame_type == 2: self.__type_data_count__ += 1 else: self.__type_unknown_count__ += 1 except Empty: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass aux = OrderedDict() aux['Module'] = self.__module_name__ aux['Frames'] = self.__total_frames_count__ aux['Management Frames'] = self.__type_management_count__ aux['Control Frames'] = self.__type_control_count__ aux['Data Frames'] = self.__type_data_count__ aux['Unknown Frames'] = self.__type_unknown_count__ self.__output__.put(aux) def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ # Empty filter means all frames return [] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ # Empty filter means all frames return [] def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/consumers/ccx.py000066400000000000000000000161401423605617300165060ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import struct import traceback from queue import Empty from collections import OrderedDict from multiprocessing import Event from wig.helpers import ieee80211 from wig.helpers import ccx from wig.helpers.output import writer from wig.helpers.Processes import WigProcess from impacket import ImpactDecoder from impacket import dot11 class CiscoClientExtensions(WigProcess): """ TODO: Documentation """ __module_name__ = "CCX (Cisco Client Extensions)" BSSID_KEY = "BSSID" SSID_KEY = "SSID" CTRL_IP_ADDR_KEY = "Controller IP Address" AP_NAME_KEY = "Access Point Name" ASSOCIATED_CLIENTS_KEY = "Associated Clients" CHANNEL_KEY = "Channel" SECURITY_KEY = "Security" TIMESTAMP_KEY = "Timestamp" def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.decoder = ImpactDecoder.Dot11Decoder() self.decoder.FCS_at_end(False) self.__injection_queue__ = injection_queue self.__devices__ = dict() def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ return [ieee80211.TYPE_MGMT] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ return [ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE, ieee80211.TYPE_MGMT_SUBTYPE_REASSOCIATION_RESPONSE] def run(self): """ TODO: Documentation """ self.set_process_title() try: self.malformed = 0 while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) try: self.decoder.decode(frame) except Exception: self.malformed +=1 continue frame_control = self.decoder.get_protocol(dot11.Dot11) if frame_control.get_subtype() in self.get_frame_subtype_filter(): mgt_frame = self.decoder.get_protocol(dot11.Dot11ManagementFrame) # Management frames shouldn't be fragmented. # At least the ones we are processing. seq_ctl = mgt_frame.get_sequence_control() fragment_number = seq_ctl & 0x000F if fragment_number == 0: data = mgt_frame.get_body_as_string() self.process_body(frame_control, mgt_frame, data) except Empty: pass except Exception as e: if frame: self.__output__.put({'Raw Frame': frame}) self.__output__.put({'Exception': traceback.format_exc()}) # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def process_body(self, frame_ctrl, mgt_frame, data): """ Process Probe Response and Reassociation Response frames searching for CCX IEs. """ bssid = ieee80211.get_string_mac_address_from_array(mgt_frame.get_bssid()) if frame_ctrl.get_subtype() == ieee80211.TYPE_MGMT_SUBTYPE_REASSOCIATION_RESPONSE: reassociation_response = self.decoder.get_protocol(dot11.Dot11ManagementReassociationResponse) data = reassociation_response._get_element(ccx.CISCO_CCX_IE_IP_ADDRESS_ID) if data: if bssid not in self.__devices__: self.__devices__[bssid] = OrderedDict() ssid = reassociation_response._get_element(dot11.DOT11_MANAGEMENT_ELEMENTS.SSID) if ssid and self.SSID_KEY not in self.__devices__[bssid]: self.__devices__[bssid][self.SSID_KEY] = ssid aux = writer.get_device_information_dict(bssid.upper(), self.__module_name__, self.__devices__[bssid]) self.__output__.put(aux) if self.CTRL_IP_ADDR_KEY not in self.__devices__[bssid]: ccx95 = chr(ccx.CISCO_CCX_IE_IP_ADDRESS_ID) + chr(len(data)) + data self.__devices__[bssid][self.CTRL_IP_ADDR_KEY] = ccx.CiscoCCX95InformationElement(ccx95).get_ip_address() aux = writer.get_device_information_dict(bssid.upper(), self.__module_name__, self.__devices__[bssid]) self.__output__.put(aux) else: if frame_ctrl.get_subtype() == dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_BEACON: frame = self.decoder.get_protocol(dot11.Dot11ManagementBeacon) elif frame_ctrl.get_subtype() == dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE: frame = self.decoder.get_protocol(dot11.Dot11ManagementProbeResponse) else: return security = ieee80211.get_security(frame) data = frame._get_element(ccx.CISCO_CCX_IE_DEVICE_NAME_ID) if bssid not in self.__devices__ and data: self.__devices__[bssid] = OrderedDict() ssid = frame.get_ssid().decode("utf-8").replace("\x00", "") self.__devices__[bssid][self.SSID_KEY] = ssid channel = frame.get_ds_parameter_set() if channel: self.__devices__[bssid][self.CHANNEL_KEY] = channel ccx85 = struct.pack("B", ccx.CISCO_CCX_IE_DEVICE_NAME_ID) + struct.pack("B", len(data)) + data device_name = ccx.CiscoCCX85InformationElement(ccx85).get_device_name() associated_clients = ccx.CiscoCCX85InformationElement(ccx85).get_associated_clients() self.__devices__[bssid][self.AP_NAME_KEY] = device_name self.__devices__[bssid][self.ASSOCIATED_CLIENTS_KEY] = associated_clients self.__devices__[bssid][self.SECURITY_KEY] = security aux = writer.get_device_information_dict(bssid.upper(), self.__module_name__, self.__devices__[bssid]) self.__output__.put(aux) def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/consumers/hp.py000066400000000000000000000230701423605617300163400ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import struct import traceback from queue import Empty from multiprocessing import Event from collections import OrderedDict from wig.helpers import ieee80211 from wig.helpers.output import writer from wig.helpers.Processes import WigProcess from impacket import ImpactDecoder from impacket import dot11 class HewlettPackardVendorSpecificTypeZero(WigProcess): """ TODO: Documentation """ __module_name__ = "HP Printer Vendor Specific" hp_ie_oui = b"\x08\x00\x09" regex_list = ["^HP-Print-[0-9A-Fa-f][0-9A-Fa-f]-(.*)$", "^DIRECT-[0-9A-Fa-f][0-9A-Fa-f]-HP (.*)$"] HP_TLV_TYPES = { 'Status BitField': 0, 'AWC Version': 1, 'AWC Minutes Remaining': 2, 'Model Name String': 3, 'Product SKU': 4, 'Device Serial Number': 5, 'Device UUID': 6, 'Device Station IPv4 Address': 7, 'IPP Capabilities': 8, 'IPP PDLS': 9, 'IPP Change ID': 10, '5GHz Channels': 11, } STATUS_BITFIELD = { 'Station is on': 0b00000000000000000000000000000001, 'Station is configured': 0b00000000000000000000000000000010, 'Station is connected': 0b00000000000000000000000000000100, 'Station supports 5GHz': 0b00000000000000000000000000001000, 'USB connected to host': 0b00000000000000000000000000010000, } def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.decoder = ImpactDecoder.Dot11Decoder() self.decoder.FCS_at_end(False) self.__tag_stats__ = dict() def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ return [ieee80211.TYPE_MGMT] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ return [ieee80211.TYPE_MGMT_SUBTYPE_BEACON, ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE] def run(self): """ TODO: Documentation """ self.set_process_title() try: self.devices = dict() self.malformed = 0 while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) try: self.decoder.decode(frame) except Exception: self.malformed +=1 continue frame_control = self.decoder.get_protocol(dot11.Dot11) if frame_control.get_type() in self.get_frame_type_filter(): if frame_control.get_subtype() in self.get_frame_subtype_filter(): mgt_frame = self.decoder.get_protocol(dot11.Dot11ManagementFrame) # Management frames shouldn't be fragmented. # At least the ones we are processing. seq_ctl = mgt_frame.get_sequence_control() fragment_number = seq_ctl & 0x000F if fragment_number == 0: self.process_frame(frame_control, mgt_frame) except Empty: pass except Exception as e: self.__output__.put({'Exception': traceback.format_exc()}) # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def process_hp_ie(self, data, info_dict): """Process HP wireless printers information element.""" index = 0 while index < len(data): tag_id = data[index] tag_length = data[index + 1] index += 2 if tag_length > len(data) - index: continue if tag_id == self.HP_TLV_TYPES['Status BitField']: if tag_length != 4: continue aux = data[index:index + 4] bitfield = struct.unpack(">I", aux)[0] if (bitfield & self.STATUS_BITFIELD['Station is on']) != 0: info_dict['Station State'] = "On" else: info_dict['Station State'] = "Off" if (bitfield & self.STATUS_BITFIELD['Station is configured']) != 0: info_dict['Station Configured'] = "True" else: info_dict['Station Configured'] = "False" if (bitfield & self.STATUS_BITFIELD['Station is connected']) != 0: info_dict['Station is Connected'] = "True" else: info_dict['Station is Connected'] = "False" if (bitfield & self.STATUS_BITFIELD['Station supports 5GHz']) != 0: info_dict['Station Supports 5GHz'] = "True" else: info_dict['Station Supports 5GHz'] = "False" if (bitfield & self.STATUS_BITFIELD['USB connected to host']) != 0: info_dict['USB Connected'] = "True" else: info_dict['USB Connected'] = "False" index += 4 elif tag_id == self.HP_TLV_TYPES['AWC Version']: if tag_length != 2: continue awc_major = data[index] awc_minor = data[index + 1] info_dict['AWC version'] = "%d.