skyplabs / probequest

Toolkit for Playing with Wi-Fi Probe Requests

ProbeQuest

Toolkit allowing to sniff and display the Wi-Fi probe requests passing nearby your wireless interface.

Probe requests are sent by a station to elicit information about access points, in particular to determine if an access point is present or not in the nearby environment. Some devices (mostly smartphones and tablets) use these requests to determine if one of the networks they have previously been connected to is in range, leaking personal information.

Further details are discussed in this paper.

Installation

pip3 install --upgrade probequest

Documentation

The project is documented here.

In the Media

ProbeQuest has appeared in the following media:

• KitPloit
• Hakin9 Magazine, VOL.13, NO. 05, "Open Source Hacking Tools"
• WonderHowTo (including a YouTube video)
• ShellVoide
• Cyber Pi Projects (Worksheet)

License

GPL version 3

probequest's Issues

Test ProbeQuest on Windows

Python builds are not available on Windows environments on Travis CI, but there are workarounds: https://docs.travis-ci.com/user/languages/python/#running-python-tests-on-multiple-operating-systems.

Split the unit tests into multiple files

The unit tests are all in the same file, which make them difficult to maintain.

Add MLME frame analysis to passively identify devices

Integrate the database of signatures resulting from the work of the research paper "Passive Taxonomy of Wifi Clients using MLME Frame Contents":

• Research paper
• DEF CON talk
• Git repository of the signatures

Add a contribution guide

Use 'main' as default branch

Failed to compile filter expression type mgt subtype probe-req (-1)

When I run i get this error:

airmon-ng start wlan0

PHY Interface Driver Chipset

phy0 wlan0 mt7601u Edimax Technology Co., Ltd Edimax Wi-Fi
(monitor mode enabled)

┌──(root💀kali)-[/home/kali]
└─# probequest -i wlan0
[*] Start sniffing probe requests...
Exception in thread Thread-3:
Traceback (most recent call last):
File "/usr/lib/python3.8/threading.py", line 932, in _bootstrap_inner
self.run()
File "/usr/lib/python3.8/threading.py", line 870, in run
self._target(self._args, **self._kwargs)
File "/usr/lib/python3/dist-packages/scapy/sendrecv.py", line 906, in _run
sniff_sockets[L2socket(type=ETH_P_ALL, iface=iface,
File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 407, in init
attach_filter(self.ins, filter, iface)
File "/usr/lib/python3/dist-packages/scapy/arch/linux.pn: Failed to compile filter expression type mgt subtype probe-req (-1)
^C[] Stopping the threads...

Probequest 0.7.2 version, monitor mode enabled, and i'm using usb wireless adapter " Edimax Technology Co., Ltd Edimax Wi-Fi" via usb on virtual box kali linux

Add support for Python 3.8

Test the good functioning of ProbeQuest with Python 3.8 and add Python 3.8 to the test matrix of Travis CI.

Automatically generate GitHub release notes

See https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes.

Build the documentation with Travis CI

Build the documentation with Travis CI to make sure it works well.

Respond to probe requests to detect open Wi-Fi

Add an active mode used to determine if the Wi-Fi access point a device is trying to connect to requires an authentication or not.

Send probe request results as JSON string to a RESTful API

Is your feature request related to a problem?

Not really, currently I'm saving the probe request results using the option "save to CSV". The problem is, that the probequest is running on a raspberry pi ("other machine"). To get the results I've to copy the csv file from the pi to my computer.

A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like

It would be nice if I can configure a RestFul API request, so that I can send the probe request directly to a web api.

A clear and concise description of what you want to happen.

Describe alternatives you've considered

A clear and concise description of any alternative solutions or features you've considered.

Additional context

I can provide a minimal example of a python based web api for testing purposes. For example with this two endpoints:

POST /probequest/results : Create a new result item
PUT /probequest/results/{id} : Update the result information identified by "id"

Add any other context or screenshots about the feature request here.

Set up CodeQL analysis

Arguments not working (-e, -r)

Dear author,

I cannot get the arguments to have any effect on the results.
For example, filtering on ESSID does not seem to work.

I also tried not using quotes. Tried --essid, -r, --regex, nothing seems to have any effect on the results I am seeing.

Could you help me out with this? I must be doing something wrong here.

Use RFtap to get around the MAC spoofing mitigation technique

See https://rftap.github.io/blog/2016/09/01/rftap-wifi.html.

Remove Snyk configuration file

Snyk is no more used for this project.

