CHOOGLER

- 인스톨

http://alexgorbatchev.com/SyntaxHighlighter/manual/installation.html

- 사용법

Wifi beacon을 캡쳐하려면, ethernet이 아니라, 802.11 mac을 필터링 해줘야 함.

Windows에서는 winpcap을 쓰고, 리눅스는 libpcap 라이브러리를 쓰는데, 둘다 ethernet만을 캡쳐해줌.
802.11 mac에 대한 캡쳐 기능이 없음.

따라서, windows에서는 별도의 유료도구를 구매해야하고,
리눅스는 별도의 라이브러리를 설치해줘야 함.

여기서는 리눅스로 하는 방법을 설명함.

1. aircrack-ng 툴 설치
   1. http://wiki.wireshark.org/CaptureSetup/WLAN/#Linux 여기를 보면 다음과 같은 언급이 있음.
   1. The easiest way to turn manually turn monitor mode on or off for an interface is with the airmon-ng script in aircrack-ng; your distribution may already have a package for aircrack-ng.
   2. # iwconfig wlan0=>device명
      을 치면, Mode:Monitored라고 나와야함. 보통은 Mode:Managed라고 나옴.
   3. aircrack-ng를 설치하고,
   4. # airmon-ng start wlan0
      을 실행하면, ifconfig해보면, mon0이 생김. 이에, iwconfig mon0을 실행하면, Mode:Monitored라고 나옴.
2. wireshark 설치
   1. wireshark.org에서 리눅스용 tar.gz를 받아서,
   2. libpcap-developement 설치하고,
   3. wireshark설치한후
   4. mon0디바이스로 캡쳐하면 가능함.

MD5_SHA-1 Utility.exe

Wi-Fi Protected Setup Specification 

Version 1.0h 

December 2006 

Wi-Fi Protected Setup Specification 1.0h.pdf

Wireless LAN Medium Access Control 

(MAC) and Physical Layer (PHY) specifications

802.11b-1999.pdf

802.11g-2003.pdf

802.11-2007.pdf.zip

Windows 7이 깔려서 나온 노트북에 Windows XP를 설치할 일이 생겼는데,

노트북 회사에서 XP관련 드라이버를 제공하지 않아서 고민이었다.

3DP Chip은 거의 다 찾아준다. 

일부 특이한 드라이버 1-2개를 못찾긴 했지만, 사용하는데는 전혀 지장없을 정도로 이상없이 설치했다.

http://vga.pe.kr/3dp/chip_down_kor.php

http://www.3dpchip.com/3DP_Chip_v1212.exe

usb to serial케이블 종류는 참 많지만, 웬만하면 다음중에 하나는 맞는거 같다.

FTDI칩셋

http://www.ftdichip.com/Drivers/VCP.htm

Prolific칩셋

http://www.prolific.com.tw/US/supportDownload.aspx?FileType=56&FileID=133&pcid=85&Page=0

1. 인텔 방식

unsigned char CalcChecksum(unsigned char *data, int leng)
{
  unsigned char csum;
 
    csum = 0xFF;
    for (;leng > 0;leng--)
        csum += *data++;
    return ~csum;
}

인텔 방식의 마이크로프로세서 실행파일 체크섬의 예

:10010000214601360121470136007EFE09D2190140
:100110002146017EB7C20001FF5F16002148011988
:10012000194E79234623965778239EDA3F01B2CAA7
:100130003F0156702B5E712B722B732146013421C7
:00000001FF

     Start code     Byte count     Address     Record type     Data     Checksum

데이터만 더하면

:100130003F0156702B5E712B722B732146013421C7
FF +  10 + 01 + 30 +  3F + 01 + 56 + 70 + 2B + 5E + 71 + 2B + 72 + 2B +73 + 21 + 46 + 01 + 34 + 21 
= 538

한바이트로 모듈라를 취하고, 다시 1의 보수를 취하면 계산이 끝난다. ~38 = C7

2. 모토로라 방식

unsigned char CalcChecksum(unsigned char *data, int leng)
{
  unsigned char csum;
 
    csum = 0;
    for (;leng > 0;leng--)
        csum += *data++;
 
    return 0xFF - csum;
}

모토로라 방식의 마이크로프로세서 실행파일 체크섬의 예

S00F000068656C6C6F202020202000003C
S11F00007C0802A6900100049421FFF07C6C1B787C8C23783C6000003863000026
S11F001C4BFFFFE5398000007D83637880010014382100107C0803A64E800020E9
S111003848656C6C6F20776F726C642E0A0042
S5030003F9
S9030000FC

     Start code     Record type     Byte count     Address     Data     Checksum

데이터만 더하면

S111003848656C6C6F20776F726C642E0A0042
11 + 00 + 38 + 48 + 65 + 6C + 6C + 6F + 20 + 77 + 6F + 72 + 6C + 64 + 2E + 0A +00 = 4BD

4BD에서 한바이트로 모듈라를 취하고, 0xFF에서 빼면 계산이 끝난다.