%d" % (awc_major, awc_minor) index += 2 elif tag_id == self.HP_TLV_TYPES['Model Name String']: model_name = data[index:index+tag_length].decode("ascii") index += tag_length info_dict['Model Name'] = model_name.replace("\x00", "") elif tag_id == self.HP_TLV_TYPES['Product SKU']: product_sku = data[index:index + tag_length].decode("ascii") index += tag_length info_dict['Product SKU'] = product_sku.replace("\x00", "") elif tag_id == self.HP_TLV_TYPES['Device Serial Number']: serial_number = data[index:index + tag_length].decode("ascii") index += tag_length info_dict['Serial Number'] = serial_number.replace("\x00", "") elif tag_id == self.HP_TLV_TYPES['Device UUID']: if tag_length != 16: continue uuid = list() for byte in data[index:index + tag_length]: uuid.append("%02X" % byte) info_dict['UUID'] = "".join(uuid) index += tag_length elif tag_id == self.HP_TLV_TYPES['Device Station IPv4 Address']: if tag_length != 4: continue octets = list() for byte in data[index:index + tag_length]: octets.append("%d" % byte) info_dict['IPv4 Address'] = ".".join(octets) index += tag_length else: index += tag_length def process_frame(self, frame_ctl, mgt_frame): """ Process Beacon and Probe Response frames searching for HP IE and storing information. """ device_mac = ieee80211.get_string_mac_address_from_array( mgt_frame.get_source_address()) if device_mac not in self.devices.keys(): self.devices[device_mac] = list() if frame_ctl.get_subtype() == ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE: _frame = self.decoder.get_protocol(dot11.Dot11ManagementProbeResponse) elif frame_ctl.get_subtype() == ieee80211.TYPE_MGMT_SUBTYPE_BEACON: _frame = self.decoder.get_protocol(dot11.Dot11ManagementBeacon) if _frame: ssid = _frame.get_ssid() channel = _frame.get_ds_parameter_set() security = ieee80211.get_security(_frame) for item in _frame.get_vendor_specific(): oui = item[0] if oui == self.hp_ie_oui: ie_data = item[1] info_items = OrderedDict() info_items['SSID'] = ssid.decode("utf-8") info_items['Channel'] = channel info_items['Security'] = security self.process_hp_ie(ie_data, info_items) aux = writer.get_device_information_dict(device_mac.upper(), self.__module_name__, info_items) self.__output__.put(aux) def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/consumers/p2p.py000066400000000000000000000234301423605617300164320ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import time import struct import string import traceback import pcapy from queue import Empty from collections import OrderedDict from multiprocessing import Event from multiprocessing import Array as mpArray from wig.helpers import ieee80211 from wig.helpers import p2p from wig.helpers import wps from wig.helpers.output import writer from wig.helpers.Processes import WigProcess from impacket import ImpactDecoder from impacket import dot11 class WiFiDirect(WigProcess): """ TODO: Documentation """ __module_name__ = "P2P (Wi-Fi Direct)" WIFI_DIRECT_SSID = b"DIRECT-" def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.decoder = ImpactDecoder.Dot11Decoder() self.decoder.FCS_at_end(False) self.__injection_queue__ = injection_queue self.__devices__ = dict() def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ return [ieee80211.TYPE_MGMT] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ return [ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE] def run(self): """ TODO: Documentation """ self.set_process_title() if self.__injection_queue__: self.__transmitter__ = WiFiDirectTransmitter(self.__injection_queue__) self.__transmitter__.start() try: self.malformed = 0 while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) try: self.decoder.decode(frame) except Exception as e: self.__output__.put({'Exception': traceback.format_exc()}) self.malformed +=1 continue frame_control = self.decoder.get_protocol(dot11.Dot11) if frame_control.get_subtype() in self.get_frame_subtype_filter(): mgt_frame = self.decoder.get_protocol(dot11.Dot11ManagementFrame) # Management frames shouldn't be fragmented. # At least the ones we are processing. seq_ctl = mgt_frame.get_sequence_control() fragment_number = seq_ctl & 0x000F if fragment_number == 0: data = mgt_frame.get_body_as_string() self.process_body(mgt_frame, data) except Empty: pass except Exception as e: if frame: self.__output__.put({'Raw Frame': frame}) self.__output__.put({'Exception': traceback.format_exc()}) # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass if self.__injection_queue__: self.__transmitter__.terminate() def process_body(self, mgt_frame, data): """ Process Probe Response frame searching for WPS and P2P IEs and storing information. """ device_mac = ieee80211.get_string_mac_address_from_array(mgt_frame.get_source_address()) probe_response_frame = self.decoder.get_protocol(dot11.Dot11ManagementProbeResponse) ssid = probe_response_frame.get_ssid() if not ssid: return if not ssid == self.WIFI_DIRECT_SSID: return if device_mac not in self.__devices__.keys(): self.__devices__[device_mac] = list() vs_list = probe_response_frame.get_vendor_specific() wps_ie_info = dict() p2p_ie_info = dict() channel = probe_response_frame.get_ds_parameter_set() for vs_element in vs_list: oui, data = vs_element vs_type = struct.pack("B", data[0]) length = struct.pack("B", len(oui + data)) raw_data = wps.WPSInformationElement.VENDOR_SPECIFIC_IE_ID + length + oui + data if oui == wps.WPSInformationElement.WPS_OUI and vs_type == wps.WPSInformationElement.WPS_OUI_TYPE: ie = wps.WPSInformationElement(raw_data) for wps_element in ie.get_elements(): k, v = wps_element if all(c in bytes(string.printable, "ascii") for c in v): wps_ie_info[string.capwords(k)] = v.decode("ascii") else: wps_ie_info[string.capwords(k)] = repr(v) elif oui == p2p.P2PInformationElement.P2P_OUI and vs_type == p2p.P2PInformationElement.P2P_OUI_TYPE: ie = p2p.P2PInformationElement(raw_data) for p2p_element in ie.get_elements(): k, v = p2p_element if all(c in string.printable for c in v): p2p_ie_info[k] = v else: p2p_ie_info[k] = repr(v) if not p2p_ie_info: return info_items = OrderedDict() info_items['SSID'] = ssid if channel: info_items['Channel'] = channel for key, value in p2p_ie_info.items(): info_items['%s' % key] = value for key, value in wps_ie_info.items(): info_items['WPS %s' % key] = value aux = writer.get_device_information_dict(device_mac.upper(), self.__module_name__, info_items) self.__output__.put(aux) def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() class WiFiDirectTransmitter(WigProcess): """ P2P (Wi-Fi Direct) Transmitter handles P2P discovery frame transmission. """ def __init__(self, queue): WigProcess.__init__(self) self.__queue__ = queue self.mac_address = b"\x00\x00\xde\xad\xbe\xef" self.channel = 1 # self.channel = interface.get_interface_channel(self.iface) def get_radiotap_header(self): """Returns a radiotap header buffer for frame injection.""" buff = bytes() buff += b"\x00\x00" # Version buff += b"\x0b\x00" # Header length buff += b"\x04\x0c\x00\x00" # Bitmap buff += b"\x6c" # Rate buff += b"\x0c" # TX Power buff += b"\x01" # Antenna return buff def get_wifi_direct_probe_request_frame(self, seq): """Returns management probe request frame header.""" buff = bytes() buff += self.get_radiotap_header() buff += b"\x40\x00" # Frame Control - Management - Probe Request buff += b"\x00\x00" # Duration buff += b"\xff\xff\xff\xff\xff\xff" # Destination Address- Broadcast buff += self.mac_address # Source Address buff += b"\xff\xff\xff\xff\xff\xff" # BSSID Address - Broadcast # buffer += "\x00\x00" # Sequence Control buff += b"\x00" + struct.pack("B", seq) # Sequence Control # SSID IE buff += b"\x00" buff += b"\x07" buff += WiFiDirect.WIFI_DIRECT_SSID # Supported Rates IE buff += b"\x01" buff += b"\x08" buff += b"\x0c\x12\x18\x24\x30\x48\x60\x6c" # DS Parameter Set IE buff += b"\x03" buff += b"\x01" buff += struct.pack("B", self.channel) # WPS IE buff += b"\xdd" buff += b"\x6c" buff += b"\x00\x50\xf2" buff += b"\x04" buff += b"\x10\x4a\x00\x01\x10" buff += b"\x10\x3a\x00\x01\x01" buff += b"\x10\x08\x00\x02\x43\x88" buff += b"\x10\x47\x00\x10\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa\xfa" buff += b"\x10\x54\x00\x08\x00\x0a\x00\x50\xf2\x04\x00\x05" buff += b"\x10\x3c\x00\x01\x01" buff += b"\x10\x02\x00\x02\x00\x00" buff += b"\x10\x09\x00\x02\x00\x00" buff += b"\x10\x12\x00\x02\x00\x00" buff += b"\x10\x21\x00\x01\x20" buff += b"\x10\x23\x00\x01\x20" buff += b"\x10\x24\x00\x01\x20" buff += b"\x10\x11\x00\x01\x41" buff += b"\x10\x49\x00\x09\x00\x37\x2a\x00\x01\x20\x03\x01\x01" # WiFi-Direct IE buff += b"\xdd" buff += b"\x11" buff += b"\x50\x6f\x9a" buff += b"\x09" buff += b"\x02\x02\x00\x21\x00" buff += b"\x06\x05\x00US\x04\x51" + struct.pack("B", self.channel) return buff def run(self): """Transmit frames forever.""" self.set_process_title() seq = 0 # TODO: Fix how we are handling sequence numbers frame = self.get_wifi_direct_probe_request_frame(seq) while True: self.__queue__.put(frame) seq += 1 time.sleep(0.100) wig-ng-0.1/wig/consumers/uncommon.py000066400000000000000000000162771423605617300175770ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # from queue import Empty from multiprocessing import Event from collections import OrderedDict from wig.helpers import ieee80211 from wig.helpers.Processes import WigProcess from impacket import ImpactDecoder from impacket import dot11 class InformationElementsStats(WigProcess): """ TODO: Documentation """ __module_name__ = "Information Element Stats" SUBTYPE_WHITELIST = [ dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_REQUEST, # 00 - 00 dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_RESPONSE, # 00 - 01 dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_REQUEST, # 00 - 02 dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_RESPONSE, # 00 - 03 dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_REQUEST, # 00 - 04 dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE, # 00 - 05 dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_BEACON, # 00 - 08 # dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ATIM, # 00 - 09 # dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_DISASSOCIATION, # 00 - 10 # dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_AUTHENTICATION, # 00 - 11 # dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_DEAUTHENTICATION, # 00 - 12 # dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ACTION, # 00 - 13 ] HDR_SIZE = { dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_BEACON: 12, dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_REQUEST: 0, dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_PROBE_RESPONSE: 12, dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_REQUEST: 4, dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_ASSOCIATION_RESPONSE: 6, dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_REQUEST: 10, dot11.Dot11Types.DOT11_SUBTYPE_MANAGEMENT_REASSOCIATION_RESPONSE: 6, } def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.decoder = ImpactDecoder.Dot11Decoder() self.decoder.FCS_at_end(False) self.