Mobile Hacking/Wardriving General

Seen a lot of discussion about defensive phone security and opsec, but not whole lot about the offensive side of things which are now accessible to almost anyone through tools like TermuX and NetHunter. Be it fancy new android phones, passenger seat laptops with high-range antennas, or anything in between; seems worth it to have a place to discuss hardware, tools, and techniques for lains on the go.

>>16678 I like the idea of this thread. How are you liking the Alfa cards on Android? I love my new dual band card, but I've never messed with it on mobile.

>>16679 They've always been my go-to for a mobile rig. Recently I've found going for walks while listening to music with my phone and card in my pocket mapping out areas around my neighborhood to be a fun cure for cabin fever.

This is my carry on stuff. That was the only usb dongle that i could get with a dual band chipset supported by my phone. it drains the battery a lot tho. But for getting handshakes is cool

Is there a derp-level intro to this sorta thing? Follow on question directly inspired by the phoneSec thread: Pixel 4 series with GrapheneOS or is there a respectable pentest OS that y'all would recommend? I only know that I know far too little. Following to the follow on: Hardware and peripheral recommendation for RasPi or the beefy new Aeaons?

>>16678 Absolutely newf4g to this, I mostly use free café WiFi or walk along the streets to catch some open WiFi networks. Though most people have wpa2 these days, so it's all locked down. Is it possible to get into a password secured network without password or brute forcing?

>>16683 What is name of the wifi adapter you use? Did you install nethunter from magisk or manualy? What ROM + Kernel you use?

>>16678 if you want range put a yagi antenna on the radial antenna. Turns it into a directional antenna that has much longer range in said direction. With 2 yagis on both sides you can even bridge 2km with 2.5ghz wlan. More to your original intent there's a online db of wlans mapped in the cities. Saw it once but wasnt interested so didnt save but knowing it exists means you can look for it and find it.

What os do you guys use for mobile phones? Did you root em or install some bootloader? Also how hard is it to hack the wifi stuff itself and maybe use external usb wifi stick?

>>16714 >TP-link archer t2u (i couldn't get one with an external antenna on that chipset, but i can't really complain) >Havoc OS 3.12, no gapps + https://github.com/Team-420/Ginkgo (i don't really like android 10 so much tho, but between miui and havoc, havoc just works better) >I installed nethunter like 2 or 3 times, first was just the full zip flashed with TWRP >last time I just flashed the chroot then downloaded the minimal tar on the app. (this is the easiest way)

>>16697 no. wps pin attacks don't work anymore since a few years. nowadays is all about getting handshakes and crackng hashes, rogue acces points and maybe som password phishing

>>16697 your stuck with brute forcing, but it doesn't take long to grab a handshake and most people don't have a strong password for their wifi so it doesn't usually take long.

>>16683 What USB wifi transceiver is that?

>>16687 Learn how stuff works before buying a soykafload of hardware and choosing a "respectable pentesting os" you pathetic cringelord

>>16754 Thank God for tripcode-heros. I was worried my questions would just get buried. I hadn't really thought about using the "never ask questions and never participate" approach. But there does seem to be an elegance in what you say. By not using this thread, board or Chain; I could gain far more "street cred" by not learning from (read: mooching off of) LainOns and just guess my way into a passable grasp of this new generation of Phreaking. Thank you, Hero. After I spend the next several weeks reading wikipedia and HackForum posts, I'm gonna be the best Decker on the 'net! -Steve B. Fremont, Nebraska Via Android

>>16722 >>16723 thanks for the replies. I'm not too talented with the code side of things, but >rogue access points sound like a lot of fun, especially since i'm getting into electronics recently, and installing a physical access point to a network sounds like a really great training for hands-on work.

LOL I find this thread after messing with nethunter for the last 3 days I got a stable system with lineage14 on nexus 5 (last official update, some build from 2019), installed magisk, flashed nethunter in twrp and granted permissons in the app. I couldn't get the internal wifi card to switch to monitor mode, so I'm waiting for a AWUS036NEH in the mail. You can also run rubber ducky scripts and other usb stuff

https://www.kali.org/docs/nethunter/ for those who asked for a derp intro

>>16868 I never owned one, but I'm pretty sure you have to install nexmon firmware. Also, why didn't you used the nethunter nexus 5 rom offered by offensive security?