FF - BD = 42

/* -------------------------- IOCTL LIST -------------------------- */

/* Wireless Identification */
#define SIOCSIWCOMMIT   0x8B00      /* Commit pending changes to driver */
#define SIOCGIWNAME 0x8B01      /* get name == wireless protocol */
/* SIOCGIWNAME is used to verify the presence of Wireless Extensions.
 * Common values : "IEEE 802.11-DS", "IEEE 802.11-FH", "IEEE 802.11b"...
 * Don't put the name of your driver there, it's useless. */

/* Basic operations */
#define SIOCSIWNWID 0x8B02      /* set network id (pre-802.11) */
#define SIOCGIWNWID 0x8B03      /* get network id (the cell) */
#define SIOCSIWFREQ 0x8B04      /* set channel/frequency (Hz) */
#define SIOCGIWFREQ 0x8B05      /* get channel/frequency (Hz) */
#define SIOCSIWMODE 0x8B06      /* set operation mode */
#define SIOCGIWMODE 0x8B07      /* get operation mode */
#define SIOCSIWSENS 0x8B08      /* set sensitivity (dBm) */
#define SIOCGIWSENS 0x8B09      /* get sensitivity (dBm) */

/* Informative stuff */
#define SIOCSIWRANGE    0x8B0A      /* Unused */
#define SIOCGIWRANGE    0x8B0B      /* Get range of parameters */
#define SIOCSIWPRIV 0x8B0C      /* Unused */
#define SIOCGIWPRIV 0x8B0D      /* get private ioctl interface info */
#define SIOCSIWSTATS    0x8B0E      /* Unused */
#define SIOCGIWSTATS    0x8B0F      /* Get /proc/net/wireless stats */
/* SIOCGIWSTATS is strictly used between user space and the kernel, and
 * is never passed to the driver (i.e. the driver will never see it). */

/* Spy support (statistics per MAC address - used for Mobile IP support) */
#define SIOCSIWSPY  0x8B10      /* set spy addresses */
#define SIOCGIWSPY  0x8B11      /* get spy info (quality of link) */
#define SIOCSIWTHRSPY   0x8B12      /* set spy threshold (spy event) */
#define SIOCGIWTHRSPY   0x8B13      /* get spy threshold */

/* Access Point manipulation */
#define SIOCSIWAP   0x8B14      /* set access point MAC addresses */
#define SIOCGIWAP   0x8B15      /* get access point MAC addresses */
#define SIOCGIWAPLIST   0x8B17      /* Deprecated in favor of scanning */
#define SIOCSIWSCAN 0x8B18      /* trigger scanning (list cells) */
#define SIOCGIWSCAN 0x8B19      /* get scanning results */

/* 802.11 specific support */
#define SIOCSIWESSID    0x8B1A      /* set ESSID (network name) */
#define SIOCGIWESSID    0x8B1B      /* get ESSID */
#define SIOCSIWNICKN    0x8B1C      /* set node name/nickname */
#define SIOCGIWNICKN    0x8B1D      /* get node name/nickname */
/* As the ESSID and NICKN are strings up to 32 bytes long, it doesn't fit
 * within the 'iwreq' structure, so we need to use the 'data' member to
 * point to a string in user space, like it is done for RANGE... */

/* Other parameters useful in 802.11 and some other devices */
#define SIOCSIWRATE 0x8B20      /* set default bit rate (bps) */
#define SIOCGIWRATE 0x8B21      /* get default bit rate (bps) */
#define SIOCSIWRTS  0x8B22      /* set RTS/CTS threshold (bytes) */
#define SIOCGIWRTS  0x8B23      /* get RTS/CTS threshold (bytes) */
#define SIOCSIWFRAG 0x8B24      /* set fragmentation thr (bytes) */
#define SIOCGIWFRAG 0x8B25      /* get fragmentation thr (bytes) */
#define SIOCSIWTXPOW    0x8B26      /* set transmit power (dBm) */
#define SIOCGIWTXPOW    0x8B27      /* get transmit power (dBm) */
#define SIOCSIWRETRY    0x8B28      /* set retry limits and lifetime */
#define SIOCGIWRETRY    0x8B29      /* get retry limits and lifetime */

/* Encoding stuff (scrambling, hardware security, WEP...) */
#define SIOCSIWENCODE   0x8B2A      /* set encoding token & mode */
#define SIOCGIWENCODE   0x8B2B      /* get encoding token & mode */
/* Power saving stuff (power management, unicast and multicast) */
#define SIOCSIWPOWER    0x8B2C      /* set Power Management settings */
#define SIOCGIWPOWER    0x8B2D      /* get Power Management settings */

