WiFi Pumpkin Framework for Rogue Wi-Fi Access Point Attack

WiFi Pumpkin - Framework for Rogue WiFi Access Point Attack

WiFi Pumpkin
The purpose of attacks with a fraudulent access point (Rogue WiFi Access Point Attack) is not a password from a WiFi network, but data transmitted through this access point. In relation to these data, a mediator attack is being carried out - the Man-In-The-Middle attacks. In the transmitted data, you can catch the credentials (logins and passwords) from websites, find out which sites have been visited, what data the user entered, and more.

Setting up a Rogue Access Point is to set up a wireless access point - the process was no different if you wanted to start distributing wireless Internet from your computer to Linux. But its subsequent attacks by the middleman make it fraudulent

There are tools that automate the process of creating configuration files for a wireless access point, as well as ensure the correct routing of traffic. Such tools include, for example, create_ap .

These same actions, but still additionally launching man in the middle attacks, are done by the mitmAPtool .

WiFi Pumpkin is a rogue AP framework to easily create these fake networks, all while forwarding legitimate traffic to and from the unsuspecting target. It comes stuffed with features, including rogue Wi-Fi access points, deauth attacks on client APs, a probe request and credentials monitor, transparent proxy, Windows update attack, phishing manager, ARP Poisoning, DNS Spoofing, Pumpkin-Proxy, and image capture on the fly. moreover, the WiFi-Pumpkin is a very complete framework for auditing Wi-Fi security check the list of features is quite broad.
Your wireless adapter and your kernel driver must support AP mode. if you dont have one check our list of usb wifi adapter monitor mode

Python 2.7
git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git
 cd WiFi-Pumpkin
 ./installer.sh --install
or download .deb file to install
sudo dpkg -i wifi-pumpkin-0.8.7-all.deb
sudo apt-get -f install # force install dependencies if not install normally
  • Rogue WiFi Access Point
  • Deauth Attack Clients AP
  • Probe Request Monitor
  • DHCP Starvation Attack
  • Credentials Monitor
  • Transparent Proxy
  • Windows Update Attack
  • Phishing Manager
  • Partial Bypass HSTS protocol
  • Support beef hook
  • ARP Poison
  • DNS Spoof
  • Patch Binaries via MITM (BDF-Proxy)
  • LLMNR, NBT-NS and MDNS poisoner (Responder)
  • Pumpkin-Proxy (ProxyServer (mitmproxy API))
  • Capture images on the fly
  • TCP-Proxy (with scapy)
  • Moduled plugins and proxys
  • Wireless Mode support hostapd-mana/hostapd-karma attacks
WiFi Pumpkin

Dns2proxyThis tools offer a different features for post-explotation once you change the DNS server to a Victim.
Sstrip2Sslstrip is a MITM tool that implements Moxie Marlinspike's SSL stripping attacks based version fork @LeonardoNve/@xtr4nge.
Sergio_proxySergio Proxy (a Super Effective Recorder of Gathered Inputs and Outputs) is an HTTP proxy that was written in Python for the Twisted framework.
BDFProxyPatch Binaries via MITM: BackdoorFactory + mitmProxy, bdfproxy-ng is a fork and review of the original BDFProxy @secretsquirrel.
ResponderResponder an LLMNR, NBT-NS and MDNS poisoner. Author: Laurent Gaffie

Transparent Proxy

Transparent proxies(mitmproxy) that you can use to intercept and manipulate HTTP traffic modifying requests and responses, that allow to inject javascripts into the targets visited. You can easily implement a module to inject data into pages creating a python file in directory "plugins/extension/" automatically will be listed on Pumpkin-Proxy tab.

Plugins Example Dev
from mitmproxy.models import decoded # for decode content html
from plugins.extension.plugin import PluginTemplate
class Nameplugin(PluginTemplate):
   meta = {
       'Name'      : 'Nameplugin',
       'Version'   : '1.0',
       'Description' : 'Brief description of the new plugin',
       'Author'    : 'by dev'
   def __init__(self):
       for key,value in self.meta.items():
           self.__dict__[key] = value
       # if you want set arguments check refer wiki more info.
       self.ConfigParser = False # No require arguments
   def request(self, flow):
       print flow.__dict__
       print flow.request.__dict__
       print flow.request.headers.__dict__ # request headers
       host = flow.request.pretty_host # get domain on the fly requests
       versionH = flow.request.http_version # get http version
       # get redirect domains example
       # pretty_host takes the "Host" header of the request into account,
       if flow.request.pretty_host == "example.org":
           flow.request.host = "mitmproxy.org"
       # get all request Header example
       self.send_output.emit("\n[{}][HTTP REQUEST HEADERS]".format(self.Name))
       for name, valur in flow.request.headers.iteritems():
           self.send_output.emit('{}: {}'.format(name,valur))
       print flow.request.method # show method request
       # the model printer data
       self.send_output.emit('[NamePlugin]:: this is model for save data logging')
   def response(self, flow):
       print flow.__dict__
       print flow.response.__dict__
       print flow.response.headers.__dict__ #convert headers for python dict
       print flow.response.headers['Content-Type'] # get content type
       #every HTTP response before it is returned to the client
       with decoded(flow.response):
           print flow.response.content # content html
           flow.response.content.replace('</body >','<h1 >injected< / h1></body >') # replace content tag
       del flow.response.headers["X-XSS-Protection"] # remove protection Header
       flow.response.headers["newheader"] = "foo" # adds a new header
       #and the new header will be added to all responses passing through the proxy

