WPS Scan

SUBMITTED BY: Guest

DATE: Dec. 5, 2013, 2:46 p.m.

FORMAT: Python

SIZE: 10.3 kB

Raw Download

HITS: 754

Report
  1. #!/usr/bin/env python
  3. from sys import argv, stderr, exit
  4. from getopt import GetoptError, getopt as GetOpt
  5. try:
  6. from scapy.all import *
  7. except Exception, e:
  8. print 'Failed to import scapy:',e
  9. exit(1)
  12. class WPSQuery:
  13. bssid = None
  14. essid = None
  15. pfile = None
  16. rprobe = False
  17. verbose = False
  18. probedNets = {}
  19. WPS_ID = "\x00\x50\xF2\x04"
  20. wps_attributes = {
  21. 0x104A : {'name' : 'Version ', 'type' : 'hex'},
  22. 0x1044 : {'name' : 'WPS State ', 'type' : 'hex'},
  23. 0x1057 : {'name' : 'AP Setup Locked ', 'type' : 'hex'},
  24. 0x1041 : {'name' : 'Selected Registrar ', 'type' : 'hex'},
  25. 0x1012 : {'name' : 'Device Password ID ', 'type' : 'hex'},
  26. 0x1053 : {'name' : 'Selected Registrar Config Methods', 'type' : 'hex'},
  27. 0x103B : {'name' : 'Response Type ', 'type' : 'hex'},
  28. 0x1047 : {'name' : 'UUID-E ', 'type' : 'hex'},
  29. 0x1021 : {'name' : 'Manufacturer ', 'type' : 'str'},
  30. 0x1023 : {'name' : 'Model Name ', 'type' : 'str'},
  31. 0x1024 : {'name' : 'Model Number ', 'type' : 'str'},
  32. 0x1042 : {'name' : 'Serial Number ', 'type' : 'str'},
  33. 0x1054 : {'name' : 'Primary Device Type ', 'type' : 'hex'},
  34. 0x1011 : {'name' : 'Device Name ', 'type' : 'str'},
  35. 0x1008 : {'name' : 'Config Methods ', 'type' : 'hex'},
  36. 0x103C : {'name' : 'RF Bands ', 'type' : 'hex'},
  37. 0x1045 : {'name' : 'SSID ', 'type' : 'str'},
  38. 0x102D : {'name' : 'OS Version ', 'type' : 'str'}
  39. }
  42. def __init__(self,iface,pfile):
  43. if iface:
  44. conf.iface = iface
  45. if pfile:
  46. self.pfile = pfile
  48. def run(self):
  49. if self.verbose:
  50. if self.pfile:
  51. stderr.write("Reading packets from %s\n\n" % self.pfile)
  52. else:
  53. stderr.write("Listening on interface %s\n\n" % conf.iface)
  55. try:
  56. sniff(prn=self.pcap,offline=self.pfile)
  57. except Exception, e:
  58. print 'Caught exception while running sniff():',e
  60. #Handles captured packets
  61. def pcap(self,packet):
  62. if packet.haslayer(Dot11Beacon):
  63. self.beaconh(packet)
  64. elif packet.haslayer(Dot11ProbeResp):
  65. self.responseh(packet)
  67. #Beacon packet handler
  68. def beaconh(self,pkt):
  69. elt = None
  70. eltcount = 1
  71. doprobe = False
  72. essid = None
  73. bssid = pkt[Dot11].addr3.upper()
  75. #If a specific BSSID and ESSID combination was supplied, skip everything else and just probe it
  76. if self.bssid and self.essid:
  77. self.probereq(self.essid,self.bssid)
  78. return
  80. #If we've already probed it, processing it's beacon frames won't do us any more good
  81. if self.probedNets.has_key(bssid):
  82. return
  84. #Is this the BSSID we're looking for?
  85. if self.bssid and self.bssid != bssid:
  86. return
  88. #Loop through all information elements
  89. while elt != pkt.lastlayer(Dot11Elt):
  90. elt = pkt.getlayer(Dot11Elt, nb=eltcount)
  91. eltcount += 1
  93. #Get the SSID
  94. if elt.ID == 0:
  95. essid = elt.info
  96. #Skip if this is not the SSID we're looking for
  97. if self.essid and essid != self.essid:
  98. return
  100. #Check for a WPS information element
  101. else:
  102. doprobe = self.iswpselt(elt)
  103. if doprobe:
  104. if self.verbose:
  105. stderr.write("WPS support detected for %s (%s)\n" % (bssid,essid))
  106. break
  108. #Should we actively probe this AP?
  109. if doprobe == True or self.rprobe == True:
  110. self.probereq(essid,bssid)
  111. return
  113. #Probe response packet handler
  114. def responseh(self,pkt):
  115. wpsdata = []
  116. eltcount = 1
  117. elt = None
  118. bssid = None
  119. essid = None
  120. bssid = pkt[Dot11].addr3.upper()
  122. #Is this the BSSID we're looking for?
  123. if self.bssid and self.bssid != bssid:
  124. return
  126. #Loop through all information elements
  127. while elt != pkt.lastlayer(Dot11Elt):
  128. elt = pkt.getlayer(Dot11Elt, nb=eltcount)
  129. eltcount += 1
  131. #Get the SSID
  132. if elt.ID == 0:
  133. essid = elt.info
  134. #Don't probe a network multiple times
  135. if essid != None and self.probedNets.has_key(bssid) and self.probedNets[bssid] == essid:
  136. return
  137. #Skip if this is not the SSID we're looking for
  138. if self.essid and essid != self.essid:
  139. return
  140. if self.verbose:
  141. stderr.write("Received probe response from %s (%s)\n" % (bssid,essid))
  142. elif self.iswpselt(elt):
  143. wpsdata = self.parsewpselt(elt)
  145. #Display WPS information
  146. if wpsdata:
  147. self.printwpsinfo(wpsdata,bssid,essid)
  148. elif self.verbose:
  149. stderr.write("No WPS element supplied by %s (%s)!\n" % (bssid,essid))
  151. #Mark this BSSID as complete
  152. self.probedNets[bssid] = essid
  154. return
  156. #Display collected WPS data
  157. def printwpsinfo(self,wpsdata,bssid,essid):
  158. textlen = 33
  159. filler = ' '
  161. if wpsdata:
  162. print ''
  163. print 'BSSID:',bssid
  164. print 'ESSID:',essid
  165. print '----------------------------------------------------------'
  167. for (header,data,datatype) in wpsdata:
  168. if datatype != 'str':
  169. tdata = data
  170. data = '0x'
  171. for i in tdata:
  172. byte = str(hex(ord(i)))[2:]
  173. if len(byte) == 1:
  174. byte = '0' + byte
  175. data += byte
  176. header = header + (filler * (textlen-len(header)))
  177. print '%s : %s' % (header,data)
  178. print ''
  181. #Send a probe request to the specified AP
  182. def probereq(self,essid,bssid):
  183. if not essid or not bssid:
  184. return
  185. if self.probedNets.has_key(bssid):
  186. return
  187. if self.pfile:
  188. return
  190. if self.verbose:
  191. stderr.write("Probing network '%s (%s)'\n" % (bssid,essid))
  193. try:
  194. #Build a probe request packet with a SSID and a WPS information element
  195. dst = mac2str(bssid)
  196. src = mac2str("ff:ff:ff:ff:ff:ff")
  197. packet = Dot11(addr1=dst,addr2=src,addr3=dst)/Dot11ProbeReq()
  198. packet = packet/Dot11Elt(ID=0,len=len(essid),info=essid)/Dot11Elt(ID=221,len=9,info="%s\x10\x4a\x00\x01\x10" % self.WPS_ID)
  200. #Send it!
  201. send(packet,verbose=0)
  202. self.probedNets[bssid] = None
  203. except Exception, e:
  204. print 'Failure sending probe request to',essid,':',e
  207. #Check if an element is a WPS element
  208. def iswpselt(self,elt):
  209. if elt.ID == 221:
  210. if elt.info.startswith(self.WPS_ID):
  211. return True
  212. return False
  215. #Parse a WPS element
  216. def parsewpselt(self,elt):
  217. data = []
  218. tagname = None
  219. tagdata = None
  220. datatype = None
  221. tag = 0
  222. tlen = 0
  223. i = len(self.WPS_ID)
  225. try:
  226. if self.iswpselt(elt):
  227. while i < elt.len:
  228. #Get tag number and length
  229. tag = int((ord(elt.info[i]) * 0x100) + ord(elt.info[i+1]))
  230. i += 2
  231. tlen = int((ord(elt.info[i]) * 0x100) + ord(elt.info[i+1]))
  232. i += 2
  234. #Get the tag data
  235. tagdata = elt.info[i:i+tlen]
  236. i += tlen
  238. #Lookup the tag name and type
  239. try:
  240. tagname = self.wps_attributes[tag]['name']
  241. datatype = self.wps_attributes[tag]['type']
  242. except Exception, e:
  243. tagname = 'Unknown'
  244. datatype = 'hex'
  246. #Append to array
  247. data.append((tagname,tagdata,datatype))
  248. except Exception,e:
  249. print 'Exception processing WPS element:',e
  251. return data
  253. def about():
  254. print '''
  255. WPScan actively scans access points that support WiFi Protected Setup by sending
  256. 802.11 probe requests to them. It then examines the WPS information element in the
  257. resulting 802.11 probe response and displays the information contained in that IE.
  259. This is useful for fingerprinting WPS-capable access points, as many of them will
  260. include their vendor, model number, and firmware versions in the WPS IE of the
  261. probe response.
  262. '''
  263. exit(0)
  265. def usage():
  266. print '''
  267. Usage: %s [OPTIONS]
  269. -i <iface> Specify the interface to listen on
  270. -p <file> Specify pcap file to read from
  271. -b <bssid> Specify a bssid filter
  272. -e <essid> Specify an essid filter
  273. -n Probe all networks
  274. -v Enable verbose mode
  275. -a Show about information
  276. -h Show help
  277. ''' % argv[0]
  278. exit(1)
  281. def main():
  282. bssid = None
  283. essid = None
  284. iface = None
  285. pfile = None
  286. probeall = False
  287. verbose = False
  289. try:
  290. opts,args = GetOpt(argv[1:],"b:e:i:p:ainvh");
  291. except GetoptError, e:
  292. print 'Usage Error:',e
  293. usage()
  295. for opt,optarg in opts:
  296. if opt == '-b':
  297. bssid = optarg.upper()
  298. elif opt == '-e':
  299. essid = optarg
  300. elif opt == '-i':
  301. iface = optarg
  302. elif opt == '-p':
  303. pfile = optarg
  304. elif opt == '-v':
  305. verbose = True
  306. elif opt == '-n':
  307. probeall = True
  308. elif opt == '-a':
  309. about()
  310. else:
  311. usage()
  314. wps = WPSQuery(iface,pfile)
  315. wps.bssid = bssid
  316. wps.essid = essid
  317. wps.rprobe = probeall
  318. wps.verbose = verbose
  319. wps.run()
  322. if __name__ == "__main__":
  323. main()
comments powered by Disqus