__tag_stats__ = dict() def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ return [ieee80211.TYPE_MGMT] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ return [ieee80211.TYPE_MGMT_SUBTYPE_BEACON, ieee80211.TYPE_MGMT_SUBTYPE_PROBE_REQUEST, ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE, ieee80211.TYPE_MGMT_SUBTYPE_ASSOCIATION_REQUEST, ieee80211.TYPE_MGMT_SUBTYPE_ASSOCIATION_RESPONSE, ieee80211.TYPE_MGMT_SUBTYPE_REASSOCIATION_REQUEST, ieee80211.TYPE_MGMT_SUBTYPE_REASSOCIATION_RESPONSE] def run(self): """ TODO: Documentation """ self.set_process_title() try: self.__malformed__ = 0 while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) try: self.decoder.decode(frame) except Exception: self.__malformed__ +=1 continue frame_control = self.decoder.get_protocol(dot11.Dot11) if frame_control.get_subtype() in self.SUBTYPE_WHITELIST: mgt_frame = self.decoder.get_protocol(dot11.Dot11ManagementFrame) # Management frames shouldn't be fragmented. # At least the ones we are processing. seq_ctl = mgt_frame.get_sequence_control() fragment_number = seq_ctl & 0x000F if fragment_number == 0: child = mgt_frame.child() header_size = self.HDR_SIZE[frame_control.get_subtype()] self.process_body(child, header_size, frame) except Empty: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass aux = OrderedDict() aux['Module'] = self.__module_name__ for tag_id, count in self.__tag_stats__.items(): if tag_id in ieee80211.tag_strings.keys(): aux['TAG %02X [%s]' % (tag_id, ieee80211.tag_strings[tag_id])] = count else: aux['TAG %02X' % tag_id] = count aux['Malformed frames'] = self.__malformed__ self.__output__.put(aux) def process_body(self, child, offset, raw): """ TODO: Documentation """ buff = child.get_header_as_string()[offset:] try: ies = InformationElementsStats.get_ie_list(buff) if ies: for ie in ies: tag, length, value = ie # We avoid adding information elements with invalid length. if length == len(value) and length > 0: if tag not in self.__tag_stats__.keys(): self.__tag_stats__[tag] = 1 else: self.__tag_stats__[tag] += 1 except Exception as e: # self.__output__.put({'Exception': str(e)}) import traceback self.__output__.put({'Exception': traceback.format_exc()}) @staticmethod def get_ie_list(buff): """ TODO: Documentation """ result = list() idx = 0 invalid = 0 while True: tag = buff[idx] length = buff[idx+1] value = buff[idx+2:idx+2+length] if length == 0 or length > len(value): invalid += 1 result.append((tag, length, value)) idx += (length + 2) if idx >= len(buff): break # if len(buff) < 3: # break # In case we found more than one invalid information element we asume # the frame contains invalid data. if invalid > 1: return list() return result def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/consumers/wps.py000066400000000000000000000135371423605617300165510ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import string import struct import traceback from queue import Empty from multiprocessing import Event from wig.helpers import wps from wig.helpers import ieee80211 from wig.helpers.output import writer from wig.helpers.Processes import WigProcess from impacket import ImpactDecoder from impacket import dot11 class WiFiProtectedSetup(WigProcess): """ TODO: Documentation """ __module_name__ = "WPS (WiFi Protected Setup)" def __init__(self, frames_queue, output_queue, injection_queue=None): WigProcess.__init__(self) self.__stop__ = Event() self.__queue__ = frames_queue self.__output__ = output_queue self.decoder = ImpactDecoder.Dot11Decoder() self.decoder.FCS_at_end(False) self.__tag_stats__ = dict() def get_frame_type_filter(self): """ Returns a list of IEEE 802.11 frame types supported by the module. """ return [ieee80211.TYPE_MGMT] def get_frame_subtype_filter(self): """ Returns a list of IEEE 802.11 frame subtypes supported by the module. """ return [ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE] def run(self): """ TODO: Documentation """ self.set_process_title() try: self.devices = dict() self.malformed = 0 while not self.__stop__.is_set(): try: frame = self.__queue__.get(timeout=5) try: self.decoder.decode(frame) except Exception as e: self.__output__.put({'Exception': traceback.format_exc()}) self.malformed +=1 continue frame_control = self.decoder.get_protocol(dot11.Dot11) if frame_control.get_type() in self.get_frame_type_filter(): if frame_control.get_subtype() in self.get_frame_subtype_filter(): mgt_frame = self.decoder.get_protocol(dot11.Dot11ManagementFrame) # Management frames shouldn't be fragmented. # At least the ones we are processing. seq_ctl = mgt_frame.get_sequence_control() fragment_number = seq_ctl & 0x000F if fragment_number == 0: self.process_frame(frame_control, mgt_frame) except Empty: pass except Exception as e: if frame: self.__output__.put({'Raw Frame': frame}) self.__output__.put({'Exception': traceback.format_exc()}) # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def process_frame(self, frame_ctl, mgt_frame): """ Process Probe Response frame searching for WPS IEs and printing the information. """ device_mac = ieee80211.get_string_mac_address_from_array( mgt_frame.get_source_address()) if device_mac not in self.devices.keys(): self.devices[device_mac] = list() if frame_ctl.get_subtype() == ieee80211.TYPE_MGMT_SUBTYPE_PROBE_RESPONSE: _frame = self.decoder.get_protocol(dot11.Dot11ManagementProbeResponse) if _frame: ssid = _frame.get_ssid() channel = _frame.get_ds_parameter_set() security = ieee80211.get_security(_frame) vs_list = _frame.get_vendor_specific() for item in vs_list: oui, data = item vs_type = struct.pack("B", data[0]) length = struct.pack("B", len(oui + data)) raw_data = wps.WPSInformationElement.VENDOR_SPECIFIC_IE_ID + length + oui + data if oui == wps.WPSInformationElement.WPS_OUI and vs_type == wps.WPSInformationElement.WPS_OUI_TYPE: info_items = dict() if ssid: info_items['SSID'] = ssid.decode('utf-8') if channel: info_items['Channel'] = channel info_items['Security'] = security ie = wps.WPSInformationElement(raw_data) for element in ie.get_elements(): k, v = element if all(c in bytes(string.printable, "ascii") for c in v): info_items[string.capwords(k)] = v.decode('ascii') else: info_items[string.capwords(k)] = repr(v) aux = writer.get_device_information_dict(device_mac.upper(), self.__module_name__, info_items) self.__output__.put(aux) def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/helpers/000077500000000000000000000000001423605617300150015ustar00rootroot00000000000000wig-ng-0.1/wig/helpers/Processes.py000066400000000000000000000017431423605617300173260ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # from multiprocessing import Process from setproctitle import setproctitle class WigProcess(Process): def set_process_title(self): setproctitle(self.__class__.__name__) wig-ng-0.1/wig/helpers/__init__.py000066400000000000000000000014511423605617300171130ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . #wig-ng-0.1/wig/helpers/ccx.py000066400000000000000000000071511423605617300161340ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import socket CISCO_CCX_IE_DEVICE_NAME_ID = 0x85 CISCO_CCX_IE_IP_ADDRESS_ID = 0x95 class InvalidCCXInformationElement(Exception): """Invalid CCX Information Element Exception.""" pass class CiscoCCX85InformationElement(object): TLV_HEADER_SIZE = 2 DEVICE_NAME_OFFSET = 10 + TLV_HEADER_SIZE DEVICE_NAME_VALUE_SIZE = 16 ASSOCIATED_CLIENTS_OFFSET = 26 + TLV_HEADER_SIZE def __init__(self, buff): self.buffer = buff self.buffer_length = len(buff) self.__device_name__ = str() self.__associated_clients__ = int() self.__do_basic_verification__() self.__process_buffer__() def get_device_name(self): """Return the device name value in the information element.""" return self.__device_name__ def get_associated_clients(self): """Return the associated clients value in the information element.""" return self.__associated_clients__ def __do_basic_verification__(self): """Verify if the buffer has the minimal length necessary.""" tlv_id = self.buffer[0] tlv_size = self.buffer[1] if not tlv_id == CISCO_CCX_IE_DEVICE_NAME_ID: raise InvalidCCXInformationElement() if tlv_size < self.ASSOCIATED_CLIENTS_OFFSET or self.buffer_length < self.ASSOCIATED_CLIENTS_OFFSET: raise InvalidCCXInformationElement() def __process_buffer__(self): """Process data buffer and get device name and associated clients.""" aux_buff = self.buffer[self.DEVICE_NAME_OFFSET:self.DEVICE_NAME_OFFSET+self.DEVICE_NAME_VALUE_SIZE] self.__device_name__ = aux_buff.decode("utf-8").replace("\x00", "") self.__associated_clients__ = self.buffer[self.ASSOCIATED_CLIENTS_OFFSET] class CiscoCCX95InformationElement(object): TLV_HEADER_SIZE = 2 TLV_MIN_SIZE = 10 IP_ADDRESS_OFFSET = 4 + TLV_HEADER_SIZE IP_ADDRESS_SIZE = 4 def __init__(self, buff): self.buffer = buff self.buffer_length = len(buff) self.__ip_address__ = str() self.__do_basic_verification__() self.__process_buffer__() def get_ip_address(self): """Return the IP address value in the information element.""" return self.__ip_address__ def __do_basic_verification__(self): """Verify if the buffer has the minimal length necessary.""" tlv_id = self.buffer[0] tlv_size = self.buffer[1] if not tlv_id == CISCO_CCX_IE_IP_ADDRESS_ID: raise InvalidCCXInformationElement() if tlv_size < self.TLV_MIN_SIZE: raise InvalidCCXInformationElement() def __process_buffer__(self): """Process data buffer and get ip address.""" buff = self.buffer[self.IP_ADDRESS_OFFSET:self.IP_ADDRESS_OFFSET+self.IP_ADDRESS_SIZE] self.