Export captured traffic to a PCAP file

See https://scapy.readthedocs.io/en/latest/usage.html#pcap.

Refactor using Scapy PipeTools

https://scapy.readthedocs.io/en/latest/advanced_usage.html#pipetools.

how to get PWR Values?

hello,
is there a way to get the PWR reported by the card.?
----sorry this was already addressed here https://github.com/secdev/scapy/issues/1982

AttributeError: 'NoneType' object has no attribute 'info'

sudo sniff-probe-req -i mon0 -o probe_output.log --debug

[*] Start sniffing probe requests...
[!] Frame filters: type mgt subtype probe-req
[!] ESSID filters: None
[!] ESSID regex: None
[!] Ignore case: False
Exception in thread Thread-2:
Traceback (most recent call last):
File "/usr/lib/python3.5/threading.py", line 914, in _bootstrap_inner
self.run()
File "/usr/local/bin/sniff-probe-req", line 239, in run
probe_request = self.parse(packet)
File "/usr/local/bin/sniff-probe-req", line 273, in parse
essid = packet.getlayer(Dot11ProbeReq).info.decode("utf-8")
AttributeError: 'NoneType' object has no attribute 'info'

Use the logging package

Refactor the --debug option by using the logging package.

Execute tests automatically before each commit

Use the pre-commit Git hook to execute the tests automatically before each commit.

Create DEB and RPM packages

Create automatically a DEB and RPM package when releasing a new version.

Error when trying to decode ESSIDs using invalid UTF-8 characters

An exception is raised when an ESSID contains invalid UTF-8 characters:

Exception in thread Thread-2:
Traceback (most recent call last):
  File "/usr/lib/python3.6/threading.py", line 916, in _bootstrap_inner
    self.run()
  File "/usr/local/bin/sniff-probe-req", line 239, in run
    probe_request = self.parse(packet)
  File "/usr/local/bin/sniff-probe-req", line 273, in parse
    essid = packet.getlayer(Dot11ProbeReq).info.decode("utf-8")
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xfd in position 1: invalid start byte

Instant error while running

Running probquest -i wlan0 instantly results in this error:

root@raspberrypi:/# probequest -i wlan0
[*] Start sniffing probe requests...
Exception in thread Thread-2:
Traceback (most recent call last):
  File "/usr/lib/python3.5/threading.py", line 914, in _bootstrap_inner
    self.run()
  File "/usr/local/lib/python3.5/dist-packages/probequest/probe_request_sniffer.py", line 251, in run
    probe_request = self.parse(packet)
  File "/usr/local/lib/python3.5/dist-packages/probequest/probe_request_sniffer.py", line 285, in parse
    essid = packet.getlayer(Dot11ProbeReq).info.decode("utf-8")
AttributeError: 'NoneType' object has no attribute 'info'

The software is running on a Raspberry PI 3 with the most recent raspbian.

libpcap0.8 version 1.10 breaks the application

Installed on Kali machine. After fresh kali installations the program works just fine, but after a full-upgrade of the OS, probequest stops working with the following error

Exception in thread Thread-2:
Traceback (most recent call last):
File "/usr/lib/python3.9/threading.py", line 954, in _bootstrap_inner
self.run()
File "/usr/lib/python3.9/threading.py", line 892, in run
self._target(*self._args, **self._kwargs)
File "/usr/lib/python3/dist-packages/scapy/sendrecv.py", line 906, in _run
sniff_sockets[L2socket(type=ETH_P_ALL, iface=iface,
File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 407, in init
attach_filter(self.ins, filter, iface)
File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 142, in attach_filter
bp = compile_filter(bpf_filter, iface)
File "/usr/lib/python3/dist-packages/scapy/arch/common.py", line 128, in compile_filter
raise Scapy_Exception(
scapy.error.Scapy_Exception: Failed to compile filter expression type mgt subtype probe-req (-1)

I had similar problems with bettercap when the program was trying to set the wifi adapter in monitor mode, and the problem was there with the library "libpcap0.80" which is updated in version 1.10 lately.

We tried installing the previous version 1.9.1 and both applications now work perfectly.

I am also addressing the issue here, in order to help anybody else experiencing the same problems.
Not really a bug of the program but of the libraries it seems to make use of.

Monitor GitHub Actions dependencies with Dependabot

Set a Wi-Fi channel

Hi, can you please explain a concept of channel switching? I suppose that Wi-Fi devices use several channels to broadcast their probe frames. How can I define a channel to collect such requests using your script?