>>16871 Idk I just followed the docs, I tried a nethunteros rom linked in a guide but it was really old. The nexmon app keeps crashing

>>16678 I use a raspberry pi with a usb battery and usb gps for wardriving. Wardriving is not illegal but the soykaf that comes after is. I think people who use smart phones for wardriving are either idiots for doing illegal soykaf on a google tracking device or larps for just collecting wifi networks and not doing anything with them. >>16722 >wps pin attacks don't work anymore since a few years. Not everyone has switched ISPs and got a shiny new router in that time. In my experience is takes days to get through all the pins though because of rate limiting. So it only really works if the target is within range of your house/car or you can hide a dropbox somewhere.

I'm really curious about more physical and tangible things we now interact with on a daily basis when it comes to the offensive positions. For example tap systems prevalent in most metro systems now globally or getting access to the now endless stream of rideshare bikes or scooters. I'd imagine there isnt much security involved in these but any thoughts about how these could be manipulated to your favor?

>>16929 not everyone use google's framework on his phones, and btw the raspberry it's not even that secure. Also i don't really think anyone gives a soykaf about cracking some password or getting a handshake from your neighborhood, but it's true that if you want to do some illegal soykaf, you should know at least how to hide yourself.

>>16970 >not everyone use google's framework on his phones, and btw the raspberry it's not even that secure. It doesn't have a long range radio broadcasting your location to every cell tower in range and closed source baseband firmware accepting arbitrary commands and linked directly to the application processor memory. So there's that. >Also i don't really think anyone gives a soykaf... Denial is not a substitute for opsec. >>16967 >tap systems prevalent in most metro systems Lookup mifare and go from there.

>>16678 Can someone give me a quick rundown on using an external network adapter such as the Alfa in OP's picrel from your phone? >I have a Pixel 3A and it's rooted with Magisk modified boot image. >I don't want to flash a custom ROM for it yet, unless I have to in order to do this >Hardware built in NIC does not want to go into promi mode (I made a thread here a while back discussing the reasons why, TLDR SoftMAC vs FullMAC) From reading online I've learned that NetHunter is great for such things, but what if I didn't want to install NetHunter? What do I have to do from the software side to make the hardware work?

>>16976 >What do I have to do from the software side to make the hardware work? It sounds like the kernel driver is missing. You may be able to compile a custom kernel with the Alfa driver included. https://developer.sony.com/develop/open-devices/guides/kernel-compilation-guides/how-to-build-and-flash-a-linux-kernel-for-aosp-supported-devices But it's a lot of work and could leave you with less features. In my experience for example Sony phones with aosp can't use the camera. If there is a nethunter rom for your device then that will definitely be the path of least resistance.

>>16976 derp I didn't realize you posted which phone https://source.android.com/setup/build/building-kernels

>>16977 >kernel with driver OK, I'm a noob so I'm going to start saying words. I don't know if they're right, so correct me if I'm wrong. Android (Linux) kernel is monolithic and thus has device drivers inside of it. The phone's kernel is modified, though. Each one's is kind of custom. However, in theory anything that can run on arm64 should be able to run on my phone, so long as the binaries to interact with the hardware are provided, correct?

>>16678 >Android (Linux) kernel is monolithic and thus has device drivers inside of it. Yes, the device drivers are part of the kernel. >The phone's kernel is modified, though. Each one's is kind of custom. This is actually an ARM thing. Every kernel needs to be configured for exactly the hardware it will run on so it knows how to initilize everything properly. That's why there is a different ROM for each phone. The reason the same Linux ISO will run on any PC is because your PC motherboard has some code on it (BIOS or UEFI) which takes care of that hardware initialization stuff. >in theory anything that can run on arm64 should be able to run on my phone, so long as the binaries to interact with the hardware are provided, correct? Yes but software can also be dependent on other software. Touhou.exe won't run on Linux even though it is Intel machine code running on an Intel CPU. Operating systems are split into kernel space and user space. Kernel space takes care of the hardware and user space is all the hardware independent applications. Firefox doesn't care if you are running on Intel or ARM or something else. The job of the kernel is the make everything look the same to the user space. In this case you want to run kismet or airodump or something to capture wifi networks. Kismet is a user space program so it doesn't care what CPU you use or what network card either. It can be Alfa or Atheros or Broadcom or whatever. Hardware is the kernel's job. You said that you plug in the Alfa and you can't use it. That means the kernel doesn't know how to talk to it. You need a kernel with the Alfa driver built in. You can build your own kernel following Google's instructions. Or you can get a ROM with the right drivers already included. (The second option is a much better use of your time).

