Wireless Hacking

Wireless Hacking By Yopie Indra -05.41010.0220

Dengan kemudahan mengakses internet melalui wireless, banyak pengguna laptop selalu mencari atau memanfaatkan hotspot yang ada untuk selalu aktif. Ada yang hanya sekedar buka email, ada yang cuman sekedar browsing, bahkan, ada juga yang sampai mengirim tugas kantor. Para pemilk dan pengguna hotspot tidak menyadari bahwa mungkin, diantara mereka ada yang berniat jahat. Untuk kasus sederhana, sebuah hotspot umum palsu dapat menjebak para pemakainya untuk memberikan username dan password mereka tanpa mereka sadari bahwa mereka telah memberikannya. dalam artikel ini, akan saya jelaskan beberapa trik yang digunakan oleh beberapa orang yang berniat jelek dalam memakai wireless. Untuk masalah pencegahannya, bisa dilihat di artikel lain di website ini yang memberikan solusi dan pencegahannya.
Untuk melakukan wireless hacking, langkah pertama yang dilakukan adalah mencari wireless network yang terdekat dengan anda. Hal itu bisa dilakukan dengan wardrive (jika dilakukan diluar ruangan) atau berkeliling mengitari hotspot yang ada (jika di dalam ruangan). Dalam artikel ini, penulis mencoba menguraikan cara menggunakan wardrive karena lebih aman dan mengingat kita hanya mencoba untuk mengetahui jaringan wireless mana saja yang lemah.

Wardrive

Wardrive adalah ekspedisi memancing elektronik untuk mencari jaringan wireless yang lemah di sekitar anda. Kebanyakan, sebagian besar dari jaringan wireless tersebut bahkan tidak diberi password atau enkripsi untuk melindunginya.
Kegiatan ini dilakukan untuk mencari jaringan mana saja yang akan dijadikan obyek serangan. Sehingga, kita bisa melakukan serangan terhadap jaringan wireless yang telah kita jadikan target. Untuk melakukan kegitan ini, diperlukan peralatan sederhana untuk memulainya.
Daftar peralatan yang dibutuhkan:
• GPS receiver
jika daerah anda sudah memiliki GPS, anda dapat dengan mudah menandai daerah mana saja yang sudah anda jelajahi dan memberi tanda khusus dimana dalam daerah yang sudah anda jelajahi tersebut terdapat jaringan wireless yang lemah.
• Wireless PCMI card
Peralatan ini dibutuhkan untuk memperluas jaringan wireless anda. Biasanya, peralatan ini dilengkapi dengan jack untuk wireless antenna receiver atau mensupport jaringan selular untuk memperoleh jaringan yang lebih luas.
• Wireless antenna receiver
Peralatan ini dibutuhkan untuk menambah jangkauan wireless PCMI card yang anda punya dengan menghubungkan jack yang dimilikinya ke dalam wireless card anda. Jika wireless card yang anda miliki tidak mempunyai jack, anda bisa membeli wireless antenna yang memakai port usb yang sudah banyak beredar di pasaran. Tapi, jika anda merasa tidak puas dengan kemampuan memperoleh jaringan menggunakan peralatan yang anda miliki, anda bisa membikinnya dengan murah dengan mengikuti petunjuk yang ada di dalam website dibawah ini :
http://www.instructables.com/id/EQARE4I72GEPUCHTHU/

Pencarian Wireless Network

Kebanyakan jaringan wireless yang beredar tidak mempunyai sekuriti atau enkripsi yang melindunginya. Untuk melacaknya, dibutuhkan peralatan yang mendukung. Ada dua tools yang biasanya dipakai untuk tujuan ini.
• Network Stumbler atau lebih dikenal NetStumbler
Software berbasis windows ini sangat mudah mencari sinyal wireless yang dipancarkan dari hotspot ke pengguna. Penulis banyak menjumpai para pengguna wireless memakai software ini untuk mencari lokasi yang tepat untuk mendapat sinyal wireless dari hotspot yang kuat atau mensurvei apakah hotspot di daerahnya cukup bagus atau tidak.
• Kismet
Salah satu fungsi yang hilang dari NetStumbler adalah kemampuan untuk menampilkan SSID dari hotspot. pada access point, mereka selalu rutin membroadcast info ini. cuman, info tersebut kebanyakan berisi SSID yang tidak terbaca atau terenkripsi. Program ini akan mencari dan menampilkan SSID yang tidak di broadcast oleh hotspot dan sangat penting untuk mencari jaringan wireless yang akan diuji.

