(For more resources related to this topic, see here.)

So I don’t think it’s possible to go to a conference these days and not see a talk on mobile or wireless. (They tend to schedule the streams to have both mobile and wireless talks at the same time—the sneaky devils. There is no escaping the wireless knowledge!) So, it makes sense that we work out some ways of training people how to skill up on these technologies. We’re going to touch on some older vulnerabilities that you don’t see very often, but as always, when you do, it’s good to know how to insta-win.

Wireless environment setup

This article is a bit of an odd one, because with Wi-Fi and mobile, it’s much harder to create a safe environment for your testers to work in. For infrastructure and web app tests, you can simply say, “it’s on the network, yo” and they’ll get the picture. However, Wi-Fi and mobile devices are almost everywhere in places that require pen testing. It’s far too easy for someone to get confused and attempt to pwn a random bystander. While this sounds hilarious, it is a serious issue if that occurs. So, adhere to the following guidelines for safer testing:

• Where possible, try and test away from other people and networks. If there is an underground location nearby, testing becomes simpler as floors are more effective than walls for blocking Wi-Fi signals (contrary to the firmly held beliefs of anyone who’s tried to improve their home network signal). If you’re an individual who works for a company, or you know, has the money to make a Faraday cage, then by all means do the setup in there. I’ll just sit here and be jealous.
• Unless it’s pertinent to the test scenario, provide testers with enough knowledge to identify the devices and networks they should be attacking. A good way to go is to provide the Mac address as they very rarely collide. (Mac randomizing tools be damned.)
• If an evil network has to be created, name it something obvious and reduce the access to ensure that it is visible to as few people as possible. The naming convention we use is Connectingtomewillresultin followed by pain, death, and suffering. While this steers away the majority of people, it does appear to attract the occasional fool, but that’s natural selection for you.
• Once again, but it is worth repeating, don’t use your home network. Especially in this case, using your home equipment could expose you to random passersby or evil neighbors. I’m pretty sure my neighbor doesn’t know how to hack, but if he does, I’m in for a world of hurt.

Software

We’ll be using Kali Linux as the base for this article as we’ll be using the tools provided by Kali to set up our networks for attack. Everything you need is built into Kali, but if you happen to be using another build such as Ubuntu or Debian, you will need the following tools:

• Iwtools (apt-get install iw): This is the wireless equivalent of ifconfig that allows the alteration of wireless adapters, and provides a handy method to monitor them.
• Aircrack suite (apt-get install aircrack-ng): The basic tools of wireless attacking are available in the Aircrack suite. This selection of tools provides a wide range of services, including cracking encryption keys, monitoring probe requests, and hosting rogue networks.
• Hostapd (apt-get install hostapd): Airbase-ng doesn’t support WPA-2 networks, so we need to bring in the serious programs for serious people. This can also be used to host WEP networks, but getting Aircrack suite practice is not to be sniffed at.
• Wireshark (apt-get install wireshark): Wireshark is one of the most widely used network analytics tools. It’s not only used by pen testers, but also by people who have CISSP and other important letters after their names. This means that it’s a tool that you should know about.
• dnschef (https://thesprawl.org/projects/dnschef/): Thanks to Duncan Winfrey, who pointed me in this direction. DNSchef is a fantastic resource for doing DNS spoofing. Other alternatives include DNS spoof and Metasploit’s Fake DNS.
• Crunch (apt-get install crunch): Crunch generates strings in a specified order. While it seems very simple, it’s incredibly useful. Use with care though; it has filled more than one unwitting user’s hard drive.

Hardware

You want to host a dodgy network. The first question to ask yourself, after the question you already asked yourself about software, is: is your laptop/PC capable of hosting a network?

If your adapter is compatible with injection drivers, you should be fine. A quick check is to boot up Kali Linux and run sudo airmon-ng start <interface>. This will put your adapter in promiscuous mode. If you don’t have the correct drivers, it’ll throw an error. Refer to a potted list of compatible adapters at http://www.aircrack-ng.org/doku.php?id=compatibility_drivers.

However, if you don’t have access to an adapter with the required drivers, fear not. It is still possible to set up some of the scenarios. There are two options.

The first and most obvious is “buy an adapter.” I can understand that you might not have a lot of cash kicking around, so my advice is to pick up an Edimax ew-7711-UAN—it’s really cheap and pretty compact. It has a short range and is fairly low powered. It is also compatible with Raspberry Pi and BeagleBone, which is awesome but irrelevant.

The second option is a limited solution. Most phones on the market can be used as wireless hotspots and so can be used to set up profiles for other devices for the phone-related scenarios in this article. Unfortunately, unless you have a rare and epic phone, it’s unlikely to support WEP, so that’s out of the question. There are solutions for rooted phones, but I wouldn’t instruct you to root your phone, and I’m most certainly not providing a guide to do so.

Realistically, in order to create spoofed networks effectively and set up these scenarios, a computer is required. Maybe I’m just not being imaginative enough.