>>16980 >The reason the same Linux ISO will run on any PC is because your PC motherboard has some code on it (BIOS or UEFI) which takes care of that hardware initialization stuff. So, phones don't really have a UEFI equivalent, because each is proprietary to the manufacturer? I've heard this before somewhere... > Or you can get a ROM with the right drivers already included Like NetHunter? How would I find something like this?

>>16980 Unless NetHunter comes with all required drivers (will it?) then I don't know what ROM to flash onto my phone. If I do build a custom kernel, would it be as easy as taking the ordinary one and adding network interface drivers for my CPU type to it? Or is it hardware specific to the OEM?

>>16982 >So, phones don't really have a UEFI equivalent That's right. Intel and AMD spent a lot of effort to make all their CPUs compatible with each other. So it's not a big deal for motherboard vendors to write UEFI code. ARM works differently, they make the basic design for the CPU but then someone else (like Samsung, Qualcomm, etc.) buy the designs and make changes for their specific product. So when you think about it it makes no sense for Qualcomm to write a BIOS to make sure software that Samsung wrote will work on Qualcomm phones. Each vendor is king of their own product. >Like NetHunter? How would I find something like this? NetHunter is here. I don't know any other ROMs that might work. https://www.kali.org/get-kali/#kali-mobile

>>16983 >will it The whole point of Kali Linux and NetHunter is to do the stuff in this thread so I'm pretty sure it will. >If I do build a custom kernel, would it be as easy as taking the ordinary one and adding network interface drivers for my CPU type to it? The android.com link has instructions. You do the repo command to get the kernel source code and then `make menuconfig` to get a menu of all the options. Find everything with alfa in the name and enable it. Then continue with the instructions to turn the source code into machine code.

>>16683 >That was the only usb dongle that i could get with a dual band chipset supported by my phone I call bullshit. You didn't try them all. Did you ever go so far as to compile a kernel with the drivers you want? Is that NIC the only one confirmed working for your model for real?

Hey, since this thread already went into this direction, let me just ask this question: Is there a way to unlock the bootloader on xiaomi redmi phones without registering a mi account? I haven't found anything so far, so I'm kinda losing hope. I really want to defeat Chang, but lack the experience to dig through the programming. Has anyone already done this?

>>16760 What he means is you're probably too much of a noob to be messing with this soykaf. You say "respectable pentesting OS" and that's the giveaway that you're a noob. You don't understand kernel customization so you really should dig around more and ask some better questions.

>>17057 Get temp root via exploit anon

>>17056 oh man, i hate when ppl talk sht and have no idea. My internal chipset can go into monitor mode (Some Qualcomm devices have a security flaw that allows them to do that https://github.com/kimocoder/qualcomm_android_monitor_mode ) but it can't do packet injections, therefore i looked for dual band usb dongles, and the only chipset i could get, that was already supported in that kernel was >rtl8812au , and the only usb i could get in my country with that chipset was that tp-link, i can't buy an alfa here, and the size was cool to get handshakes on the go. The another one i have is a rtl8821cu that i use with an external antenna in my raspberry. I compiled my kernel adding that driver but didn't really workout, because is pretty much maintained by 1 person, and it's a mix of other realtek drivers and certainly no optimized to work in android, unlike the rtl8812au driver that it's maintained by aircrack. i also use a long range ralink 2800, for 2.4ghz only and cheap dongles with MT7601u works out of the box too, i also had one but i broke it. in other response i linked the kernel that i was using and the source, you can check all the chipsets that works in that kernel without adding them by yourself. >>16721

>>17069 >unlike the rtl8812au driver that it's maintained by aircrack I should get a NIC for my phone whose drivers are maintained by aircrack.

>>17074 them are pretty easy to add in a kernel for your phone if you have the source. But aircrack only maintain the >rtl8812au >rtl8814au >rtl8818eus However there are no problems when compiling those drivers in kernel and they do the job. >https://gitlab.com/kalilinux/nethunter/build-scripts/kali-nethunter-project/-/wikis/Modifying-the-Kernel

>>17078 Your link is a 404, otherwise I'll try out your advice to see if it works

>>16678 Just wanted to post a bit of an update >go to pawn shop yesterday >buy cheap stealthy dual band wifi chip >Don't even know if it's got injection mode >I don't even know if this thing has a brand >Mini CD includes drivers, setup, impressive documentation >Drivers for Windows Mac and Linux >Linux Drivers built up to Android 8 >Tried running Install.sh on my Linux Mint >Compile failure, kernell error code 2 ... So now I'm here. The key word here is drivers.