__ip_address__ = socket.inet_ntoa(buff) wig-ng-0.1/wig/helpers/ieee80211.py000066400000000000000000000420621423605617300166620ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # from impacket import dot11 FRAME_CONTROL_HEADER_LENGTH = 2 TYPE_MGMT = 0b00 TYPE_CTRL = 0b01 TYPE_DATA = 0b10 TYPE_MGMT_SUBTYPE_ASSOCIATION_REQUEST = 0b0000 TYPE_MGMT_SUBTYPE_ASSOCIATION_RESPONSE = 0b0001 TYPE_MGMT_SUBTYPE_REASSOCIATION_REQUEST = 0b0010 TYPE_MGMT_SUBTYPE_REASSOCIATION_RESPONSE = 0b0011 TYPE_MGMT_SUBTYPE_PROBE_REQUEST = 0b0100 TYPE_MGMT_SUBTYPE_PROBE_RESPONSE = 0b0101 TYPE_MGMT_SUBTYPE_BEACON = 0b1000 TYPE_MGMT_SUBTYPE_ATIM = 0b1001 TYPE_MGMT_SUBTYPE_DISASSOCIATION = 0b1010 TYPE_MGMT_SUBTYPE_AUTHENTICATION = 0b1011 TYPE_MGMT_SUBTYPE_DEAUTHENTICATION = 0b1100 TYPE_MGMT_SUBTYPE_ACTION = 0b1101 TYPE_MGMT_SUBTYPE_ACTION_NO_ACK = 0b1110 # TAG IDs # https://raw.githubusercontent.com/ # wireshark/wireshark/master/epan/dissectors/packet-ieee80211.c TAG_SSID = 0 TAG_SUPP_RATES = 1 TAG_FH_PARAMETER = 2 TAG_DS_PARAMETER = 3 TAG_CF_PARAMETER = 4 TAG_TIM = 5 TAG_IBSS_PARAMETER = 6 TAG_COUNTRY_INFO = 7 TAG_FH_HOPPING_PARAMETER = 8 TAG_FH_HOPPING_TABLE = 9 TAG_REQUEST = 10 TAG_QBSS_LOAD = 11 TAG_EDCA_PARAM_SET = 12 TAG_TSPEC = 13 TAG_TCLAS = 14 TAG_SCHEDULE = 15 TAG_CHALLENGE_TEXT = 16 TAG_POWER_CONSTRAINT = 32 TAG_POWER_CAPABILITY = 33 TAG_TPC_REQUEST = 34 TAG_TPC_REPORT = 35 TAG_SUPPORTED_CHANNELS = 36 TAG_CHANNEL_SWITCH_ANN = 37 TAG_MEASURE_REQ = 38 TAG_MEASURE_REP = 39 TAG_QUIET = 40 TAG_IBSS_DFS = 41 TAG_ERP_INFO = 42 TAG_TS_DELAY = 43 TAG_TCLAS_PROCESS = 44 TAG_HT_CAPABILITY = 45 TAG_QOS_CAPABILITY = 46 TAG_ERP_INFO_OLD = 47 TAG_RSN_IE = 48 TAG_EXT_SUPP_RATES = 50 TAG_AP_CHANNEL_REPORT = 51 TAG_NEIGHBOR_REPORT = 52 TAG_RCPI = 53 TAG_MOBILITY_DOMAIN = 54 TAG_FAST_BSS_TRANSITION = 55 TAG_TIMEOUT_INTERVAL = 56 TAG_RIC_DATA = 57 TAG_DSE_REG_LOCATION = 58 TAG_SUPPORTED_OPERATING_CLASSES = 59 TAG_EXTENDED_CHANNEL_SWITCH_ANNOUNCEMENT = 60 TAG_HT_INFO = 61 TAG_SECONDARY_CHANNEL_OFFSET = 62 TAG_BSS_AVG_ACCESS_DELAY = 63 TAG_ANTENNA = 64 TAG_RSNI = 65 TAG_MEASURE_PILOT_TRANS = 66 TAG_BSS_AVB_ADM_CAPACITY = 67 TAG_IE_68_CONFLICT = 68 TAG_WAPI_PARAM_SET = 68 TAG_BSS_AC_ACCESS_DELAY = 68 TAG_TIME_ADV = 69 TAG_RM_ENABLED_CAPABILITY = 70 TAG_MULTIPLE_BSSID = 71 TAG_20_40_BSS_CO_EX = 72 TAG_20_40_BSS_INTOL_CH_REP = 73 TAG_OVERLAP_BSS_SCAN_PAR = 74 TAG_RIC_DESCRIPTOR = 75 TAG_MMIE = 76 TAG_EVENT_REQUEST = 78 TAG_EVENT_REPORT = 79 TAG_DIAGNOSTIC_REQUEST = 80 TAG_DIAGNOSTIC_REPORT = 81 TAG_LOCATION_PARAMETERS = 82 TAG_NO_BSSID_CAPABILITY = 83 TAG_SSID_LIST = 84 TAG_MULTIPLE_BSSID_INDEX = 85 TAG_FMS_DESCRIPTOR = 86 TAG_FMS_REQUEST = 87 TAG_FMS_RESPONSE = 88 TAG_QOS_TRAFFIC_CAPABILITY = 89 TAG_BSS_MAX_IDLE_PERIOD = 90 TAG_TFS_REQUEST = 91 TAG_TFS_RESPONSE = 92 TAG_WNM_SLEEP_MODE = 93 TAG_TIM_BROADCAST_REQUEST = 94 TAG_TIM_BROADCAST_RESPONSE = 95 TAG_COLLOCATED_INTER_REPORT = 96 TAG_CHANNEL_USAGE = 97 TAG_TIME_ZONE = 98 TAG_DMS_REQUEST = 99 TAG_DMS_RESPONSE = 100 TAG_LINK_IDENTIFIER = 101 TAG_WAKEUP_SCHEDULE = 102 TAG_CHANNEL_SWITCH_TIMING = 104 TAG_PTI_CONTROL = 105 TAG_PU_BUFFER_STATUS = 106 TAG_INTERWORKING = 107 TAG_ADVERTISEMENT_PROTOCOL = 108 TAG_EXPIDITED_BANDWIDTH_REQ = 109 TAG_QOS_MAP_SET = 110 TAG_ROAMING_CONSORTIUM = 111 TAG_EMERGENCY_ALERT_ID = 112 TAG_MESH_CONFIGURATION = 113 TAG_MESH_ID = 114 TAG_MESH_LINK_METRIC_REPORT = 115 TAG_CONGESTION_NOTIFICATION = 116 TAG_MESH_PEERING_MGMT = 117 TAG_MESH_CHANNEL_SWITCH = 118 TAG_MESH_AWAKE_WINDOW = 119 TAG_BEACON_TIMING = 120 TAG_MCCAOP_SETUP_REQUEST = 121 TAG_MCCAOP_SETUP_REPLY = 122 TAG_MCCAOP_ADVERTISEMENT = 123 TAG_MCCAOP_TEARDOWN = 124 TAG_GANN = 125 TAG_RANN = 126 TAG_EXTENDED_CAPABILITIES = 127 TAG_AGERE_PROPRIETARY = 128 TAG_MESH_PREQ = 130 TAG_MESH_PREP = 131 TAG_MESH_PERR = 132 TAG_CISCO_CCX1_CKIP = 133 TAG_CISCO_CCX2 = 136 TAG_PXU = 137 TAG_PXUC = 138 TAG_AUTH_MESH_PEERING_EXCH = 139 TAG_MIC = 140 TAG_DESTINATION_URI = 141 TAG_U_APSD_COEX = 142 TAG_WAKEUP_SCHEDULE_AD = 143 TAG_EXTENDED_SCHEDULE = 144 TAG_STA_AVAILABILITY = 145 TAG_DMG_TSPEC = 146 TAG_NEXT_DMG_ATI = 147 TAG_DMG_CAPABILITIES = 148 TAG_CISCO_CCX3 = 149 TAG_CISCO_VENDOR_SPECIFIC = 150 TAG_DMG_OPERATION = 151 TAG_DMG_BSS_PARAMETER_CHANGE = 152 TAG_DMG_BEAM_REFINEMENT = 153 TAG_CHANNEL_MEASURMENT_FB = 154 TAG_AWAKE_WINDOW = 157 TAG_MULTI_BAND = 158 TAG_ADDBA_EXT = 159 TAG_NEXTPCP_LIST = 160 TAG_PCP_HANDOVER = 161 TAG_DMG_LINK_MARGIN = 162 TAG_SWITCHING_STREAM = 163 TAG_SESSION_TRANSMISSION = 164 TAG_DYN_TONE_PAIR_REP = 165 TAG_CLUSTER_REP = 166 TAG_RELAY_CAPABILITIES = 167 TAG_RELAY_TRANSFER_PARAM = 168 TAG_BEAMLINK_MAINTENANCE = 169 TAG_MULTIPLE_MAC_SUBLAYERS = 170 TAG_U_PID = 171 TAG_DMG_LINK_ADAPTION_ACK = 172 TAG_SYMBOL_PROPRIETARY = 173 TAG_MCCAOP_ADVERTISEMENT_OV = 174 TAG_QUIET_PERIOD_REQ = 175 TAG_QUIET_PERIOD_RES = 177 TAG_ECAPC_POLICY = 182 TAG_CLUSTER_TIME_OFFSET = 183 TAG_ANTENNA_SECTOR_ID = 190 TAG_VHT_CAPABILITY = 191 TAG_VHT_OPERATION = 192 TAG_EXT_BSS_LOAD = 193 TAG_WIDE_BW_CHANNEL_SWITCH = 194 TAG_VHT_TX_PWR_ENVELOPE = 195 TAG_CHANNEL_SWITCH_WRAPPER = 196 TAG_OPERATING_MODE_NOTIFICATION = 199 TAG_FINE_TIME_MEASUREMENT_PARAM = 206 TAG_S1G_OPEN_LOOP_LINK_MARGIN_INDEX = 207 TAG_RPS = 208 TAG_PAGE_SLICE = 209 TAG_AID_REQUEST = 210 TAG_AID_RESPONSE = 211 TAG_S1G_SECTOR_OPERATION = 212 TAG_S1G_BEACON_COMPATIBILITY = 213 TAG_SHORT_BEACON_INTERVAL = 214 TAG_CHANGE_SEQUENCE = 215 TAG_TWT = 216 TAG_S1G_CAPABILITIES = 217 TAG_SUBCHANNEL_SELECTIVE_TRANSMISSION = 220 TAG_VENDOR_SPECIFIC_IE = 221 TAG_AUTHENTICATION_CONTROL = 222 TAG_TSF_TIMER_ACCURACY = 223 TAG_S1G_RELAY = 224 TAG_REACHABLE_ADDRESS = 225 TAG_S1G_RELAY_DISCOVERY = 226 TAG_AID_ANNOUNCEMENT = 228 TAG_PV1_PROBE_RESPONSE_OPTION = 229 TAG_EL_OPERATION = 230 TAG_SECTORIZED_GROUP_ID_LIST = 231 TAG_S1G_OPERATION = 232 TAG_HEADER_COMPRESSION = 233 TAG_SST_OPERATION = 234 TAG_MAD = 235 TAG_S1G_RELAY_ACTIVATION = 236 TAG_CAG_NUMBER = 237 TAG_AP_CSN = 239 TAG_FILS_INDICATION = 240 TAG_DIFF_INITIAL_LINK_SETUP = 241 TAG_FRAGMENT = 242 TAG_ELEMENT_ID_EXTENSION = 255 tag_strings = { TAG_SSID: "SSID parameter set", TAG_SUPP_RATES: "Supported Rates", TAG_FH_PARAMETER: "FH Parameter set", TAG_DS_PARAMETER: "DS Parameter set", TAG_CF_PARAMETER: "CF Parameter set", TAG_TIM: "Traffic Indication Map (TIM)", TAG_IBSS_PARAMETER: "IBSS Parameter set", TAG_COUNTRY_INFO: "Country Information", TAG_FH_HOPPING_PARAMETER: "Hopping Pattern Parameters", TAG_FH_HOPPING_TABLE: "Hopping Pattern Table", TAG_REQUEST: "Request", TAG_QBSS_LOAD: "QBSS Load Element", TAG_EDCA_PARAM_SET: "EDCA Parameter Set", TAG_TSPEC: "Traffic Specification", TAG_TCLAS: "Traffic Classification", TAG_SCHEDULE: "Schedule", TAG_CHALLENGE_TEXT: "Challenge text", TAG_POWER_CONSTRAINT: "Power Constraint", TAG_POWER_CAPABILITY: "Power Capability", TAG_TPC_REQUEST: "TPC Request", TAG_TPC_REPORT: "TPC Report", TAG_SUPPORTED_CHANNELS: "Supported Channels", TAG_CHANNEL_SWITCH_ANN: "Channel Switch Announcement", TAG_MEASURE_REQ: "Measurement Request", TAG_MEASURE_REP: "Measurement Report", TAG_QUIET: "Quiet", TAG_IBSS_DFS: "IBSS DFS", TAG_ERP_INFO: "ERP Information", TAG_TS_DELAY: "TS Delay", TAG_TCLAS_PROCESS: "TCLAS Processing", TAG_HT_CAPABILITY: "HT Capabilities (802.11n D1.10)", TAG_QOS_CAPABILITY: "QoS Capability", TAG_ERP_INFO_OLD: "ERP Information", TAG_RSN_IE: "RSN Information", TAG_EXT_SUPP_RATES: "Extended Supported Rates", TAG_AP_CHANNEL_REPORT: "AP Channel Report", TAG_NEIGHBOR_REPORT: "Neighbor Report", TAG_RCPI: "RCPI", TAG_MOBILITY_DOMAIN: "Mobility Domain", TAG_FAST_BSS_TRANSITION: "Fast BSS Transition", TAG_TIMEOUT_INTERVAL: "Timeout Interval", TAG_RIC_DATA: "RIC Data", TAG_DSE_REG_LOCATION: "DSE Registered Location", TAG_SUPPORTED_OPERATING_CLASSES: "Supported Operating Classes", TAG_EXTENDED_CHANNEL_SWITCH_ANNOUNCEMENT: "Extended Channel Switch Announcement", TAG_HT_INFO: "HT Information (802.11n D1.10)", TAG_SECONDARY_CHANNEL_OFFSET: "Secondary Channel Offset (802.11n D1.10)", TAG_BSS_AVG_ACCESS_DELAY: "BSS Average Access Delay", TAG_ANTENNA: "Antenna", TAG_RSNI: "RSNI", TAG_MEASURE_PILOT_TRANS: "Measurement Pilot Transmission", TAG_BSS_AVB_ADM_CAPACITY: "BSS Available Admission Capacity", TAG_IE_68_CONFLICT: "BSS AC Access Delay/WAPI Parameter Set", TAG_TIME_ADV: "Time Advertisement", TAG_RM_ENABLED_CAPABILITY: "RM Enabled Capabilities", TAG_MULTIPLE_BSSID: "Multiple BSSID", TAG_20_40_BSS_CO_EX: "20/40 BSS Coexistence", TAG_20_40_BSS_INTOL_CH_REP: "20/40 BSS Intolerant Channel Report", TAG_OVERLAP_BSS_SCAN_PAR: "Overlapping BSS Scan Parameters", TAG_RIC_DESCRIPTOR: "RIC Descriptor", TAG_MMIE: "Management MIC", TAG_EVENT_REQUEST: "Event Request", TAG_EVENT_REPORT: "Event Report", TAG_DIAGNOSTIC_REQUEST: "Diagnostic Request", TAG_DIAGNOSTIC_REPORT: "Diagnostic Report", TAG_LOCATION_PARAMETERS: "Location Parameters", TAG_NO_BSSID_CAPABILITY: "Non Transmitted BSSID Capability", TAG_SSID_LIST: "SSID List", TAG_MULTIPLE_BSSID_INDEX: "Multiple BSSID Index", TAG_FMS_DESCRIPTOR: "FMS Descriptor", TAG_FMS_REQUEST: "FMS Request", TAG_FMS_RESPONSE: "FMS Response", TAG_QOS_TRAFFIC_CAPABILITY: "QoS Traffic Capability", TAG_BSS_MAX_IDLE_PERIOD: "BSS Max Idle Period", TAG_TFS_REQUEST: "TFS Request", TAG_TFS_RESPONSE: "TFS Response", TAG_WNM_SLEEP_MODE: "WNM-Sleep Mode", TAG_TIM_BROADCAST_REQUEST: "TIM Broadcast Request", TAG_TIM_BROADCAST_RESPONSE: "TIM Broadcast Response", TAG_COLLOCATED_INTER_REPORT: "Collocated Interference Report", TAG_CHANNEL_USAGE: "Channel Usage", TAG_TIME_ZONE: "Time Zone", TAG_DMS_REQUEST: "DMS Request", TAG_DMS_RESPONSE: "DMS Response", TAG_LINK_IDENTIFIER: "Link Identifier", TAG_WAKEUP_SCHEDULE: "Wakeup Schedule", TAG_CHANNEL_SWITCH_TIMING: "Channel Switch Timing", TAG_PTI_CONTROL: "PTI Control", TAG_PU_BUFFER_STATUS: "PU Buffer Status", TAG_INTERWORKING: "Interworking", TAG_ADVERTISEMENT_PROTOCOL: "Advertisement Protocol", TAG_EXPIDITED_BANDWIDTH_REQ: "Expedited Bandwidth Request", TAG_QOS_MAP_SET: "QoS Map Set", TAG_ROAMING_CONSORTIUM: "Roaming Consortium", TAG_EMERGENCY_ALERT_ID: "Emergency Alert Identifier", TAG_MESH_CONFIGURATION: "Mesh Configuration", TAG_MESH_ID: "Mesh ID", TAG_MESH_LINK_METRIC_REPORT: "Mesh Link Metric Report", TAG_CONGESTION_NOTIFICATION: "Congestion Notification", TAG_MESH_PEERING_MGMT: "Mesh Peering Management", TAG_MESH_CHANNEL_SWITCH: "Mesh Channel Switch Parameters", TAG_MESH_AWAKE_WINDOW: "Mesh Awake Window", TAG_BEACON_TIMING: "Beacon Timing", TAG_MCCAOP_SETUP_REQUEST: "MCCAOP Setup Request", TAG_MCCAOP_SETUP_REPLY: "MCCAOP SETUP Reply", TAG_MCCAOP_ADVERTISEMENT: "MCCAOP Advertisement", TAG_MCCAOP_TEARDOWN: "MCCAOP Teardown", TAG_GANN: "Gate Announcement", TAG_RANN: "Root Announcement", TAG_EXTENDED_CAPABILITIES: "Extended Capabilities", TAG_AGERE_PROPRIETARY: "Agere Proprietary", TAG_MESH_PREQ: "Path Request", TAG_MESH_PREP: "Path Reply", TAG_MESH_PERR: "Path Error", TAG_CISCO_CCX1_CKIP: "Cisco CCX1 CKIP + Device Name", TAG_CISCO_CCX2: "Cisco CCX2", TAG_PXU: "Proxy Update", TAG_PXUC: "Proxy Update Confirmation", TAG_AUTH_MESH_PEERING_EXCH: "Auhenticated Mesh Perring Exchange", TAG_MIC: "MIC (Message Integrity Code)", TAG_DESTINATION_URI: "Destination URI", TAG_U_APSD_COEX: "U-APSD Coexistence", TAG_WAKEUP_SCHEDULE_AD: "Wakeup Schedule 802.11ad", TAG_EXTENDED_SCHEDULE: "Extended Schedule", TAG_STA_AVAILABILITY: "STA Availability", TAG_DMG_TSPEC: "DMG TSPEC", TAG_NEXT_DMG_ATI: "Next DMG ATI", TAG_DMG_CAPABILITIES: "DMG Capabilities", TAG_CISCO_CCX3: "Cisco Unknown 95", TAG_CISCO_VENDOR_SPECIFIC: "Vendor Specific", TAG_DMG_OPERATION: "DMG Operating", TAG_DMG_BSS_PARAMETER_CHANGE: "DMG BSS Parameter Change", TAG_DMG_BEAM_REFINEMENT: "DMG Beam Refinement", TAG_CHANNEL_MEASURMENT_FB: "Channel Measurement Feedback", TAG_AWAKE_WINDOW: "Awake Window", TAG_MULTI_BAND: "Multi Band", TAG_ADDBA_EXT: "ADDBA Extension", TAG_NEXTPCP_LIST: "NEXTPCP List", TAG_PCP_HANDOVER: "PCP Handover", TAG_DMG_LINK_MARGIN: "DMG Link Margin", TAG_SWITCHING_STREAM: "Switching Stream", TAG_SESSION_TRANSMISSION: "Session Transmission", TAG_DYN_TONE_PAIR_REP: "Dynamic Tone Pairing Report", TAG_CLUSTER_REP: "Cluster Report", TAG_RELAY_CAPABILITIES: "Relay Capabilities", TAG_RELAY_TRANSFER_PARAM: "Relay Transfer Parameter", TAG_BEAMLINK_MAINTENANCE: "Beamlink Maintenance", TAG_MULTIPLE_MAC_SUBLAYERS: "Multiple MAC Sublayers", TAG_U_PID: "U-PID", TAG_DMG_LINK_ADAPTION_ACK: "DMG Link Adaption Acknowledgment", TAG_SYMBOL_PROPRIETARY: "Symbol Proprietary", TAG_MCCAOP_ADVERTISEMENT_OV: "MCCAOP Advertisement Overview", TAG_QUIET_PERIOD_REQ: "Quiet Period Request", TAG_QUIET_PERIOD_RES: "Quiet Period Response", TAG_ECAPC_POLICY: "ECAPC Policy", TAG_CLUSTER_TIME_OFFSET: "Cluster Time Offset", TAG_ANTENNA_SECTOR_ID: "Antenna Sector ID", TAG_VHT_CAPABILITY: "VHT Capabilities", TAG_VHT_OPERATION: "VHT Operation", TAG_EXT_BSS_LOAD: "Extended BSS Load", TAG_WIDE_BW_CHANNEL_SWITCH: "Wide Bandwidth Channel Switch", TAG_VHT_TX_PWR_ENVELOPE: "VHT Tx Power Envelope", TAG_CHANNEL_SWITCH_WRAPPER: "Channel Switch Wrapper", TAG_OPERATING_MODE_NOTIFICATION: "Operating Mode Notification", TAG_S1G_OPEN_LOOP_LINK_MARGIN_INDEX: "S1G Open-Loop Link Margin Index", TAG_RPS: "RPS", TAG_PAGE_SLICE: "Page Slice", TAG_AID_REQUEST: "AID Request", TAG_AID_RESPONSE: "AID Response", TAG_S1G_SECTOR_OPERATION: "Sector Operation", TAG_S1G_BEACON_COMPATIBILITY: "S1G Beacon Compatibility", TAG_SHORT_BEACON_INTERVAL: "Short Beacon Interval", TAG_CHANGE_SEQUENCE: "Change Sequence", TAG_TWT: "Target Wake Time", TAG_S1G_CAPABILITIES: "S1G Capabilities", TAG_SUBCHANNEL_SELECTIVE_TRANSMISSION: "Subchannel Selective Transmission", TAG_VENDOR_SPECIFIC_IE: "Vendor Specific", TAG_AUTHENTICATION_CONTROL: "Authentication Control", TAG_TSF_TIMER_ACCURACY: "TSF Timer Accuracy", TAG_S1G_RELAY: "S1G Relay", TAG_REACHABLE_ADDRESS: "Reachable Address", TAG_S1G_RELAY_DISCOVERY: "S1G Relay Discovery", TAG_AID_ANNOUNCEMENT: "AID Announcement", TAG_PV1_PROBE_RESPONSE_OPTION: "PV1 Probe Response Option", TAG_EL_OPERATION: "EL Operation", TAG_SECTORIZED_GROUP_ID_LIST: "Sectorized Group ID List", TAG_S1G_OPERATION: "S1G Operation", TAG_HEADER_COMPRESSION: "Header Compression", TAG_SST_OPERATION: "SST Operation", TAG_MAD: "MAD", TAG_S1G_RELAY_ACTIVATION: "S1G Relay Activation", TAG_CAG_NUMBER: "CAG Number", TAG_AP_CSN: "AP-CSN", TAG_FILS_INDICATION: "FILS Indication", TAG_DIFF_INITIAL_LINK_SETUP: "Differential Initial Link Setup", TAG_FRAGMENT: "Fragment", TAG_ELEMENT_ID_EXTENSION: "Element ID Extension", } MICROSOFT_OUI = "\x00\x50\xF2" VENDOR_SPECIFIC_WPA_ID = "\x01" def get_frame_type(frame_control): """ Returns frame type. """ return (frame_control[0] & 0b00001100) >> 2 def get_frame_subtype(frame_control): """ Returns frame subtype. """ return (frame_control[0] & 0b11110000) >> 4 def get_security(frame): """Returns the network security. The values can be OPEN, WEP, WPA or WPA2.""" cap = frame.get_capabilities() def is_wpa_ie_present(vendor_specific_ies): for oui, data in vendor_specific_ies: if oui == MICROSOFT_OUI and data[0] == VENDOR_SPECIFIC_WPA_ID: return True return False if cap & dot11.Dot11ManagementCapabilities.CAPABILITY_PRIVACY == 0: return "OPEN" else: if frame._get_element(dot11.DOT11_MANAGEMENT_ELEMENTS.RSN): return "WPA2" elif is_wpa_ie_present(frame.get_vendor_specific()): return "WPA" else: return "WEP" def get_string_mac_address_from_buffer(buff): """Returns string representation of a MAC address from a buffer.""" return ":".join('%02x' % octet for octet in buff) def get_string_mac_address_from_array(buff): """Returns string representation of a MAC address from a array.""" return ":".join('%02x' % octet for octet in buff) def get_buffer_from_string_mac_address(mac_address): """Returns buffer representation of a MAC address from a string.""" result = str() for octet in mac_address.split(":"): result += chr(int(octet, 16)) return result wig-ng-0.1/wig/helpers/network/000077500000000000000000000000001423605617300164725ustar00rootroot00000000000000wig-ng-0.1/wig/helpers/network/__init__.py000066400000000000000000000014511423605617300206040ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . #wig-ng-0.1/wig/helpers/network/interfaces.py000066400000000000000000000052271423605617300211750ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import os # SYSFS related constants SYS_CLASS_NET = "/sys/class/net/" SYS_WIRELESS = "wireless" SYS_PHY80211 = "phy80211" # IEEE 802.11 related device types ARPHRD_IEEE80211 = 801 ARPHRD_IEEE80211_RADIOTAP = 803 # LINK-LAYER HEADER TYPES # https://www.tcpdump.org/linktypes.html DLT_IEEE802_11 = 105 DLT_IEEE802_11_RADIO = 127 # Pcap Constants PCAP_SNAPLEN = 65535 PCAP_PROMISC = False PCAP_TIMEOUT = 100 # in miliseconds def get_ieee80211_network_interfaces(): """ Returns a list of IEEE 802.11 network interface names. Each of the entries in /sys/class/net/ is a symbolic link representing one of the real or virtual networking devices that are visible in the network namespace of the process that is accessing the directory. Each of these symbolic links refers to entries in the /sys/devices directory. References: - http://man7.org/linux/man-pages/man5/sysfs.5.html - https://www.kernel.org/doc/html/v4.16/admin-guide/sysfs-rules.html """ ifaces = list() for iface in os.listdir(SYS_CLASS_NET): iface_sys_path = os.path.join(SYS_CLASS_NET, iface) iface_sys_list_dir = os.listdir(iface_sys_path) if (SYS_WIRELESS in iface_sys_list_dir) and \ (SYS_PHY80211 in iface_sys_list_dir): ifaces.append(iface) return ifaces def is_monitor_mode_set(network_interface): """ Returns True if the IEEE 802.11 network interface is in monitor mode. References: - https://github.com/torvalds/linux/blob/master/include/uapi/linux/if_arp.h """ path = os.path.join(SYS_CLASS_NET, network_interface, "type") if not os.path.exists(path): raise Exception("Invalid network interface.") fd = open(path, "rb") value = int(fd.read().strip()) fd.close() if value == ARPHRD_IEEE80211 or value == ARPHRD_IEEE80211_RADIOTAP: return True return False wig-ng-0.1/wig/helpers/output/000077500000000000000000000000001423605617300163415ustar00rootroot00000000000000wig-ng-0.1/wig/helpers/output/__init__.py000066400000000000000000000014511423605617300204530ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . #wig-ng-0.1/wig/helpers/output/writer.py000066400000000000000000000023361423605617300202330ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # from collections import OrderedDict # Verbose Count OUTPUT_INFO = 0 OUTPUT_VERBOSE = 1 OUTPUT_DEBUG = 2 def get_device_information_dict(mac_address, module_name, elements): """ Function that returns an ordered dictionary with the device information. """ aux = OrderedDict() aux[""] = mac_address aux["Module"] = module_name for title, value in elements.items(): aux[title] = value return aux wig-ng-0.1/wig/helpers/p2p.py000066400000000000000000000301261423605617300160560ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import struct from collections import OrderedDict from wig.helpers import wps from wig.helpers import ieee80211 class InvalidP2PInformationElement(Exception): """Invalid P2P Information Element Exception.""" pass class P2PElements(object): """Contains all P2P data elements constants.""" ID_STATUS = 0x00 ID_MINOR_REASON_CODE = 0x01 ID_P2P_CAPABILITY = 0x02 ID_P2P_DEVICE_ID = 0x03 ID_GROUP_OWNER_INTENT = 0x04 ID_CONFIGURATION_TIMEOUT = 0x05 ID_LISTEN_CHANNEL = 0x06 ID_P2P_GROUP_BSSID = 0x07 ID_EXTENDED_LISTEN_TIMING = 0x08 ID_INTENDED_P2P_INTERFACE_ADDRESS = 0x09 ID_P2P_MANAGEABILITY = 0x0A ID_CHANNEL_LIST = 0x0B ID_NOTICE_OF_ABSENCE = 0x0C ID_P2P_DEVICE_INFO = 0x0D ID_P2P_GROUP_INFO = 0x0E ID_P2P_GROUP_ID = 0x0F ID_P2P_INTERFACE = 0x10 ID_OPERATING_CHANNEL = 0x11 ID_INVITATION_FLAGS = 0x12 ID_OUT_OF_BAND_GROUP_OWNER_NEGOTIATION_CHANNEL = 0x13 ID_UNUSED = 0x14 ID_SERVICE_HASH = 0x15 ID_SESSION_INFORMATION_DATA_INFO = 0x16 ID_CONNECTION_CAPABILITY_INFO = 0x17 ID_ADVERTISEMENT_ID_INFO = 0x18 ID_ADVERTISED_SERVICE_INFO = 0x19 ID_SESSION_ID_INFO = 0x1A ID_FEATURE_CAPABILITY = 0x1B ID_PERSISTENG_GROUP_INFO = 0x1C ID_VENDOR_SPECIFIC = 0xDD @staticmethod def get_element_key(value): """Returns string based on the value parameter.""" for p2p_item in P2PElements.__dict__.items(): k, v = p2p_item if v == value: return k.replace("_", " ").capitalize()[3:].replace("P2p", "P2P") return None class P2PDeviceCapability(object): """Contains P2P Device Capabilities constants.""" DEVICE_CAPABILITY_SERVICE_DISCOVERY = 0b00000001 DEVICE_CAPABILITY_P2P_CLIENT_DISCOVERABILITY = 0b00000010 DEVICE_CAPABILITY_CONCURRENT_OPERATION = 0b00000100 DEVICE_CAPABILITY_P2P_INFRASTRUCTURE_MANAGED = 0b00001000 DEVICE_CAPABILITY_P2P_DEVICE_LIMIT = 0b00010000 DEVICE_CAPABILITY_P2P_INVITATION_PROCEDURE = 0b00100000 @staticmethod def get_element_key(value): """Returns string based on the value parameter.""" for p2p_item in P2PDeviceCapability.