If it wasn’t clear to anyone that I make things up as I go, I pretty much don’t know what I’m doing. But I do it anyway because it means that<\/p>\n
This morning I was looking at gps units because I’m trying to get my Wifi Pineapple to do stuff. In my last post<\/a>, I mentioned my intent to return the gps unit because I thought it was defective. Thing is, its not defective, per-say. I just don’t know what I’m doing. I think. I’ve seen posts about running the same GPS stick under linux with no issues on the amazon website as well as this post for hooking everything up to the rasberry pi<\/a>. It seems to be linux compatible for all that I can see.<\/p>\n This trouble occurs after I’ve plugged the gps chip into my computer and gotten everything working from there. I’ll have to write a separate blog post about how to actually get the thing to run.<\/p>\n The problem is that gpsd is being temperamental, which seems to be par for the course<\/a>. GPSD isn’t outputting any debug information when I use it. Apparently. Because there’s no output when everything is working or debug information to say what is not working. So, I don’t know for sure that gpsd is or is not working.<\/p>\n The solution of course is to use something other then gpsd. Kismet_server does provide a way to directly access a GPS device though. So let’s use that. The problem with that is it also doesn’t seem to output any errors. Which may mean everything is working perfectly. Or not. At least with kismet_server managing the GPS tracking you don’t get an error saying GPSD has been unresponsive for the last 15 minutes and kismet_server needs to reconnect.<\/p>\n The core is the wifi pineapple<\/a> from hak5. Next up is some parts from sparkfun: a usb power cable<\/a> and a lion battery pack<\/a>. Alternately I have a usb charger for the cigarette letter that provides much longer lasting power. Then I have a leftover 2gb microSD card that I usually leave in the pineapple. The final part is the gps dongle<\/a>.<\/p>\n Software side, its still pretty easy. To get kismet_server on the pineapple you’ll need it connected to the wifi somehow. Then you’ll run: I wouldn’t bother with installing gpsd. It doesn’t seem to work, and its one more layer to go wrong.<\/p>\n You could use kismet_drone but then you have to connect it to a kismet_server. It might be nice if you had an army of drones that you wanted to connect back to a single server so that multiple people could connect to it, but I can’t see any purpose to it in my application.<\/p>\n Here’s my kismet.conf for kismet server.<\/p>\n If you’ve copy pasted my config, then you don’t need to worry about this stuff. Still, you should read it over.<\/p>\n To be able to connect to a kismet server remotely, there are **two** lines that you need to edit to allow remote connections. They are:<\/p>\n \t\t\t Most websites are covering the old kismet conf file so they won’t mention that. You need to change the listen line to tcp:\/\/0.0.0.0:2501 so it will answer all connections. Set the allowed hosts to 172.16.42.0\/24 so that at least people have to be connected to your router to do anything.<\/p>\n<\/li>\n You’ll also need to edit your config to make kismet server aware that is needs to manage your gps device. One of the features of the Pineapple Mark V is the boot mode switches. I have a wardrive mode, and my command string is this: You could, if battery life was a true concern and you didn’t want to do any monitoring whatsover via a wireless interface add in an Does this home rolled crazy ass solution work? Mostly. I’ve done some successful testing with it locally. I know it usually streams GPS data. But I don’t know that I trust it on large scale yet. On the other hand, there’s a trip to DC608 coming up at the end of the month. Its a two hour trip to Madison. And I have half a month to finish testing everything.