Memasuki jaringan wireless yang telah ditemukan

Setelah menemukan sebuah jaringan network, langkah selanjutnya adalah mencoba untuk menghubungkan anda ke jaringan tersebut. Jika jaringan tersebut tidak menggunakan sekuriti enkripsi, anda bisa langsung mengakses ke SSID. Jika SSID tidak di broadcast, anda dapat masuk dengan SSID yang sedang tidak di broadcast. Tentu saja, anda dapat dengan mudah menemukan yang tidak di broadcast menggunakan fitur yang ada kismet bukan? Jika jaringan tersebut dienkripsi, anda membutuhkan salah satu dari peralatan dibawah ini.
• CowPatty
Software ini menggunakan metode brute force untuk membuka WPA-PSK, yang mana PSK sendiri dianggap sebagai WEP baru unrtuk keamanan sekuriti wireless di rumah.Progam ini mencoba beberapa dari berbagai pilihan yang berasal dari file dictionary apakah ada yang sesuai dengan apa yang digunakan sebagai kunci tersebut
• ASLeap
jika ada jaringan yang menggunakan LEAP, alat ini bisa digunakan untuk mencari data semacam username dan password yang sedang online di jaringan, dan mengoverride akses pemiliknya.LEAP tidak memproteksi proses tersebut seperti EAP, yang mana itu menjadi kelemahan utama bagi LEAP.

Mengendus atau mencuri Data Wireless

Tidak peduli apakah anda terkoneksi langsung ke jaringan wireless atau tidak,, jika ada jaringan wireless di dalam daerah dekat anda, selalu ada data yang lewat di dalam jaringan kapan pun itu. Untuk mengambil data itu, anda perlu peralatan untuk mengambil atau melihat data tersebut.
• Wireshark (pendahulu Ethereal)
dimana masih terjadi perdebatan bagaimana cara ynag tercepat dalam menyikapi program ini, tidak ada keraguan lagi bahwa software ini sangat berguna. ia dapat mencari jaringan wireless yang ada lengkap dengan info sekuriti. software ini dapat mecuri data dari 802.11 manajemen hotspot dan bisa juga digunakan sebagai alat untuk mencari hotspot yang tidak memproteksi dirinya dengan SSID.
• SwitchSniffer
Software ini adalah program yang bisa mencari user yang aktif di jaringan switch LAN dan dapat mengambil seluruh packet data tanpa persetujuan user yang bersangkutan, software ini juga dapat mendeteksi program arpspoofer sedang berjalan dan membokir sesi pertahanan semacam firewal. jika anda menggabungkan program ini dengan program sniffer yang lain, anda dapat melihat dan mengambil id user dan password dari user lain di dalam jaringan anda.

Tindakan anda selanjutnya?

Setelah anda mengetahui bagaimana proses hacking, terserah anda mau diapakan data ataupun hotspot yang telah anda temukan dan anda eksploitasi itu. jika anda mau melaporkan ke admin hotspot bahwa ada kelemahan, anda telah menjadi bagian dari Ethical hacker. tapi, jika anda malah makin mengeksploitasi hotspot tersebut, maka anda menjadi Blackcap Hacker. anda mau memilih menjadi apa, itu hak anda. penulis hanya membagi info saja. semoga tutorial ini bermanfaat bagi anda.

Sumber:
- hack proofing your network
- hacking wireless network for dummies
- http://www.ethicalhacker.net/content/view/16/24/

Hack Wifi,WIFI HACKING, hacker wifi, wireless Hack, How Hack Wifi, Cara menhack wifi

Hacking On Xp Part III

How to Forge Email with Windows XP Telnet

Want a computer you can telnet into and mess around with, and not get into trouble no matter what you do to it? I've set up my
techbroker.com (206.61.52.33) with user xyz, password guest for you to play with. Here's how to forge email to xyz@techbroker.com using
telnet. Start with the command:

C:\>telnet techbroker.com 25
Connecting To Techbroker.com

220 <techbroker.com> Service ready

Now you type in who you want the message to appear to come from:

helo santa@techbroker.com
Techbroker.com will answer:

250 <techbroker.com> host ready

Next type in your mail from address:

mail from:santa@techbroker.com

250 Requested mail action okay, completed

Your next command:

rcpt to:xyz@techbroker.com
250 Requested mail action okay, completed

Your next command:
data
354 Start main input; end with <CRLF>.<CRLF>

Newbie note: <CRLF> just means hit return. In case you can't see that little period between the <CRLF>s, what you do to end composing your email is to hit enter, type a period, then hit enter again.