/* WPA : Generic IEEE 802.11 informatiom element (e.g., for WPA/RSN/WMM).
 * This ioctl uses struct iw_point and data buffer that includes IE id and len
 * fields. More than one IE may be included in the request. Setting the generic
 * IE to empty buffer (len=0) removes the generic IE from the driver. Drivers
 * are allowed to generate their own WPA/RSN IEs, but in these cases, drivers
 * are required to report the used IE as a wireless event, e.g., when
 * associating with an AP. */
#define SIOCSIWGENIE    0x8B30      /* set generic IE */
#define SIOCGIWGENIE    0x8B31      /* get generic IE */

/* WPA : IEEE 802.11 MLME requests */
#define SIOCSIWMLME 0x8B16      /* request MLME operation; uses
                     * struct iw_mlme */
/* WPA : Authentication mode parameters */
#define SIOCSIWAUTH 0x8B32      /* set authentication mode params */
#define SIOCGIWAUTH 0x8B33      /* get authentication mode params */

/* WPA : Extended version of encoding configuration */
#define SIOCSIWENCODEEXT 0x8B34     /* set encoding token & mode */
#define SIOCGIWENCODEEXT 0x8B35     /* get encoding token & mode */

/* WPA2 : PMKSA cache management */
#define SIOCSIWPMKSA    0x8B36      /* PMKSA cache operation */

/* -------------------- DEV PRIVATE IOCTL LIST -------------------- */

/* These 32 ioctl are wireless device private, for 16 commands.
 * Each driver is free to use them for whatever purpose it chooses,
 * however the driver *must* export the description of those ioctls
 * with SIOCGIWPRIV and *must* use arguments as defined below.
 * If you don't follow those rules, DaveM is going to hate you (reason :
 * it make mixed 32/64bit operation impossible).
 */
#define SIOCIWFIRSTPRIV 0x8BE0
#define SIOCIWLASTPRIV  0x8BFF
/* Previously, we were using SIOCDEVPRIVATE, but we now have our
 * separate range because of collisions with other tools such as
 * 'mii-tool'.
 * We now have 32 commands, so a bit more space ;-).
 * Also, all 'odd' commands are only usable by root and don't return the
 * content of ifr/iwr to user (but you are not obliged to use the set/get
 * convention, just use every other two command). More details in iwpriv.c.
 * And I repeat : you are not forced to use them with iwpriv, but you
 * must be compliant with it.
 */

/* ------------------------- IOCTL STUFF ------------------------- */

/* The first and the last (range) */
#define SIOCIWFIRST 0x8B00
#define SIOCIWLAST  SIOCIWLASTPRIV      /* 0x8BFF */
#define IW_IOCTL_IDX(cmd)   ((cmd) - SIOCIWFIRST)
/* ----------------------- WIRELESS EVENTS ----------------------- */
/* Those are *NOT* ioctls, do not issue request on them !!! */
/* Most events use the same identifier as ioctl requests */

#define IWEVTXDROP  0x8C00      /* Packet dropped to excessive retry */
#define IWEVQUAL    0x8C01      /* Quality part of statistics (scan) */
#define IWEVCUSTOM  0x8C02      /* Driver specific ascii string */
#define IWEVREGISTERED  0x8C03      /* Discovered a new node (AP mode) */
#define IWEVEXPIRED 0x8C04      /* Expired a node (AP mode) */
#define IWEVGENIE   0x8C05      /* Generic IE (WPA, RSN, WMM, ..)
                     * (scan results); This includes id and
                     * length fields. One IWEVGENIE may
                     * contain more than one IE. Scan
                     * results may contain one or more
                     * IWEVGENIE events. */
#define IWEVMICHAELMICFAILURE 0x8C06    /* Michael MIC failure
                     * (struct iw_michaelmicfailure)
                     */
#define IWEVASSOCREQIE  0x8C07      /* IEs used in (Re)Association Request.
                     * The data includes id and length
                     * fields and may contain more than one
                     * IE. This event is required in
                     * Managed mode if the driver
                     * generates its own WPA/RSN IE. This
                     * should be sent just before
                     * IWEVREGISTERED event for the
                     * association. */
#define IWEVASSOCRESPIE 0x8C08      /* IEs used in (Re)Association
                     * Response. The data includes id and
                     * length fields and may contain more
                     * than one IE. This may be sent
                     * between IWEVASSOCREQIE and
                     * IWEVREGISTERED events for the
                     * association. */
#define IWEVPMKIDCAND   0x8C09      /* PMKID candidate for RSN
                     * pre-authentication
                     * (struct iw_pmkid_cand) */

#define IWEVFIRST   0x8C00
#define IW_EVENT_IDX(cmd)   ((cmd) - IWEVFIRST)

Windows XP registry 경로

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

아래 값들을 적절히 셋팅한다. 없다면 [새로 만들기]->[문자열 값(S)] 클릭하여 새로 생성한다.

AutoAdminLogon

DefaultUserName 

DefaultPassword 

링크 참조.

http://support.microsoft.com/kb/315231/ko