__dict__.items(): k, v = p2p_item if v == value: return k.replace("_", " ").lower()[len("DEVICE_CAPABILITY_"):] return None class P2PGroupCapability(object): """Contains P2P Group Capabilities constants.""" GROUP_CAPABILITY_P2P_GROUP_OWNER = 0b00000001 GROUP_CAPABILITY_PERSISTENT_P2P_GROUP = 0b00000010 GROUP_CAPABILITY_P2P_GROUP_LIMIT = 0b00000100 GROUP_CAPABILITY_INTRA_BSS_DISTRIBUTION = 0b00001000 GROUP_CAPABILITY_CROSS_CONNECTION = 0b00010000 GROUP_CAPABILITY_PERSISTENT_RECONNECT = 0b00100000 GROUP_CAPABILITY_GROUP_FORMATION = 0b01000000 GROUP_CAPABILITY_IP_ADDRESS_ALLOCATION = 0b10000000 @staticmethod def get_element_key(value): """Returns string based on the value parameter.""" for p2p_item in P2PGroupCapability.__dict__.items(): k, v = p2p_item if v == value: return k.replace("_", " ").lower()[len("GROUP_CAPABILITY_"):] return None class P2PInformationElement(object): TLV_ID_LENGTH = 1 TLV_SIZE_LENGTH = 2 P2P_IE_SIZE_LENGTH = 1 VENDOR_SPECIFIC_IE_ID = b"\xdd" # Vendor Specific ID P2P_OUI = b"\x50\x6f\x9a" # WFA specific OUI P2P_OUI_TYPE = b"\x09" # P2P type FIXED_DATA_LENGTH = len(VENDOR_SPECIFIC_IE_ID) + P2P_IE_SIZE_LENGTH + len(P2P_OUI) + len(P2P_OUI_TYPE) def __init__(self, buff): self.buffer = buff self.buffer_length = len(buff) self.__elements__ = OrderedDict() self.__do_basic_verification__() self.__process_buffer__() def get_elements(self): """Returns a dictionary with the WPS information.""" return self.__elements__.items() def __do_basic_verification__(self): """ Verify if the buffer has the minimal length necessary, the correct OUI and OUI type. """ idx = 0 if self.buffer_length <= self.FIXED_DATA_LENGTH: raise InvalidP2PInformationElement("Invalid buffer length.") if not struct.pack("B", self.buffer[idx]) == self.VENDOR_SPECIFIC_IE_ID: raise InvalidP2PInformationElement("Invalid P2P information element id.") idx += len(self.VENDOR_SPECIFIC_IE_ID) + self.P2P_IE_SIZE_LENGTH if not self.buffer[idx:self.FIXED_DATA_LENGTH] == self.P2P_OUI + self.P2P_OUI_TYPE: raise InvalidP2PInformationElement("Invalid P2P information element id.") def __process_buffer__(self): """ Process data buffer, walkthrough all elements to verify the buffer boundaries and populate the __elements__ attribute. """ index = 0 buff = self.buffer[self.FIXED_DATA_LENGTH:] while index < len(buff): if not len(buff[index:]) >= self.TLV_ID_LENGTH + self.TLV_SIZE_LENGTH: raise InvalidP2PInformationElement("TLV invalid data.") tlv_id = struct.unpack("B", buff[index:index+self.TLV_ID_LENGTH])[0] index += self.TLV_ID_LENGTH tlv_size = struct.unpack("H", buff[index:index + self.TLV_SIZE_LENGTH])[0] index += self.TLV_SIZE_LENGTH tlv_name = P2PElements.get_element_key(tlv_id) tlv_data = buff[index:index + tlv_size] if tlv_name: if tlv_id == P2PElements.ID_P2P_CAPABILITY: self.__elements__.update(self.get_capability_attribute_string(tlv_data)) # self.__elements__[tlv_name] = self.get_capability_attribute_string(tlv_data) elif tlv_id == P2PElements.ID_P2P_DEVICE_INFO: self.__elements__.update(self.get_device_information_attribute_string(tlv_data)) # self.__elements__[tlv_name] = self.get_device_information_attribute_string(tlv_data) else: self.__elements__[tlv_name] = tlv_data index += tlv_size @staticmethod def get_capability_attribute_string(data): """Returns a string with the P2P device and group capabilities.""" result = OrderedDict() dev_cap = data[0] grp_cap = data[1] dev_cap_lst = list() grp_cap_lst = list() # Device Capabilities if bool(P2PDeviceCapability.DEVICE_CAPABILITY_SERVICE_DISCOVERY & dev_cap): aux = P2PDeviceCapability.get_element_key(P2PDeviceCapability.DEVICE_CAPABILITY_SERVICE_DISCOVERY) dev_cap_lst.append(aux) if bool(P2PDeviceCapability.DEVICE_CAPABILITY_P2P_CLIENT_DISCOVERABILITY & dev_cap): aux = P2PDeviceCapability.get_element_key( P2PDeviceCapability.DEVICE_CAPABILITY_P2P_CLIENT_DISCOVERABILITY) dev_cap_lst.append(aux) if bool(P2PDeviceCapability.DEVICE_CAPABILITY_CONCURRENT_OPERATION & dev_cap): aux = P2PDeviceCapability.get_element_key(P2PDeviceCapability.DEVICE_CAPABILITY_CONCURRENT_OPERATION) dev_cap_lst.append(aux) if bool(P2PDeviceCapability.DEVICE_CAPABILITY_P2P_INFRASTRUCTURE_MANAGED & dev_cap): aux = P2PDeviceCapability.get_element_key( P2PDeviceCapability.DEVICE_CAPABILITY_P2P_INFRASTRUCTURE_MANAGED) dev_cap_lst.append(aux) if bool(P2PDeviceCapability.DEVICE_CAPABILITY_P2P_DEVICE_LIMIT & dev_cap): aux = P2PDeviceCapability.get_element_key(P2PDeviceCapability.DEVICE_CAPABILITY_P2P_DEVICE_LIMIT) dev_cap_lst.append(aux) if bool(P2PDeviceCapability.DEVICE_CAPABILITY_P2P_INVITATION_PROCEDURE & dev_cap): aux = P2PDeviceCapability.get_element_key( P2PDeviceCapability.DEVICE_CAPABILITY_P2P_INVITATION_PROCEDURE) dev_cap_lst.append(aux) # Group Capabilities if bool(P2PGroupCapability.GROUP_CAPABILITY_P2P_GROUP_OWNER & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_P2P_GROUP_OWNER) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_PERSISTENT_P2P_GROUP & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_PERSISTENT_P2P_GROUP) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_P2P_GROUP_LIMIT & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_P2P_GROUP_LIMIT) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_INTRA_BSS_DISTRIBUTION & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_INTRA_BSS_DISTRIBUTION) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_CROSS_CONNECTION & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_CROSS_CONNECTION) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_PERSISTENT_RECONNECT & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_PERSISTENT_RECONNECT) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_GROUP_FORMATION & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_GROUP_FORMATION) grp_cap_lst.append(aux) if bool(P2PGroupCapability.GROUP_CAPABILITY_IP_ADDRESS_ALLOCATION & grp_cap): aux = P2PGroupCapability.get_element_key(P2PGroupCapability.GROUP_CAPABILITY_IP_ADDRESS_ALLOCATION) grp_cap_lst.append(aux) result['P2P Device Capabilities'] = ", ".join(dev_cap_lst) result['P2P Group Capabilities'] = ", ".join(grp_cap_lst) return result @staticmethod def get_device_information_attribute_string(data): """Returns a string with the P2P device information.""" result = OrderedDict() min_size = 21 if len(data) < min_size: return "Invalid device information attribute." offset = 0 mac_address = ieee80211.get_string_mac_address_from_buffer(data[offset:offset+6]) offset += 6 config_methods_raw = data[offset:offset+2] config_methods_str = wps.WPSInformationElement.get_config_methods_string(config_methods_raw).decode("ascii") offset += 2 primary_dev_type_raw = data[offset:offset+8] primary_dev_type_str = wps.WPSInformationElement.get_primary_device_type_string(primary_dev_type_raw).decode("ascii") offset += 8 number_secondary_dev_types = data[offset] offset += 1 # TODO: Process Secondary Device Types List for idx in range(number_secondary_dev_types): aux = data[offset:offset+8] offset += 8 offset += 2 device_name_length = struct.unpack(">H", data[offset:offset + 2])[0] offset += 2 device_name_str = data[offset:offset+device_name_length].decode("ascii") result['P2P Device Address'] = mac_address result['P2P Config Methods'] = config_methods_str result['P2P Primary Device Type'] = primary_dev_type_str result['P2P Number of Secondary Device Types'] = str(number_secondary_dev_types) result['P2P Device Name'] = device_name_str return result wig-ng-0.1/wig/helpers/radiotap.py000066400000000000000000000064571423605617300171720ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # # Radiotap helper functions. # # References: # - https://www.radiotap.org/ import struct # Structures Size VERSION_SIZE = 1 PADDING_SIZE = 1 LENGTH_SIZE = 2 PRESENT_FLAGS_SIZE = 4 MAC_TIMESTAMP_SIZE = 8 # Present Flags PF_TSFT_MASK = 0b00000000000000000000000000000001 PF_FLAGS_MASK = 0b00000000000000000000000000000010 EF_FLAGS_MASK = 0b10000000000000000000000000000000 # Extended presence masks # Flags F_FCS_AT_END_MASK = 0b00010000 # Version Constant SUPPORTED_VERSION = 0 class InvalidRadiotap(Exception): pass def get_version(buff): """ Returns header version. The version field indicates which major version of the radiotap header is in use. Currently, this is always 0. """ idx = 0 version = buff[idx] if version != SUPPORTED_VERSION: raise InvalidRadiotap("Invalid Radiotap version.") return version def get_length(buff): """ Returns header length. The len field indicates the entire length of the radiotap data, including the radiotap header. This is valuable for the developer so they can consistently locate the beginning of the 802.11 frame that follows the radiotap data, even if their parser doesn’t understand all of the data fields specified. """ idx = 2 size = LENGTH_SIZE length = struct.unpack("> 4 raise InvalidRadiotap("Invalid Radiotap Header.") wig-ng-0.1/wig/helpers/wps.py000066400000000000000000000271061423605617300161720ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import struct class InvalidWPSInformationElement(Exception): """Invalid WPS Information Element Exception.""" pass class WPSElements(object): """Contains all WPS data elements constants.""" ID_AP_CHANNEL = 0x1001 ID_ASSOCIATION_STATE = 0x1002 ID_AUTHENTICATION_TYPE = 0x1003 ID_AUTHENTICATION_TYPE_FLAGS = 0x1004 ID_AUTHENTICATOR = 0x1005 ID_CONFIG_METHODS = 0x1008 ID_CONFIGURATION_ERROR = 0x1009 ID_CONFIRMATION_URL4 = 0x100A ID_CONFIRMATION_URL6 = 0x100B ID_CONNECTION_TYPE = 0x100C ID_CONNECTION_TYPE_FLAGS = 0x100D ID_CREDENTIAL = 0x100E ID_DEVICE_NAME = 0x1011 ID_DEVICE_PASSWORD_ID = 0x1012 ID_E_HASH1 = 0x1014 ID_E_HASH2 = 0x1015 ID_E_SNONCE1 = 0x1016 ID_E_SNONCE2 = 0x1017 ID_ENCRYPTED_SETTINGS = 0x1018 ID_ENCRYPTED_TYPE = 0x100F ID_ENCRYPTED_TYPE_FLAGS = 0x1010 ID_ENROLLEE_NONCE = 0x101A ID_FEATURE_ID = 0x101B ID_IDENTITY = 0x101C ID_IDENTITY_PROOF = 0x101D ID_KEY_WRAP_AUTHENTICATOR = 0x101E ID_KEY_IDENTIFIER = 0x101F ID_MAC_ADDRESS = 0x1020 ID_MANUFACTURER = 0x1021 ID_MESSAGE_TYPE = 0x1022 ID_MODEL_NAME = 0x1023 ID_MODEL_NUMBER = 0x1024 ID_NETWORK_INDEX = 0x1026 ID_NETWORK_KEY = 0x1027 ID_NETWORK_KEY_INDEX = 0x1028 ID_NEW_DEVICE_NAME = 0x1029 ID_NEW_PASSWORD = 0x102A ID_OOB_DEVICE_PASSWORD = 0x102C ID_OS_VERSION = 0x102D ID_POWER_LEVEL = 0x102F ID_PSK_CURRENT = 0x1030 ID_PSK_MAX = 0x1031 ID_PUBLIC_KEY = 0x1032 ID_RADIO_ENABLED = 0x1033 ID_REBOOT = 0x1034 ID_REGISTRAR_CURRENT = 0x1035 ID_REGISTRAR_ESTABLISHED = 0x1036 ID_REGISTRAR_LIST = 0x1037 ID_REGISTRAR_MAX = 0x1038 ID_REGISTRAR_NONCE = 0x1039 ID_REQUEST_TYPE = 0x103A ID_RESPONSE_TYPE = 0x103B ID_RF_BANDS = 0x103C ID_R_HASH1 = 0x103D ID_R_HASH2 = 0x103E ID_R_SNONCE1 = 0x103F ID_R_SNONCE2 = 0x1040 ID_SELECT_REGISTRAR = 0x1041 ID_SERIAL_NUMBER = 0x1042 ID_WIFI_PROTECTED_SETUP_STATE = 0x1044 ID_SSID = 0x1045 ID_TOTAL_NETWORKS = 0x1046 ID_UUID_E = 0x1047 ID_UUID_R = 0x1048 ID_VENDOR_EXTENSION = 0x1049 ID_VERSION = 0x104A ID_X509_CERTIFICATE_REQUEST = 0x104B ID_X509_CERTIFICATE = 0x104C ID_EAP_IDENTITY = 0x104D ID_MESSAGE_COUNTER = 0x104E ID_PUBLIC_KEY_HASH = 0x104F ID_REKEY_KEY = 0x1050 ID_KEY_LIFETIME = 0x1051 ID_PERMITED_CONFIG_METHODS = 0x1052 ID_SELECTED_REGISTRAR_CONFIG_METHODS = 0x1053 ID_PRIMARY_DEVICE_TYPE = 0x1054 ID_SECONDARY_DEVICE_TYPE_LIST = 0x1055 ID_PORTABLE_DEVICE = 0x1056 ID_AP_SETUP_LOCKED = 0x1057 ID_APPLICATION_EXTENSION = 0x1058 ID_EAP_TYPE = 0x1059 ID_INITIALIZATION_VECTOR = 0x1060 ID_PROVIDED_AUTOMATICALLY = 0x1061 ID_8021X_ENABLED = 0x1062 ID_APP_SESSION_KEY = 0x1063 ID_WEP_TRANSMIT_KEY = 0x1064 ID_CONFIG_METHODS_SIZE = 2 ID_VERSION_SIZE = 1 ID_WIFI_PROTECTED_SETUP_STATE_SIZE = 1 ID_UUID_SIZE = 16 ID_PRIMARY_DEVICE_TYPE_SIZE = 8 @staticmethod def get_element_key(value): """Returns string based on the value parameter.""" for wps_item in WPSElements.__dict__.items(): k, v = wps_item if v == value: return k.replace("_", " ").lower()[len("ID_"):] return None class WPSConfigurationMethods(object): CONFIG_METHOD_USB = 0x0001 CONFIG_METHOD_ETHERNET = 0x0002 CONFIG_METHOD_LABEL = 0x0004 CONFIG_METHOD_DISPLAY = 0x0008 CONFIG_METHOD_EXTERNAL_NFC_TOKEN = 0x0010 CONFIG_METHOD_INTEGRATED_NFC_TOKEN = 0x0020 CONFIG_NFC_INTERFACE = 0x0040 CONFIG_METHOD_PUSH_BUTTON = 0x0080 CONFIG_METHOD_KEYPAD = 0x0100 @staticmethod def get_element_key(value): """Returns string based on the value parameter.""" for wps_item in WPSElements.__dict__.items(): k, v = wps_item if v == value: return k.replace("_", " ").lower()[len("CONFIG_METHOD_"):] return None class WPSInformationElement(object): """TODO""" TLV_ID_LENGTH = 2 TLV_SIZE_LENGTH = 2 WPS_IE_SIZE_LENGTH = 1 VENDOR_SPECIFIC_IE_ID = b"\xdd" # Vendor Specific ID WPS_OUI = b"\x00\x50\xf2" # Microsoft OUI (WiFi Alliance) WPS_OUI_TYPE = b"\x04" # WPS type FIXED_DATA_LENGTH = len(VENDOR_SPECIFIC_IE_ID) + WPS_IE_SIZE_LENGTH + len(WPS_OUI) + len(WPS_OUI_TYPE) def __init__(self, buff): self.buffer = buff self.buffer_length = len(buff) self.__elements__ = dict() self.__do_basic_verification__() self.__process_buffer__() def get_elements(self): """Returns a dictionary with the WPS information.""" return self.__elements__.items() def __do_basic_verification__(self): """ Verify if the buffer has the minimal length necessary, the correct OUI and OUI type. """ idx = 0 if self.buffer_length <= self.FIXED_DATA_LENGTH: raise InvalidWPSInformationElement("Invalid buffer length.") if not struct.pack("B", self.buffer[idx]) == self.VENDOR_SPECIFIC_IE_ID: raise InvalidWPSInformationElement("Invalid WPS information element id.") idx += len(self.VENDOR_SPECIFIC_IE_ID) + self.WPS_IE_SIZE_LENGTH if not self.buffer[idx:self.FIXED_DATA_LENGTH] == self.WPS_OUI + self.WPS_OUI_TYPE: raise InvalidWPSInformationElement("Invalid WPS information element id.") @staticmethod def get_config_methods_string(data): """Returns a string with the WPS configuration methods based on the data parameter.""" config_methods_list = list() config_method_value = struct.unpack("!H", data)[0] if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_USB: config_methods_list.append("USB") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_ETHERNET: config_methods_list.append("Ethernet") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_LABEL: config_methods_list.append("Label") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_DISPLAY: config_methods_list.append("Display") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_EXTERNAL_NFC_TOKEN: config_methods_list.append("External NFC Token") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_INTEGRATED_NFC_TOKEN: config_methods_list.append("Integrated NFC Token") if config_method_value & WPSConfigurationMethods.CONFIG_NFC_INTERFACE: config_methods_list.append("NFC Interface") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_PUSH_BUTTON: config_methods_list.append("Push Button") if config_method_value & WPSConfigurationMethods.CONFIG_METHOD_KEYPAD: config_methods_list.append("Keypad") return bytes(", ".join(config_methods_list), 'ascii') def get_version_string(self, data): """Returns a string with the WPS version based on the data parameter.""" value = "%02X" % struct.unpack("B", data)[0] return bytes("%s.%s" % (value[0], value[1]), 'ascii') def get_setup_state_string(self, data): """Returns a string with the WPS version based on the data parameter.""" value = struct.unpack("B", data)[0] if value == 1: return b"Not-Configured" elif value == 2: return b"Configured" else: return b"Invalid Value" def get_uuid_string(self, data): """Returns a string with the WPS UUID based on the data parameter.""" uuid = str() for char in data: uuid += "%02X" % char return bytes(uuid, 'ascii') @staticmethod def get_primary_device_type_string(data): """Returns a string with the WPS primary device type based on the data parameter.""" primary_device_type = str() category = struct.unpack("!H", data[:2])[0] # subcategory = struct.unpack("!H", data[6:8])[0] if category == 1: primary_device_type = b"Computer" elif category == 2: primary_device_type = b"Input Device" elif category == 3: primary_device_type = b"Printers, Scanners, Faxes and Copiers" elif category == 4: primary_device_type = b"Camera" elif category == 5: primary_device_type = b"Storage" elif category == 6: primary_device_type = b"Network Infrastructure" elif category == 7: primary_device_type = b"Displays" elif category == 8: primary_device_type = b"Multimedia Devices" elif category == 9: primary_device_type = b"Gaming Devices" elif category == 10: primary_device_type = b"Telephone" return primary_device_type def __process_buffer__(self): """ Process data buffer, walkthrough all elements to verify the buffer boundaries and populate the __elements__ attribute. """ index = 0 buff = self.buffer[self.FIXED_DATA_LENGTH:] while index < len(buff): if not len(buff[index:]) > self.TLV_ID_LENGTH + self.TLV_SIZE_LENGTH: raise InvalidWPSInformationElement("TLV invalid data.") tlv_id = struct.unpack("!H", buff[index:index + self.TLV_ID_LENGTH])[0] index += self.TLV_ID_LENGTH tlv_size = struct.unpack("!H", buff[index:index + self.TLV_SIZE_LENGTH])[0] index += self.TLV_SIZE_LENGTH tlv_name = WPSElements.get_element_key(tlv_id) tlv_data = buff[index:index + tlv_size] if tlv_name: if tlv_id == WPSElements.ID_CONFIG_METHODS and tlv_size == WPSElements.ID_CONFIG_METHODS_SIZE: self.__elements__[tlv_name] = self.get_config_methods_string(tlv_data) elif tlv_id == WPSElements.ID_VERSION and tlv_size == WPSElements.ID_VERSION_SIZE: self.__elements__[tlv_name] = self.get_version_string(tlv_data) elif tlv_id == WPSElements.ID_WIFI_PROTECTED_SETUP_STATE and \ tlv_size == WPSElements.ID_WIFI_PROTECTED_SETUP_STATE_SIZE: self.__elements__[tlv_name] = self.get_setup_state_string(tlv_data) elif (tlv_id == WPSElements.ID_UUID_E or tlv_id == WPSElements.ID_UUID_R) and \ tlv_size == WPSElements.ID_UUID_SIZE: self.__elements__[tlv_name] = self.get_uuid_string(tlv_data) elif tlv_id == WPSElements.ID_PRIMARY_DEVICE_TYPE and \ tlv_size == WPSElements.ID_PRIMARY_DEVICE_TYPE_SIZE: self.__elements__[tlv_name] = self.get_primary_device_type_string(tlv_data) else: self.__elements__[tlv_name] = tlv_data index += tlv_size wig-ng-0.1/wig/producers/000077500000000000000000000000001423605617300153455ustar00rootroot00000000000000wig-ng-0.1/wig/producers/__init__.py000066400000000000000000000014511423605617300174570ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . #wig-ng-0.1/wig/producers/base.py000066400000000000000000000145541423605617300166420ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # from multiprocessing import Event import pcapy from wig.helpers import radiotap from wig.helpers.network import interfaces from wig.helpers.Processes import WigProcess # Link-Layer Headre Types # https://www.tcpdump.org/linktypes.html DLT_IEEE802_11 = 105 DLT_IEEE802_11_RADIO = 127 # Defines the type of producer. # An example of an finite producer is a offlice capture from pcap file. # An example of an infinite producer is a live capture from a network interface. FINITE_TYPE = 0 INFINITE_TYPE = 1 class LiveNetworkCapture(WigProcess): """ Live Network Capture produccer class objective is to capture network traffic from a network interface and put it a queue. """ SNAPLEN = interfaces.PCAP_SNAPLEN PROMISC = interfaces.PCAP_PROMISC TIMEOUT = interfaces.PCAP_TIMEOUT PRODUCER_TYPE = INFINITE_TYPE def __init__(self, network_interface, frames_queue, bpf_filter=None): WigProcess.__init__(self) self.__network_interface__ = network_interface self.__frames_queue__ = frames_queue self.__filter__ = bpf_filter self.__stop__ = Event() self.__ieee80211_frame_offset__ = None self.__open_network_interface__() self.__set_datalink__() def __open_network_interface__(self): """ This method opens the network interface and sets the BPF filter. """ self.__pd__ = pcapy.open_live(self.__network_interface__, self.SNAPLEN, self.PROMISC, self.TIMEOUT) if self.__filter__: self.__pd__.setfilter(self.__filter__) def __set_datalink__(self): """ This method sets the datalink for the pcap network capture file. """ self.__datalink__ = self.__pd__.datalink() if not (self.__datalink__ == DLT_IEEE802_11 or \ self.__datalink__ == DLT_IEEE802_11_RADIO): msg = "%s is not a wireless interface." % self.