TCP-Proxy Server
A proxy that you can place between in a TCP stream. It filters the request and response streams with (scapy module) and actively modify packets of a TCP protocol that gets intercepted by WiFi-Pumpkin. this plugin uses modules to view or modify the intercepted data that possibly easiest implementation of a module, just add your custom module on "plugins/analyzers/" automatically will be listed on TCP-Proxy tab.
from scapy.all import *
from scapy_http import http # for layer HTTP
from default import PSniffer # base plugin class

class ExamplePlugin(PSniffer):
    _activated     = False
    _instance      = None
    meta = {
        'Name'      : 'Example',
        'Version'   : '1.0',
        'Description' : 'Brief description of the new plugin',
        'Author'    : 'your name',
    def __init__(self):
        for key,value in self.meta.items():
            self.__dict__[key] = value

    def getInstance():
        if ExamplePlugin._instance is None:
            ExamplePlugin._instance = ExamplePlugin()
        return ExamplePlugin._instance

    def filterPackets(self,pkt): # (pkt) object in order to modify the data on the fly
        if pkt.haslayer(http.HTTPRequest): # filter only http request

            http_layer = pkt.getlayer(http.HTTPRequest) # get http fields as dict type
            ip_layer = pkt.getlayer(IP)# get ip headers fields as dict type

            print http_layer.fields['Method'] # show method http request
            # show all item in Header request http
            for item in http_layer.fields['Headers']:
                print('{} : {}'.format(item,http_layer.fields['Headers'][item]))

            print ip_layer.fields['src'] # show source ip address
            print ip_layer.fields['dst'] # show destiny ip address

            print http_layer # show item type dict
            print ip_layer # show item type dict

            return self.output.emit({'name_module':'send output to tab TCP-Proxy'})

Launch WiFi Pumpkin
The launch is done by the command:
Please note that when trying to start from a regular user (not root), the program does not work.
After launch, the following interface opens:
configure WiFi-Pumpkin
Go to the settings and change the name of the access point (I chose FreeWifi):

In the Activity Monitor settings, I put check marks on HTTP-Requests (web requests), HTTP-Authentication (credentials from websites), and Pumpkin-Proxy .

In the Plugins tab, select what is more important to you. Pumpkin-Proxy allows you to use various ready-made solutions (kilogera, BeEF , code injection, etc. But SSLStrip + paired with dns2proxy allow you to bypass HTTPS and intercept much more credentials.
The Plugins tab has a brief description of each plug-in.
When setup is complete, click Start .
Pumpkin-Proxy Plugins
The following plugins are available in the Pumpkin-Proxy tab :
Plugin nameShort description
beefThis module injects JavaScript code that “ hooks ” onto BeEF . As an option, you need to specify the address of the .js file.
dnsspoofReplaces the Domain Name Server (DNS) responses. In the setting you need to specify for which domain name, which one to return IP.
downloadspoofReplaces files uploaded via HTTP to their malicious versions.
dump_post_dataCollects captured HTTP POST data from login pages.
html_injectInjects arbitrary HTML code into a vulnerable web page.
inverted_internetAdds an HTML style to invert the contents of the body tag.
js_injectInjects a JavaScript code into the page, as an option, you must specify the URL of the file with the code.
keyloggerWrites all button presses with timestamps to an array and sends the attacker.
replaceImagesReplaces all the images in the specified image settings.
shakepagePlugin adds javascript with page shake effect.
stickycookieMonitoring of traffic on Cookie and Set-Cookie headers.
upsidedownternetTurns upside down images on sites.
Some of them have options. To change plug-in options, click Settings next to the name of the plug-in. All of these plugins will only work on websites without HTTPS.

Wifi Hacking
March 10, 2019



Popular Posts

USB WiFi adapters that support monitor mode and wireless injection

usb wifi adapter with monitor mode and wireless injection (100% compatibl…

how to update Kali Linux and Fix update error

Kali Linux one of the best Linux distro for penetration testing it's freq…

Fix Kali Linux sources.list Repositories

Fix default repository First after installing a clean Kali Linux the sou…

Recent Comments

Contact Me