What about warflying? I've had a cheap Chinese wifi drone kicking around (WLRC KK5), and I'm wondering if I can turn use it to obtain RAPs from the comfort of home.

>>17278 Arent they like 30min flying max? Gonna be some mission impossible soykaf flying with a dead timer.

>>16697 I'm kind of new to this also, but from what I've learned brute forcing and dictionary attacks aren't really an option anymore. Anything past 8 characters will take years to crack, and the majority of passwords aren't in the dictionaries. To illustrate this download the biggest dictionary you can find and grep it for your own wifi password. I bet it's not in there.

>>17160 search for the chipset, usually the drivers that come in with the dongle aren't very good, but are usable for other people to hack around and get patches, your best is to search a linux driver for that specific chipset on github. >>17319 This is very true, dictionary attacks are joke nowadays especially if you use whatever dictionary you find online. The only serious tool to do some powerful cracking is hashcat, but even with hashcat you have to guess or have luck for type of default passwords and so on. Dictionary attacks now are only useful if you know part of the password, like you know it's a birthday or a name and you don't know the random numbers after that. The best way till this day to obtain a wifi password is to have physical acces to the router and use a wps push button.

>>17342 >>17319 >anons think Dictionary Attacks are obsolete and useless because they fail to crack things >Hashcat is not the only good utility, there is also John the ripper and others >Part of the GPU explosion had to do with GPUs being powerful password crackers. Anyone who thinks their hardware is too weak should setup a cracking rig with several GPUs. If you haven't done so, you have no right to talk about viability of cracking handshakes. >Password length doesn't really matter in a dictionary attack, even with mutation, because it relies on probability that the password is in or around the dictionary. >You lainons are probably unironically using rockyou.txt even though it has a mountain of garbage in it that no one's cleaned out. Yes, I'm saying your dicts are soykaf, and you should consider either making one or minding where you download them, and which ones you get. Also, grep your dicts. >If you don't want to build a mining/cracking rig, you can borrow horsepower from cloud providers >Constraints put on the password just make brute forcing that much easier Cracking is only useless if your opponent has a strong non-dictionary guessable password. Why do you expect to take a wordlist off the internet and expect to capture more than like 0.5% of passwords with it in the real world?

>>17358 According to my calculations a linode server with 4 RTX6000 gpus running 24/7 would take around 400 days to crack a 9 character password using brute force. >Why do you expect to take a wordlist off the internet and expect to capture more than like 0.5% of passwords with it in the real world? I don't, that's my point.

>>17365 A buddy of mine did a talk on password cracking methodology. I can't remember which conference he was speaking at, but if you're bruteforcing after 2005 you're doing it wrong. Not saying you specifically, just in general. Any sufficiently large wordlist with a robust ruleset will do the trick for most passwords out there as long as we're talking about using hashcat. Also, I'm sure everyone's already aware, but the mean time to recovery highly depends on the algorithm as well. NTLM/NTLMv2/etc are computationally easier than some soykaf like blake. LM and md5 should just be "use this rainbow table" at this point lol. I had one kerb ticket that was an absolute bitch and didn't crack after a few runs over a week and a half. Not uncommon for those to run for days, sometimes not even being recovered.

>>17358 Because I have experience successfully doing exactly that with a file full of NetNTLMv2 hashes? Yes, I make and curate my own wordlists. Idk man, I'm hedging my bets on other things before bruteforcing. >JTR I have had like one instance where I used JTR over hashcat. >If you don't want to build a mining/cracking rig, you can borrow horsepower from cloud providers 100% >Grep your dicts 100% I hear you though, you can't just plug and play rockyou and deadone.

>>17342 have you ever worked in a IT department? There is almost always about 3 users with SeasonYear as there password

>>17358 rockyou (and almost any dict on internet) is pointless for me, because i'm a non-english speaker, so for passwords that aren't only numbers i must make my own dicts. The thing is, aircrack is too slow and doesn't do combination, i don't know what's the state of john the ripper, last time i used it was like 7 years ago. I don't have a full gpu cracking rig, it's a bit pricey for now. But, i have a rx5600 and a ryen 7 4000, and can use both on hashcat under open cl, so i got covered number combinantions, at least for 8 digits, and some default combinations with letters + numbers. Seriously is all win, you can make dictionary attacks useful and faster with hashcat.