Anyhow, try typing:

This is a test.
.
250 Requested mail action okay, completed
quit
221 <techbroker.com> Service closing transmission channel

Connection to host lost.

Using techbroker's mail server, even if you enable full headers, the
message we just composed looks like:

Status: R
X-status: N

This is a test.

That's a pretty pathetic forged email, huh? No "from", no date.
However, you can make your headers better by using a trick with the data command. After you give it, you can insert as many headers as you choose. The trick is easier to show than explain:

220 <techbroker.com> Service ready
helo santa@northpole.org
250 <techbroker.com> host ready
mail from:santa@northpole.com
250 Requested mail action okay, completed
rcpt to:<script language="JavaScript"><!-- var name = "cmeinel"; var domain = "techbroker.com"; document.write('<a href=\"mailto:' + name + '@' + domain + '\">'); document.write(name + '@' + domain + '</a>'); // --></script>
250 Requested mail action okay, completed
data
354 Start main input; end with <CRLF>.<CRLF>
from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
.
250 Requested mail action okay, completed
quit
221 <techbroker.com> Service closing transmission channel

Connection to host lost.

The message then looks like:

from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.

The trick is to start each line you want in the headers with one word
followed by a colon, and the a line followed by "return". As soon as
you write a line that doesn't begin this way, the rest of what you
type goes into the body of the email.

Notice that the santa@northpole.com from the "mail from:" command didn't show up in the header. Some mail servers would show both "from" addresses.

You can forge email on techbroker.com within one strict limitation.
Your email has to go to someone at techbroker.com. If you can find any way to send email to someone outside techbroker, let us know, because you will have broken our security, muhahaha! Don't worry, you have my permission.

Next, you can read the email you forge on techbroker.com via telnet:

C:\>telnet techbroker.com 110

+OK <30961.5910984301@techbroker.com> service ready

Give this command:
user xyz
+OK user is known

Then type in this:
pass test
+OK mail drop has 2 message(s)

retr 1
+OK message follows
This is a test.

If you want to know all possible commands, give this command:

help
+OK help list follows
USER user
PASS password
STAT
LIST [message]
RETR message
DELE message
NOOP
RSET
QUIT
APOP user md5
TOP message lines
UIDL [message]
HELP

Unless you use a weird online provider like AOL, you can use these
same tricks to send and receive your own email. Or you can forge email to a friend by telnetting to his or her online provider's email
sending computer(s).

Hacking On XP Part II

How to Telnet with Windows XP

The queen of hacker commands is telnet. To get Windows help for
telnet, in the cmd.exe window give the command:

C:\>telnet /?

Here's what you will get:

telnet [-a][-e escape char][-f log file][-l user][-t term][host
[port]]
-a Attempt automatic logon. Same as -l option except uses
the currently logged on user's name.
-e Escape character to enter telnet client prompt.
-f File name for client side logging
-l Specifies the user name to log in with on the remote system.
Requires that the remote system support the TELNET ENVIRON
option.
-t Specifies terminal type.
Supported term types are vt100, vt52, ansi and vtnt only.
host Specifies the hostname or IP address of the remote computer
to connect to.

port Specifies a port number or service name.

****************
Newbie note: what is a port on a computer? A computer port is sort of like a seaport. It's where things can go in and/or out of a computer. Some ports are easy to understand, like keyboard, monitor, printer and modem. Other ports are virtual, meaning that they are created by software. When that modem port of yours (or LAN or ISDN or DSL) is connected to the Internet, your computer has the ability to open or close any of over 65,000 different virtual ports, and has the ability to connect to any of these on another computer - if it is running that port, and if a firewall doesn?t block it.
****************
****************
Newbie note: How do you address a computer over the Internet? There are two ways: by number or by name.
****************

The simplest use of telnet is to log into a remote computer. Give the
command:

C:/>telnet targetcomputer.com (substituting the name of the computer you want to telnet into for targetcomputer.com)

If this computer is set up to let people log into accounts, you may
get the message:

login:

Type your user name here, making sure to be exact. You can't swap between lower case and capital letters. For example, user name Guest is not the same as guest.