<\/p>\n Its madness, it really is.<\/p>\n","protected":false},"excerpt":{"rendered":" Wardriving With The Wifi Pineapple mark V You can skip this part if you like If it wasn’t clear to anyone that I make things up as I go, I pretty much don’t know what I’m doing. But I do it anyway because it means that I learn something new I’m never bored because I’m… <\/p>\nHardware<\/h3>\n
Software<\/h3>\n
\n\t\topkg update
\n\t\topkg install kismet_server<\/code>\n\t<\/p>\nConf Files<\/h3>\n
\n\t\t\t#http:\/\/soliloquyforthefallen.net\/blog\/2014\/04\/12\/wardriving-with-the-wifi-pineapple-mark-v\n\t\t\t# Kismet config file\n\t\t\t# Most of the \"static\" configs have been moved to here -- the command line\n\t\t\t# config was getting way too crowded and cryptic. We want functionality,\n\t\t\t# not continually reading --help!\n\n\t\t\t# Version of Kismet config\n\t\t\tversion=2009-newcore\n\n\t\t\t# Name of server (Purely for organizational purposes)\n\t\t\tservername=Kismet_2009\n\n\t\t\t# Prefix of where we log (as used in the logtemplate later)\n\t\t\tlogprefix=\/mnt\/test\/kismet\/logs\n\n\t\t\t# Do we process the contents of data frames? If this is enabled, data\n\t\t\t# frames will be truncated to the headers only immediately after frame type\n\t\t\t# detection. This will disable IP detection, etc, however it is likely\n\t\t\t# safer (and definitely more polite) if monitoring networks you do not own.\n\t\t\t# hidedata=true\n\n\t\t\t# Do we allow plugins to be used? This will load plugins from the system\n\t\t\t# and user plugin directiories when set to true (See the README for the default\n\t\t\t# plugin locations).\n\t\t\tallowplugins=true\n\n\t\t\t# See the README for full information on the new source format\n\t\t\t# ncsource=interface:options\n\t\t\t# for example:\n\t\t\tncsource=wlan1\n\t\t\t# ncsource=wifi0:type=madwifi\n\t\t\t# ncsource=wlan0:name=intel,hop=false,channel=11\n\n\t\t\t# Comma-separated list of sources to enable. This is only needed if you defined\n\t\t\t# multiple sources and only want to enable some of them. By default, all defined\n\t\t\t# sources are enabled.\n\t\t\t# For example, if sources with name=prismsource and name=ciscosource are defined,\n\t\t\t# and you only want to enable those two:\n\t\t\t# enablesources=prismsource,ciscosource\n\n\t\t\t# Control which channels we like to spend more time on. By default, the list\n\t\t\t# of channels is pulled from the driver automatically. By setting preferred channels,\n\t\t\t# if they are present in the channel list, they'll be set with a timing delay so that\n\t\t\t# more time is spent on them. Since 1, 6, 11 are the common default channels, it makes\n\t\t\t# sense to spend more time monitoring them.\n\t\t\t# For finer control, see further down in the config for the channellist= directives.\n\t\t\tpreferredchannels=1,6,11\n\n\t\t\t# How many channels per second do we hop? (1-10)\n\t\t\tchannelvelocity=3\n\n\t\t\t# By setting the dwell time for channel hopping we override the channelvelocity\n\t\t\t# setting above and dwell on each channel for the given number of seconds.\n\t\t\t#channeldwell=10\n\n\t\t\t# Channels are defined as:\n\t\t\t# channellist=name:ch1,ch2,ch3\n\t\t\t# or\n\t\t\t# channellist=name:range-start-end-width-offset,ch,range,ch,...