Can there be a Fix to MAC ADDRESS RANDOMIZATION

Since Mac address randomization is on by default on most devices

this make the probe sniffing a bit useless

So i think it can maybe be fixed a bit

1. We can fingerprint devices that probe for certain ssids

like for example if it we catch a mac probing for skyplabs network
then we use that mac address to link the reset of the other probes together to know that they are coming from which device

2. collecting probe requests for already connected devices to nearby networks
   i don't know actually how to do that but here what i noticed

when deauthing a network for a couple of SECs
and monitoring it with airodump-ng

You can actually see all the probs lined together for each device on that network even that they are using Mac randomization but it still works some how

You can try that by trying to capture a 4-way-handshake manually

There is also these two attacks that uses some form of advanced methods to break the Randomization but i wasn't able to fully understand

Three Years Later: A Study of MAC Address Randomization In Mobile Devices And When It Succeeds PDF

Defeating MAC Address Randomization Through Timing Attacks PDF

RESEARCHERS BREAK MAC ADDRESS RANDOMIZATION AND TRACK 100% OF TEST DEVICES

Thanks

Add an option to display the version

Add an option to the sniff-probe-req script to display the current version of the software.

For example:

$ sniff-probe-req --version
v0.5.0

Capture the RSSI

It is now possible to read the RSSI with Scapy: secdev/scapy#1982.

scapy.error.Scapy_Exception: Failed to compile filter expression type mgt subtype probe-req (-1)

when running it on my raspberry i get this error:
`!
pi@raspberrypi:~/Probe-Hunter $ sudo probequest -i wlan0
[*] Start sniffing probe requests...
Exception in thread Thread-2:
Traceback (most recent call last):
File "/usr/lib/python3.7/threading.py", line 917, in _bootstrap_inner
self.run()
File "/usr/lib/python3.7/threading.py", line 865, in run
self._target(*self._args, **self._kwargs)
File "/usr/local/lib/python3.7/dist-packages/scapy/sendrecv.py", line 907, in _run
*arg, **karg)] = iface
File "/usr/local/lib/python3.7/dist-packages/scapy/arch/linux.py", line 407, in init
attach_filter(self.ins, filter, iface)
File "/usr/local/lib/python3.7/dist-packages/scapy/arch/linux.py", line 142, in attach_filter
bp = compile_filter(bpf_filter, iface)
File "/usr/local/lib/python3.7/dist-packages/scapy/arch/common.py", line 129, in compile_filter
"Failed to compile filter expression %s (%s)" % (filter_exp, ret)
scapy.error.Scapy_Exception: Failed to compile filter expression type mgt subtype probe-req (-1)

[] Stopping the threads...
^C[] Bye!
`

i tried to reinstall tcpdump as suggested on the web, but it wont work.

Drop support for Python 3.6

Add Python 3.7 to the build matrix

Use AsyncSniffer from Scapy

Scapy has introduced the AsyncSniffer class since version 2.4.3. ProbeQuest should use it instead of the current implementation.

Possible on Windows?

Just wondering if this is capable with Windows10?

Cheers

Make some dependencies optional

Some dependencies are only required for extra features not essential to the good functioning of ProbeQuest. It is the case for example of the option --fake.

These dependencies should be removed from the install_requires list in setup.py and placed into a separate list in extras_require.

Exception in thread Thread-2:

Describe the bug

I've installed probequest, but when I try to run it, it returns this error:
[*] Start sniffing probe requests... [!] ESSID filters: None [!] ESSID regex: None [!] Ignore case: False Exception in thread Thread-2: Traceback (most recent call last): File "/usr/lib/python3.9/threading.py", line 954, in _bootstrap_inner self.run() File "/usr/lib/python3.9/threading.py", line 892, in run self._target(*self._args, **self._kwargs) File "/usr/lib/python3/dist-packages/scapy/sendrecv.py", line 906, in _run sniff_sockets[L2socket(type=ETH_P_ALL, iface=iface, File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 407, in __init__ attach_filter(self.ins, filter, iface) File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 142, in attach_filter bp = compile_filter(bpf_filter, iface) File "/usr/lib/python3/dist-packages/scapy/arch/common.py", line 128, in compile_filter raise Scapy_Exception( scapy.error.Scapy_Exception: Failed to compile filter expression type mgt subtype probe-req (-1)

To Reproduce

Install: probequest -i wlan0 --debug
command used: probequest -i wlan0mon --debug (at first I tried without debug of course)

Expected behaviour

Scan wireless networks :)

Execution environment

Please complete the following information:

• OS: [e.g. Debian Stretch] Kali 2021.1
• Python version: [e.g. 3.6] Python 3.9.1+
• ProbeQuest version: [e.g. 0.7.0] 0.7.2
• Method of installation: [e.g. pip] pip3 install --upgrade probequest

Test the argument parser

Add unit tests to test the argument parser.