****************
Newbie note: Lots of people email me asking how to learn what their user name and password are. Stop laughing, darn it, they really do. If you don't know your user name and password, that means whoever runs that computer didn't give you an account and doesn't want you to log on.
****************

Then comes the message:

Password:

Again, be exact in typing in your password.

What if this doesn't work?

Every day people write to me complaining they can't telnet. That is
usually because they try to telnet into a computer, or a port on a
computer that is set up to refuse telnet connections. Here's what it
might look like when a computer refuses a telnet connection:

C:\ >telnet 10.0.0.3
Connecting To 10.0.0.3...Could not open connection to the host, on port 23. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

Or you might see:

C:\ >telnet techbroker.com
Connecting To techbroker.com...Could not open connection to the host, on port 23.
No connection could be made because the target machine actively
refused it.

If you just give the telnet command without giving a port number, it
will automatically try to connect on port 23, which sometimes runs a
telnet server.

**************
Newbie note: your Windows computer has a telnet client program,
meaning it will let you telnet out of it. However you have to install
a telnet server before anyone can telnet into port 23 on your
computer.
*************

If telnet failed to connect, possibly the computer you were trying to
telnet into was down or just plain no longer in existence. Maybe the
people who run that computer don't want you to telnet into it.

How to Telnet into a Shell Account

Even though you can't telnet into an account inside some computer, often you can get some information back or get that computer to do something interesting for you. Yes, you can get a telnet connection to succeed -without doing anything illegal --against almost any computer, even if you don't have permission to log in. There are many legal things you can do to many randomly chosen computers with telnet. For example:

C:/telnet freeshell.org 22

SSH-1.99-OpenSSH_3.4p1

That tells us the target computer is running an SSH server, which enables encrypted connections between computers. If you want to SSH into an account there, you can get a shell account for free at
<http://freeshell.org/> . You can get a free SSH client program from
<http://winfiles.com/> .

One reason most hackers have shell accounts on Internet servers is because you can meet the real hackers there. When you've logged in, give the command w or who. That gives a list of user names. You can talk to other users with tht talk command. Another fun thing, if your shell account allows it, is to give the command

ps -auxww

It might tell you what commands and processes other users are running. Ask other users what they are doing and they might teach you something. Just be careful not to be a pest!

***************
You can get punched in the nose warning: Your online provider might kick you off for making telnet probes of other computers. The solution is to get a local online provider and make friends with the people who run it, and convince them you are just doing harmless, legal explorations.
*************

Sometimes a port is running an interesting program, but a firewall won't let you in. For example, 10.0.0.3, a computer on my local area network, runs an email sending program, (sendmail working together with Postfix, and using Kmail to compose emails). I can use it from an account inside 10.0.0.3 to send emails with headers that hide from where I send things.

If I try to telnet to this email program from outside this computer,
here's what happens:

C:\>telnet 10.0.0.3 25
Connecting To 10.0.0.3...Could not open connection to the host, on
port 25.
No connection could be made because the target machine actively
refused it.

However, if I log into an account on 10.0.0.3 and then telnet from
inside to port 25, here's what I get:

Last login: Fri Oct 18 13:56:58 2002 from 10.0.0.1
Have a lot of fun...
cmeinel@test-box:~> telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1... [Carolyn's note: 127.0.0.1 is the numerical
address meaning localhost, the same computer you are logged into]
Connected to localhost.
Escape character is '^]'.
220 test-box.local ESMTP Postfix

The reason I keep this port 25 hidden behind a firewall is to keep
people from using it to try to break in or to forge email. Now the
ubergeniuses reading this will start to make fun of me because no
Internet address that begins with 10. is reachable from the Internet.
However, sometimes I place this "test-box" computer online with a
static Internet address, meaning whenever it is on the Internet, it
always has the same numerical address. I'm not going to tell you what its Internet address is because I don't want anyone messing with it. I just want to mess with other people's computers with it, muhahaha. That's also why I always keep my Internet address from showing up in the headers of my emails.

***************
Newbie note: What is all this about headers? It's stuff at the
beginning of an email that may - or may not - tell you a lot about
where it came from and when. To see full headers, in Outlook click
view -> full headers. In Eudora, click the "Blah blah blah" icon.
****************