>>17368 At least. I can testify to this. I mean, brute forces don't work against most things anymore. Even WPA2 is going to be replaced by WPA3 soon so that offline bruteforce won't work. Actually, it will if you capture the handshake via derandomization, but it's going to be harder and require you to understand modp group encryption or elliptic curve encryption. However, I've worked in so many places where some supervisor's password is password1 or something equally retarded... God, how tempting. It was like staring into temptation, because the insecure password beloned to this autist who I didn't really like. I chose not to fuarrrk with him or anything, using great force of will. I haven't done any blackhat soykaf ever, but man it could have been so easy...

How usable cracking wifi passwords with mid range smartphones is? To achive that, you need to compile kernel with drivers for wifi dongle, use Kali App and what else? What haveyou done with those setups of yours?

>>16678 Fellow lainons, I'm going to share some research, questions, and concerns with you about this slightly glowing topic. Please be aware that I am a mere amateur compared to many of you. Also as a disclaimer I never do anything evil when I "hack", it's all for research and defense purposes. The worst cybercrime I'm guilty of is piracy and maybe scanning a network I didn't have permission to. >On deauthentication attacks This topic glows. I made the mistake of posting about it with my actual identity. That's why I'm on TOR now. It's very fun to abuse the WPA2 lack of forward security, and the general lack of public awareness makes this tactic highly effective at completely pwning a network. I bet glowies already know me because I like to post negative things about our overlords, and also I used to work for them. Anyway, as of a little while ago, I've decided to start using TOR for my research on hacking topics. >What hardware do I have? I'm not listing my exact hardware, but I haven't used any fancy antennas. I have a rooted Android phone, a rooted Android tablet (essentially phone without 4G chip or baseband) , and a laptop running a popular Debian-based GNU/Linux distro. Each device is unique in the wardriving environment. Each is an ordinary civilian device, unlike an antenna: >Phone "Full botnet connection, a favorite among the sheep" softMAC, enforced by firmware and hardware. 4G/5G + GPS + E911/Baseband + Wifi + Bluetooth radio. Spies on you at the firmware level and to a lesser extent the hardware level. Hardware encryption can be broken by OEM. Poorly suited for wardriving. Unrooted Android may be used for passive scanning with eg. Wifi Analyzer by VREM FOSS no-ad app. Additional wardriving functionality, such as promi mode, may be unlocked through root. Please note that just having root isn't good enough here-- you'll need to either hack your firmware or connect an external WiFi adapter. Doing this is very difficult, as this thread shows. >Tablet "Sleek, discrete, functional. The generalist's choice." The tablet usually doesn't have as much botnet connectivity as the cell phone. The firmware still phones home to Google, with WiFi SSID's around you. The tablet may actually be taken completely offline, unlike the phone. Same restriction as phones as far as softMAC. More battery than a phone allows longer use of the WiFi antenna. Because tablets lack GPS, they are not well suited for wardriving at all-- even less so than phones. The most you can use your unrooted tablet for is locating the physical location of an access point. >Laptop "As useful as you make it" Wardriving can be done on Linux, Windows, and probably even Mac and ChromeOS. I recommend a Librebooted Kali Thinkpad, but I don't own one. Just make sure your NIC supports promi and allows you to use 2.4Ghz and 5Ghz bands. The rest is just technical knowledge of the terminal. The laptop is by far the best tool for this due to the control you get over your hardware. >You should get an SDR, anon! Yes, and combine it with GNU radio. Rome wasn't built in a day.