__network_interface__ raise ValueError(msg) def run(self): """ This method reads frames from the pcap file descriptor and put them into the frame queue. """ self.set_process_title() while not self.__stop__.is_set(): try: _, frame = self.__pd__.next() # Ignore metadata header if frame: if self.__datalink__ == DLT_IEEE802_11_RADIO: offset = radiotap.get_length(frame) if radiotap.has_FCS(frame): frame = frame[offset:-4] else: frame = frame[offset:] self.__frames_queue__.put(frame) except radiotap.InvalidRadiotap: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() class OfflineNetworkCapture(WigProcess): """ Offline Network Capture produccer class objective is to read network traffic from a pcap file and put it a queue. """ PRODUCER_TYPE = FINITE_TYPE def __init__(self, pcap_filename, frames_queue, bpf_filter=None): WigProcess.__init__(self) self.__pcap_filename__ = pcap_filename self.__frames_queue__ = frames_queue self.__filter__ = bpf_filter self.__stop__ = Event() self.__datalink__ = None self.__open_pcap_file__() self.__set_datalink__() def __open_pcap_file__(self): """ This method opens the pcap network capture file and sets the BPF filter. """ self.__pd__ = pcapy.open_offline(self.__pcap_filename__) if self.__filter__: self.__pd__.setfilter(self.__filter__) def __set_datalink__(self): """ This method sets the datalink for the pcap network capture file. """ self.__datalink__ = self.__pd__.datalink() if not (self.__datalink__ == DLT_IEEE802_11 or \ self.__datalink__ == DLT_IEEE802_11_RADIO): msg = "%s is not a wireless interface." % self.__pcap_filename__ raise ValueError(msg) def run(self): """ This method reads frames from the pcap file descriptor and put them into the frame queue. """ self.set_process_title() while not self.__stop__.is_set(): try: _, frame = self.__pd__.next() # Ignore metadata header if frame: if self.__datalink__ == DLT_IEEE802_11_RADIO: offset = radiotap.get_length(frame) if radiotap.has_FCS(frame): frame = frame[offset:-4] else: frame = frame[offset:] self.__frames_queue__.put(frame) else: # If we receive an empty frame as a result from calling the # next method of the pcap descriptor we have reached the end # of the pcap capture file. break except radiotap.InvalidRadiotap: pass # Ignore SIGINT signal, this is handled by parent. except KeyboardInterrupt: pass def shutdown(self): """ This method sets the __stop__ event to stop the process. """ self.__stop__.set() wig-ng-0.1/wig/wig-ng.py000066400000000000000000000240371423605617300151070ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # wig-ng - Wireless Information Gathering New Generation # Copyright (C) 2022 - Andrés Blanco (6e726d) <6e726d@gmail.com> # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import os import time import argparse from multiprocessing import Queue, Array, TimeoutError from multiprocessing import Array as mpArray from wig.consumers.base import Mediator from wig.consumers.base import FrameInjectionManager from wig.consumers.base import OutputManager from wig.producers.base import LiveNetworkCapture from wig.producers.base import OfflineNetworkCapture from wig.helpers.network import interfaces from wig.helpers.output import writer import pcapy APP_NAME = "Wig-ng" VERSION_MAJOR = 0 VERSION_MINOR = 1 DESCRIPTION = "" # TODO: Add application description SUPPORTED_EXTENSIONS = ["cap", "pcap"] def check_input_network_interfaces(interfaces_list): """ Check if interfaces support IEEE 802.11 and are on monitor mode. """ for interface in interfaces_list: if interface not in interfaces.get_ieee80211_network_interfaces(): print("Error: %s is not a valid IEEE 802.11 interface." % interface) raise Exception("Network Interface Error.") if not interfaces.is_monitor_mode_set(interface): print("Error: %s is not on monitor mode." % interface) raise Exception("Network Interface Error.") def check_input_pcap_capture_files(files_list): """ Check if pcap capture files exist and are valid for the application. """ for file in files_list: if not os.path.exists(file): print("Error: %s does not exists." % file) raise Exception("PCAP Capture File Error.") if not os.path.isfile(file): print("Error: %s is not a file." % file) raise Exception("PCAP Capture File Error.") pd = pcapy.open_offline(file) datalink = pd.datalink() if datalink not in [interfaces.DLT_IEEE802_11, interfaces.DLT_IEEE802_11_RADIO]: print("Error: %s is not a valid IEEE 802.11 network capture file." % file) raise Exception("PCAP Capture File Error.") def doit_pcap_files(files_list, concurrent_files, verbose_level): """ TODO: Add documentation. """ try: frame_queue = Queue() output_queue = Queue() output_manager = OutputManager(output_queue) output_manager.start() mediator = Mediator(frame_queue, output_queue, OfflineNetworkCapture.PRODUCER_TYPE) producers_list = list() while files_list: _file = files_list[0] if len(producers_list) < concurrent_files: producer = OfflineNetworkCapture(_file, frame_queue) if verbose_level > writer.OUTPUT_INFO: output_queue.put({'': 'Producer: %s - %s' % (producer, _file)}) producers_list.append(producer) producer.start() files_list.remove(_file) # Start mediator as soon as we have one or more producers if not mediator.is_alive(): mediator.start() for producer in producers_list: if not producer.is_alive(): output_queue.put({'': 'Producer: %s has finished.' % producer}) producers_list.remove(producer) # To avoid 100% CPU usage time.sleep(1) # We started all producers, we can flag the timeout event. mediator.timeout_event() while True: if not producers_list: output_queue.put({'': 'All producers ended.'}) break for producer in producers_list: if not producer.is_alive(): output_queue.put({'': '%s finished.' % producer}) producers_list.remove(producer) time.sleep(1) # Wait for Output Manager while True: if output_manager.is_alive() and output_queue.empty(): output_manager.shutdown() output_manager.join() break time.sleep(1) if mediator.is_alive(): # Give mediator 15 minutes to join. mediator.join(60 * 15) if mediator.is_alive(): mediator.terminate() except KeyboardInterrupt: print("\nCaugth Ctrl+C...") # Graceful shutdown on all producers and consumers. for producer in producers_list: print("\nStoping %s" % producer) producer.shutdown() producer.join(10) producer.terminate() mediator.shutdown() mediator.join(10) mediator.terminate() # Wait for Output Manager while True: if output_manager.is_alive() and output_queue.empty(): output_manager.shutdown() output_manager.join() break time.sleep(1) def doit_live_capture(interfaces_list, verbose_level, active_mode): """ TODO: Add documentation. """ try: frame_queue = Queue() output_queue = Queue() injection_queue = Queue() output_manager = OutputManager(output_queue) output_manager.start() frame_injection_manager = FrameInjectionManager(injection_queue, interfaces_list) frame_injection_manager.start() producers_list = list() for interface in interfaces_list: producer = LiveNetworkCapture(interface, frame_queue, bpf_filter="type mgt") if verbose_level > writer.OUTPUT_INFO: output_queue.put({'': 'Producer: %s - %s' % (producer, interface)}) producers_list.append(producer) producer.start() if active_mode: mediator = Mediator(frame_queue, output_queue, LiveNetworkCapture.PRODUCER_TYPE, injection_queue) else: mediator = Mediator(frame_queue, output_queue, LiveNetworkCapture.PRODUCER_TYPE) mediator.start() for producer in producers_list: if verbose_level > writer.OUTPUT_INFO: output_queue.put({'': 'Waiting for producer %s...' % producer}) producer.join() mediator.shutdown() except KeyboardInterrupt: print("\nCaugth Ctrl+C...\n") # Graceful shutdown on all producers and consumers. for producer in producers_list: producer.shutdown() producer.join(30) if producer.is_alive(): producer.terminate() print("Waiting for mediator...") mediator.shutdown() mediator.join(90) mediator.terminate() # Wait for Output Manager while True: if output_manager.is_alive() and output_queue.empty(): output_manager.shutdown() output_manager.join() break time.sleep(1) frame_injection_manager.terminate() class PcapCatureDir(argparse.Action): """ ArgParse Action that checks for a valid directory containing at leats one pcap capture file. """ def __call__(self, parser, namespace, values, option_string=None): _dir = values if not os.path.isdir(_dir): parser.error("%s is not a valid path" % _dir) if os.access(_dir, os.R_OK): setattr(namespace, self.dest, _dir) else: parser.error("Error: %s is not a readable dir" % _dir) has_pcap_files = False _files = list() for (root, _, files) in os.walk(_dir): for filename in files: extension = filename.split(".")[-1] if extension in SUPPORTED_EXTENSIONS: has_pcap_files = True _files.append(os.path.join(root, filename)) if not has_pcap_files: parser.error("Error: %s doesn't contain pcap files." % _dir) else: setattr(namespace, self.dest, _files) if __name__ == "__main__": parser = argparse.ArgumentParser(description=DESCRIPTION) parser.add_argument('-v', '--verbose', dest='verbose_level', action='count', default=0, help='Output verbosity (incremental).') parser.add_argument('-c', '--concurrent', type=int, default=4, metavar='count', help='Number of PCAP capture files to process simultaneously.') parser.add_argument('-a', '--active', action="store_true", help='Some modules can perform frame injection, this is define by setting the active mode.') group = parser.add_mutually_exclusive_group(required=True) group.add_argument('-i', '--interface', action='append', metavar='network interface', help='IEEE 802.11 network interface on monitor mode.') group.add_argument('-r', action='append', metavar='pcap file', help='PCAP capture file with IEEE 802.11 network traffic.') group.add_argument('-R', action=PcapCatureDir, metavar='pcap directory', help='Directory with PCAP capture files.') args = parser.parse_args() if args.interface: check_input_network_interfaces(args.interface) doit_live_capture(args.interface, args.verbose_level, args.active) if args.r: check_input_pcap_capture_files(args.r) doit_pcap_files(args.r, args.concurrent, args.verbose_level) if args.R: check_input_pcap_capture_files(args.R) doit_pcap_files(args.R, args.concurrent, args.verbose_level)