WAIDPS (Wireless Auditing and IDS/IPS) :: Tools
WAIDPS (Wireless Auditing, Intrusion Detection and Prevention System) is an open source wireless swissknife written in Python and work on Linux environment. This is a multipurpose tools designed for audit (penetration testing) networks, detect wireless intrusion (WEP/WPA/WPS attacks) and also intrusion prevention (stopping station from associating to access point). Apart from these, it will harvest all WiFi information in the surrounding and store in databases. This will be useful when it comes to auditing a network if the access point is ‘MAC filtered’ or ‘hidden SSID’ and there isn’t any existing client at that moment.
WAIDPS may be useful to penetration testers, wireless trainers, law enforcement agencies and those who is interested to know more about wireless auditing and protection. The primarily purpose for this script is to detect intrusion. Once wireless detect is found, it display on screen and also log to file on the attack. Additional features are added to current script where previous
WIDS does not have are :
- automatically save the attack packets into a file
- interactive mode where users are allow to perform many functions
- allow user to analyse captured packets
- load previously saved pcap file or any other pcap file to be examine
- customizing filters
- customize detection threshold (sensitivity of IDS in detection)
At present, WAIDPS is able to detect the following wireless attacks and will subsequently add other detection found in the previous WIDS.
- Association / Authentication flooding
- Detect mass deauthentication which may indicate a possible WPA attack for handshake
- Detect possible WEP attack using the ARP request replay method
- Detect possible WEP attack using chopchop method
- Detect possible WPS pin bruteforce attack by Reaver, Bully, etc.
- Detection of Evil-Twin
- Detection of Rogue Access Point
The whole structure of the Wireless Auditing, Intrusion Detection & Prevention System will comprise of
Harvesting WiFi Information [Done]Intrusion Detection [Done]Intrusion Prevention [Done]Auditing (Testing network) [Done]
Other additional item include analyzing of packets, display of captured dump, display network barchart and much more.
Requirements
No special equipment is required to use this script as long as you have the following :
- Root access (admin)
- Wireless interface which is capable of monitoring and injection
- Python 2.7 installed
- Aircrack-NG suite installed
- TShark installed
- TCPDump installed
- Mergecap installed (for joining pcap files)
- xterm installed
Structure of WAIDS’ Display ::
Before starting with the detail description of the whole application, WAIDPS display structures are separated in several parts. For better understanding, the structures are as below.
WiFi-Harvesting Module
- Collecting/Storing of Access Points/Stations details and the relationship with each other. [Access Points / Wireless Clients Listing]
- Displaying of unassociated station information and its probe [Unassociated Stations]
- Allowing user to enter MAC addresses / Names to be monitored [Monitoring Panel]
- Association of stations to access point, station switch from one access point to another, station acting as both a wireless client and access point, etc [Association/Connection Alert]
Intrusion Detection
- Capture/Analyzing of packets
- Displaying of Station/Access Point MAC addresses and detected suspicious data count [Suspicious Activity Listing]
- Displaying of analysed WEP/WPA/WPS attack pattern and its detail [Attack Detected]
Tutorials ::
Text & Image Tutorial :: Click Here
Download ::
Linux :: WAIDPS (.py)
Source :: https://github.com/SYWorks/waidps
Submitted By :: SYChua
Post a Comment