>>17425 >mid range smartphones I'm going to bully you a bit. If you think the cost or "prestige" of your phone has anything to do with this thread's topic, you're pretty clueless. The only thing it might affect is how far your phone could "sense" soykaf in theory, but if you're trying to use a WiFi antenna on it then who cares? >Which phones work? Actually if you read the thread closely you'll get your answer. TLDR any phone you can compile a custom kernel on, as long as the proper kernel drivers are available. This depends on the antenna too, as your built in antenna is softMAC. I shall not elaborate more. >Cracking wifi passwords with mid range smartphones? There's 2 main possibilities here: your English is Indian-tier awful, or you're some dumb drunk skiddie. Either way, you really are dumb as a rock, aren't you? If you meant what you typed, then how much cracking power do you think a low voltage ARM chip has? It doesn't exactly have a GPU either, if you know what I mean. If you don't understand what I just said, you should try learning to hack from a computer first before hopping on Android. The second possibility is more likely. "Mid range smartphone". Kek. Dumb question, really. >Use Kali app You don't need the Kali app, you just need the device drivers and the wardriving software. Kali NetHunter is just a super convenient thing because it has drivers preinstalled for it. Beware that if you do get NetHunter, then you'll need a wifi chip which works with NetHunter. Also beware of bricking your device, be sure to have a backup plan such as a TWRP image backup, and a backup plan to the backup plan. I mean, fastboot and stock firmware. If you can't use fastboot, don't try this. >What have you done with these setups of yours? The only effective ones I can build seem to all use a laptop to be truthful. This cell phone soykaf is interesting but stupid too because it's like trying to paint while wearing a straightjacket. Yes, cell phones offer stealth, but that's why you have so little control over them. It's not intended to be weaponized like this. Actually, it's intended NOT to. Oh, and also everything is being upgraded to WPA3 so you skiddies won't just be able to abuse WPA2 as easily. >>17662 I forgot to mention a very important piece of hardware that hackers often use for wardriving... >The Pi The best of both worlds, of a tablet and a computer. Full hardware customization, with an ARM processor. Combine a Pi with an adapter, a software defined radio, or another antenna, and you have yourself a wardriving setup. Only, it's not exactly subtle. At all. Fits in a backpack easily though. This is the best overall option for those who want to wardrive.

>>OP what did you say, w*gger?

>deauthentication attacks do w*ggers really? did 2003 call?

>>16678 Been doing independent research on this for a while, with a lot of it from lain. I wish I had a place to upload my lab notes, but they contain records of potentially incriminating activity, as well as details of hardware that I was using and still am. >"For scieeeeence!" >The mobile Wardriving topic intersects with Android rooting and thus Linux systems, as well as 802.11 security and RF, causing the library of notes on this topic that I have created to be quite vast. My research describes everything from finding the hardware to rooting the Android arm hardware, as well as performing the same wardriving techniques on a laptop too see the difference. >As of this moment, I have been unable to attach a network card to my phone besides the one I already have built in. This thread has given me that idea, and now it is my goal to add it to my research. >Yes, a lot of my research is sourced from this website, other chans, and the internet >Much of it, I have forgotten to cite and must probably go back to do so before publishing >If I published it, it would be anonymously >How should I do so? It's several PDF's of documentation for you skiddies. It contains important summarization and code fragments which you can actually use Here are some excerpts from my research: >The Android filesystem doesn't end at the top of the file manager, unless the file manager is granted root access. There is a way to hack this by using adb + tab autocomplete trick >Android phones have manufacturer specific BIOS, Google-controlled firmware, and hardware limitations which all want to prevent a hacker from using their phone in any way they weren't supposed to. It is unclear if this is done with caution, malice, or simply for the sake of simplicity to the sheep. A sheep wouldn't access any parts of their phone like that, so the decision is clearly done by the manufacturer with no small amount of malice and caution. At every step of an endeavor such as wardriving, expect both the hardware and the firmware to block you. >In order to change the firmware of your Android device, you must have the bootloader unlocked. Unlocking a bootloader is different from getting root (su) access to the device. The bootloader of an ordinary market phone is a black box which is controlled by the manufacturer. It is often used to prevent the user from getting access to restricted partitions and the top of the Linux filesystem >With that said, reversing firmware (specifically the wireless radio drivers) might allow a genius to enable monitor/promi mode on their built NIC. You may have to build it all from the ground up though. >Manufacturers usually don't like giving out their firmware, or even information about firmware/hardware. LineageOS is AOSP, which is Android minus Google blobs. Expect more limited functionality with no Google services on your device. You have to set it up yourself at that point. No Maps, no JewTube (by default), no Gmail or Play Store. No Google telemetry or WiFi/BT triangulation either, though. Weigh the pros and cons before continuing this lab. >On the topic of risk, you risk permabricking your Android device. It is required that you be a master of the fastboot and adb tools before proceeding. Get a copy of your stock firmware in order to prevent permabrick. Equally important with temp-root and with permaroot. >A different lainthread has informed me about GSM engineering mode, which can apparently be used to control communication with cellular towers. Makes your cell phone much harder to trace in theory, even to glowie glitterboys. I find his approach quite impractical, though. It is easier to build your own phone at that point, because to unlock GSM Engineer mode you have to find the hidden app and maybe reverse engineer code on your Android. They weren't very clear about how exactly they'd do it, except on very old Android versions. >Android Phones are usually SoftMAC and not FullMAC which means low level control of the MAC is not granted to the user except through the software. Basically, GNU macchanger doesn't work. Since a hacker would want to change their MAC at will, >A network may easily be scanned using an Android. Utilities such as Fing Network Scanner and nmap work. When I tried to use nmap -sN on my phone, using Termux it said I need root privileges. Use pkg install nmap to install nmap on Termux.