Add 'pyproject.toml' and 'setup.cfg'

Test ProbeQuest on macOS

Python builds are not available on macOS environments on Travis CI, but there are workarounds: https://docs.travis-ci.com/user/languages/python/#running-python-tests-on-multiple-operating-systems.

The sniffer stops after having received the first frame

Unlike the stop_callback method used by scapy3k, the stop_filter method used by scapy requires one positional argument, raising the following exception:

is_set() takes 1 positional argument but 2 were given

However, because the exceptions occurring inside the PacketSniffer thread are captured only once, just after the sniffer has started, no error is displayed during the runtime.

Perform an evil twin attack based on the captured probe requests

Sniffing nearby APs and broadcasting them to allow users to connect, set up an authentication portal page

Thanks for the author's work

Use Sphinx for the documentation

Move the content of the wiki hosted on GitHub to a documentation written with Sphinx and committed inside the main Git repository.

Switch to tox

[skyper@desktop0:~/Documents/SkypLabs/probequest]$ python3 setup.py test                                                                                                                                                                                                        
running test                                                                                                                                                                                                                                                                    
WARNING: Testing via this command is deprecated and will be removed in a future version. Users looking for a generic test entry point independent of test runner are encouraged to use tox.

tox website: https://tox.readthedocs.io/en/latest/

Use an entry point to create the CLI tool

See the entry points specification.

A WPA 2 karma attack (saved network handshaker )

as karma attacks works on saved open networks only and not secured ones so we will need to have the password first to get it work although this seems a bit hard... the number of saved networks Guarantee that there is a one with a weak password... so will need to make the karma attack start two networks of the targeted prob one open and the second secured and the victim will auto connect to the one with the correct configuration with the saved obviously correct password and we save that handshake with the other handshakes captured form the same device to brute force and break the ones with the weak passwords.

Dependabot couldn't authenticate with https://pypi.python.org/simple/

Dependabot couldn't authenticate with https://pypi.python.org/simple/.

You can provide authentication details in your Dependabot dashboard by clicking into the account menu (in the top right) and selecting 'Config variables'.

View the update logs.

Add Pylint to the tests

Execute Pylint when doing python3 setup.py test.

error after ruuning script

i have a fully updated kali machine and have installed and tried to run the script and i'm getting an error message.
in the example you can see my script version and my adapter is in monitor mode. Any ideas how to fix this? thanks

┌──(kali㉿kali)-[~]
└─$ sudo airmon-ng

PHY Interface Driver Chipset

phy0 wlan0 88XXau Realtek Semiconductor Corp. RTL8812AU 802.11a/b/g/n/ac 2T2R DB WLAN Adapter

┌──(kali㉿kali)-[~]
└─$ sudo probequest --version
0.7.2

┌──(kali㉿kali)-[~]
└─$ sudo probequest --i wlan0
[*] Start sniffing probe requests...
Exception in thread Thread-1:
Traceback (most recent call last):
File "/usr/lib/python3.9/threading.py", line 954, in _bootstrap_inner
self.run()
File "/usr/lib/python3.9/threading.py", line 892, in run
self._target(*self._args, **self._kwargs)
File "/usr/lib/python3/dist-packages/scapy/pipetool.py", line 114, in run
p.start()
File "/usr/lib/python3/dist-packages/scapy/scapypipes.py", line 51, in start
self.s = conf.L2listen(iface=self.iface, filter=self.filter)
File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 407, in init
attach_filter(self.ins, filter, iface)
File "/usr/lib/python3/dist-packages/scapy/arch/linux.py", line 142, in attach_filter
bp = compile_filter(bpf_filter, iface)
File "/usr/lib/python3/dist-packages/scapy/arch/common.py", line 128, in compile_filter
raise Scapy_Exception(
scapy.error.Scapy_Exception: Failed to compile filter expression type mgt subtype probe-req (-1)

Add a JSON exporter

This is a greatly requested feature.