\n\t\t\t#\n\t\t\t# Channels may be a numeric channel or a frequency\n\t\t\t#\n\t\t\t# Channels may specify an additional wait period. For common default channels,\n\t\t\t# an additional wait period can be useful. Wait periods delay for that number\n\t\t\t# of times per second - so a configuration hopping 10 times per second with a\n\t\t\t# channel of 6:3 would delay 3\/10ths of a second on channel 6.\n\t\t\t#\n\t\t\t# Channel lists may have up to 256 channels and ranges (combined). For power\n\t\t\t# users scanning more than 256 channels with a single card, ranges must be used.\n\t\t\t#\n\t\t\t# Ranges are meant for \"power users\" who wish to define a very large number of\n\t\t\t# channels. A range may specify channels or frequencies, and will automatically\n\t\t\t# sort themselves to cover channels in a non-overlapping fashion. An example\n\t\t\t# range for the normal 802.11b\/g spectrum would be:\n\t\t\t#\n\t\t\t# range-1-11-3-1\n\t\t\t#\n\t\t\t# which indicates starting at 1, ending at 11, a channel width of 3 channels,\n\t\t\t# incrementing by one. A frequency based definition would be:\n\t\t\t#\n\t\t\t# range-2412-2462-22-5\n\t\t\t#\n\t\t\t# since 11g channels are 22 mhz wide and 5 mhz apart.\n\t\t\t#\n\t\t\t# Ranges have the flaw that they cannot be shared between sources in a non-overlapping\n\t\t\t# way, so multiple sources using the same range may hop in lockstep with each other\n\t\t\t# and duplicate the coverage.\n\t\t\t#\n\t\t\t# channellist=demo:1:3,6:3,11:3,range-5000-6000-20-10\n\n\t\t\t# Default channel lists\n\t\t\t# These channel lists MUST BE PRESENT for Kismet to work properly. While it is\n\t\t\t# possible to change these, it is not recommended. These are used when the supported\n\t\t\t# channel list can not be found for the source; to force using these instead of\n\t\t\t# the detected supported channels, override with channellist= in the source defintion\n\t\t\t#\n\t\t\t# IN GENERAL, if you think you want to modify these, what you REALLY want to do is\n\t\t\t# copy them and use channellist= in the packet source.\n\t\t\tchannellist=IEEE80211b:1:3,6:3,11:3,2,7,3,8,4,9,5,10\n\t\t\tchannellist=IEEE80211a:36,40,44,48,52,56,60,64,149,153,157,161,165\n\t\t\tchannellist=IEEE80211ab:1:3,6:3,11:3,2,7,3,8,4,9,5,10,36,40,44,48,52,56,60,64,149,153,157,161,165\n\n\t\t\t# Client\/server listen config\n\t\t\tlisten=tcp:\/\/0.0.0.0:2501\n\t\t\t# People allowed to connect, comma seperated IP addresses or network\/mask\n\t\t\t# blocks. Netmasks can be expressed as dotted quad (\/255.255.255.0) or as\n\t\t\t# numbers (\/24)\n\t\t\tallowedhosts=172.16.42.0\/24\n\n\t\t\t# Maximum number of concurrent GUI's\n\t\t\tmaxclients=5\n\t\t\t# Maximum backlog before we start throwing out or killing clients. The\n\t\t\t# bigger this number, the more memory and the more power it will use.\n\t\t\tmaxbacklog=5000\n\n\t\t\t# Server + Drone config options. To have a Kismet server export live packets\n\t\t\t# as if it were a drone, uncomment these.\n\t\t\t# dronelisten=tcp:\/\/127.0.0.1:3501\n\t\t\t# droneallowedhosts=127.0.0.1\n\t\t\t# dronemaxclients=5\n\t\t\t# droneringlen=65535\n\n\t\t\t# OUI file, expected format 00:11:22
A few highlights on that conf file!<\/h4>\n
\n
listen=tcp:\/\/0.0.0.0:2501
\n\t\t\t\tallowedhosts=172.16.42.0\/24<\/code><\/p>\n
\n\t\t\tgpstype=serial
\n\t\t\t# What serial device do we look for the GPS on?
\n\t\t\tgpsdevice=\/dev\/ttyUSB0<\/code>\n\t\t\t<\/p>\n<\/li>\nDip Switches<\/h3>\n
\n\t\tifconfig wlan1 down && iwconfig wlan1 mode monitor && ifconfig wlan1 up && mount \/dev\/sda1 \/mnt\/test && kismet_server -f \/mnt\/test\/kismet\/kismet.conf 2>&1 >> \/mnt\/test\/kismet\/errors.log<\/code>
\n\tYou’ll need to ssh into the pineapple and mkdir the \/mnt\/test directory first.<\/p>\nifconfig wlan0 down<\/code> but eh.<\/p>\nIn Conclusion<\/h3>\n