>>17673 >>17674 Actually, you're retarded you son of a bitch. >2003 >not using pixie dust

>>16678 It can't be that there is still no one-click software that scans for networks, compares MAC addresses and vendor SSID names with list of pwned router models and Bluetooth devices, lists all possible exploits, then tries to apply them in succession. That including cbruteforce of known vendor password combinations, like for example some ISPs have 8 character all caps alphanumeric passes which are fast to brute force on modern GPU. Come on, it's current year already, I don't have to type all that command line video terminal soykaf like in the 70's. Damn, in 2013 all you had to do to pwn someone on wireless network is to download DroidSheep on literally any Android smartphone, go to local McDolans and sniff-sniff-sniff all their facebook and myspace cookies, hijack the session right there or come home and post fun soykaf impersonating clueless people. That's far as my knowledge of war-jacking goes.

>>17776 there are apps that easily provides you pwned routers and generates the known auto-generated passphrases based on the MAC, there's also ones for WPS pin. I think they were available on android but if you have the passphrase generation algo you can just make one yourself. >>17774 just look for phones with available and open sourced kernel/device tree, that way you can use custom/modified kernels or mainline kernels 4.x+ or 5.x+ with the needed firmware however I have zero experience making these as I might brick my phones and most of my phones are broken anyways >GSM Engineer mode engineer mode is almost available on any mediatek phone, if the app is not there you can just import the same apk from another mediatek phone into system app folders and it would still work since you probably have the same kernel and libraries and should target the same stuff but this is never needed to be done as I've yet to see any manufacturer remove such apps. however the chance of getting a twrp+rooted mediatek is VERY low since they rarely open source their stuff. there is a "mediatek android developers" github account which has few phones but that's about all I know about rootable mediatek. I think mediatek is much cleaner than the scourge that is snapdragon, snapdragon is well known for system apps uploading and downloading several GBs for absolutely no reason at all which I've confirmed to happen many times, but I don't know if it's an official backdoor or somehow the phone just happen to have gotten zero days randomly and is another hacker's backdoor.

Where do sites like haveibeenpwned source their databases? That could be a good source of passwords obviously, all languages included.

>>17774 Inshallah brother, and glory be upon you. >use nmap -sN You need root privileges for that because it requires access to raw packets and/or network interfaces. Sounds like you went a step not far enough. If you had given Termux root when you tried to launch an OS-fingerprinting nmap scan, you would actually have touched the firmware. >ping scans Cyber-weapon tools like Ning and Fing can use pings. With ping, think ICMP, which is Internet Control Message Protocol. As I'm sure you know ICMP is not on the transport layer and thus has no port and isn't TCP or UDP. ICMP is on the network layer, and it can be abused in order to scan. >nmap has modes for everything >learn more here: https://xkln.net/blog/icmp-ping-and-traceroute--what-i-wish-i-was-taught/ Ping scanning is how Android WiFI scanning apps work. You can't initiate your favorite well known nmap -sN <subnet range> scan because it requires access to both the raw incoming packets, and raw packet creation. In other words, deep access whichI think is managed by the Android OS firmware. Also, beware that scanning infidels are caught with intrustion detection systems like snorter. Snorter can be configured to find ICMP scans, and it works. People trust so much to Google and Apple. The firewall, the DNS, the app store, everything. >you want some research? Try to run the same nmap scans with sudo on your phone now, and show what happens >>17777 >apps which provide pwned devices >apps which find factory passwords There are online databases for that. I might link them later. >Mediatek phone There are a lot of MediaTek CPUs. If we're talking root through exploit on them, you'll find more holes in them on average. Examples of phones where you'll have to do that but which otherwise make good phones are LGs. >Phones available and open source device tree Like what? List some good ones. By the way, I work on new Android devices (10+). You don't always have to fully know the device tree, you know.

