2

Scenario:

  • Two devices have wireless connect. ( like wi-fi )
  • Probably encrypted. ( like wi-fi's WPA2 )

Which instruments are best for discovering carrier frequency?

How encrypted-text should be gathered to attack on it ( kind of software, e.g. something like horst, but more broad )?

Improve this question
6
  • 1
    What do you mean wifi-like? Are they connected using WPA2 or a similar protocol or is it something different? Is the device an AP and a client of some kind? More details about the specific situation would make it easier to give a proper answer.
    – Fewmitz
    Oct 26 '13 at 16:33
  • I make little changes. Question should looks like "How to attack encrypted wi-fi, where I don't know even carrier frequency?"
    – polar bear on the white snow
    Oct 26 '13 at 17:20
  • A more specific question would probably get you some better answers. Give a bit more details on what you know about this system.
    – 0xea
    Oct 26 '13 at 19:38
  • I closed this as a dupe of the other as they cover the same thing, but that seems to be a better iteration of the question. In the future, please edit your initial question itself rather than asking a newer one with minor changes.
    – asheeshr
    Oct 30 '13 at 14:14
  • Close, but please, don't delete, there are two pretty answers.
    – polar bear on the white snow
    Oct 31 '13 at 22:56
3

If "something like wi-fi" means it's radio but not really 802.11, you might want to take a look at Software Defined Radio projects. As the question isn't really clear, your mileage may vary.

There are numerous hardware tools you can use. From relatively expensive tools like bladeRF and hackRF to really cheap alternatives like rtl-sdr. You'd probably need to do some research on how to actually use them for what you want.

Improve this answer
1
  • Your answer is very nearby for what I'm looking for. Exactly, something like wi-fi or GSM. Simple clarification may be only "Radio". Me need to detect carrier, thereafter sniff packets to make similar to WPA2 attack, if it's possible. I'll probably create another question about only detection of carrier.
    – polar bear on the white snow
    Oct 30 '13 at 11:49
4

I would say this guide is a good place to start. However, this is assuming when you say "wifi-like" you mean very similar to authentication using WPA2.

Cracking WPA2 is a little more complex than WEP, for example. The initialization code for WPA2 uses a four-way handshake to properly initialize all of the vectors that are used in the actual encrypting. So in order to properly break it you need to sniff the traffic that gets sent back and forth during a session initialization. However, because this is a WiFi it's not uncommon for packets to not be sniffed properly. So you should be aware that you may have to initialize the connection more than one time. Again, see the link I posted.

As for not knowing the carrier frequency there are a few ways to approach the issue. As the link pointed out they suggest getting an antenna. This is the best option when you're doing anything with WiFi. However, if you have reason to believe the access point is on a standard frequency discovering it could be as simple as an App on a smartphone to search for networks. But if you're doing this with any kind of frequency you should get an antenna and look for some guides on how to interact with it; they're all over the place.

Another approach would be to look at the client. Since you asked this question on an RE forum I'm assuming you have access to at least one of the access points so you can attack it from that angle and try to trace what happens when the connection is initiated.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.