>>17778 Their passwords? They probably aggregate from a lot of databases. I wouldn't be surprised if a bunch of it actually even came from this site. I've found custom google searches which yielded databases here. Databases of solid gold. I have terabytes of knowledge the US government doesn't want me to have. Aside from the pirated content, of course. Gotta have that lol. >>17776 >It can't be that there is still no one-click software that scans for networks, compares MAC addresses and vendor SSID names with list of pwned router models and Bluetooth devices, lists all possible exploits, then tries to apply them in succession. The Metasploit framework and tools like it actually can do automated stuff like this. Ever used it? Also, I could write such a tool and put it on github. Gotta give back to the community after taking so, so much. I've stolen so many movies, and games, and music. I'll never feel bad. I'll never change. They can hang me and I won't repent. fuarrrk the system! Also, I don't use Metasploit because I'll just make my own Python script every time. I wanna type it all into my terminal. >unencrypted cookies normal people have caught on long ago and everyone is reinforcing the systems now. Your local McDolan's has a much more secure network than it did in 2013.

>>17776 To partially answer this, wifite2 is a sort of autopwn collection of scripts: https://github.com/kimocoder/wifite2 It still does not cover new attacks (KRACK, FRAG), but scripts for them exist separately.

>>17946 I think anon was talking about Nessus and Metasploit. WiFite does not do vuln scanning like he mentioned, although it is a good tool.

I wanted to revive this thread a little bit. >who am I? I am the Android researcher who has posted in this thread before. In recent months, I have made a few advancements in my studies. Part of it is discovering and re-discovering publicly known stuff. Part of it was experimentation. I am running Google Pixels. I've had a bunch at this point but they keep breaking or getting lost. Great hacker phones though. >>16978 Thank you for the resource lainon. I hope you stay tuned on this thread, because I'm going to push the limits of what a cell phone can do for hacking, and I'm going to document my research. >>17777 I wanted to ask if there were already lists of publicly known WiFi logins. I mean, the whole point of attacking an 802.11 network for me is to piggyback for privacy. That, or you're just broke and trying to get free WiFi because you don't have data (maybe you're using a tablet idk). You COULD also make a bot like this, but it's inefficient in theory and requires other steps not covered here. >>16984 Where can I find information about a phone's BIOS? Suppose I have a Pixel 3 for which I can download firmware on the internet. >what is my progress I have not installed NetHunter. I have not even flashed Lineage. All I have for now is root and nmap working. I don't have GSM engi mode either. I have not yet tried connecting an external NIC. I'm still very much starting out on this research. Then again, when I first posted on this thread almost half a year ago, I couldn't even launch nmap from Android. Slowly, I'm transitioning into using my phone as a hacking machine. >>17774 It is possible to change the MAC of your phone. You would do it with the same way you would normally manage network interfaces in Linux. Pretty sure even macchanger works. Although, you do need root. Also, what's weird about Android is that running ifconfig without sudo will omit several network interfaces. I can understand why that is and what's going on, but I have not figured out which interface is which. Running ifconfig with root on Android shows like 8 different network interfaces. Way more than Ubuntu.

Has anyone here figured out how to run Wireshark from their Android yet? >Screen is too small Use a tablet >it's impossible Rob Braxman has done it

>>17278 Technically, anything you can do from a cell phone, you can do from a drone. Hell, you can even attach a cell phone to a drone. Maybe even a Pi. I have a whole prototype drone designed that even has a frequency jammer and a laser. I call it the Gryphon. Drones also have other problems: >illegal to fly or even own in most places (you have to DIY to have any kind of fun) >limited battery and range >people get suspicious if you even have it on you. Drones do not fly silently. Everyone around can tell you're using a drone. Hence, the Gryphon is designed to come apart completely and be controlled from a cell phone, tablet, or SDR. The problem is that warflying has no advantage in most cases. If 802.11 networks are designed for people to access, then you can get that network from the ground. I mean, I could imagine a situation where you wanna hack some neighbor in your apartment building who lives above or below you. You COULD send my Gryphon with a NIC attachment to perform a deauth handshake capture or a passive handshake capture. That isn't what the damn thing is meant for though. It has like a spray paint nozzle attachment for taking out enemy cameras. Using it to deauth WiFi is kind of pointless. No point to deauthing with drones in 99% of cases.

>>18712 You could throw battery powered dead drops and network extenders around in unreachable places with a copter drone. Probably with autonomous power source like solar batteries if you live somewhere sunny. >It has like a spray paint nozzle attachment for taking out enemy cameras That's cool got any pics or schematic plans?

>>18723 Not until it is ready and field tested kek

>>18712 >Technically, anything you can do from a cell phone, you can do from a drone. Hell, you can even attach a cell phone to a drone. Maybe even a Pi. Phones have fullmac wifi chips.