1 / 57

Intro for new WCTFers

Embrace the world of Wireless Capture the Flag (WCTF) challenges, where RF technology reigns supreme. Learn to use cutting-edge tools like SDR, explore WiFi flags and encryption, and dive into protocol reversal and communication interception. Score points by honing your skills in WiFi tools like Kismet and Airodump-ng, alongside SDR tools like gqrx and Freqwatch. Equip yourself with the right platform, operating systems, and a host of software and hardware tools. Discover the array of antennas and headphones for your setup, and master the art of target selection using different radiation patterns. Stay protected from static, noise, and interference, and delve into advanced concepts to excel in the diverse challenges. Enter the thrilling world of WCTF, where innovation and skills set you on the path to victory.

bprovost
Download Presentation

Intro for new WCTFers

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Intro for new WCTFers

  2. Reason behind the WCTF • Use of RF technology has exploded • RF used to require special and expensive equipment • Safe Environment • $20 gets most signals of interest

  3. Legal issues to be aware of • IANAL, neither are you • Consult your local laws (fcc.gov) • Restrictions for telco services (pagers and cell) • Wiretap/Dual Party Consent

  4. How we do this • WiFi Flags • Crypto • Keys • Hashes • Communication interception • SDR Flags • Protocol reversal • Demodulate files • Rx/Tx

  5. Recon • Know your wireless neighborhood • WiFi • Kismet • Airodump-ng • SDR • Freqwatch • gqrx

  6. Exploitation • Do your homework on the tools • Practice in a safe environment • Score the points!

  7. Platform Selection Internet access • A device with USB tether Laptop (PC or MAC) • Multi core processor (high end for SDR) • 16 GB ram or more (especially for VMs) • Hard drive space for all the things • Screen with space for multiple terminals External Radios/antennas • Internal radios generally do not give the optimal capability • Built in antennas rarely give flexibility needed Power-Supply • Enough outlets to power all of your gear • Possibly powered USB hubs

  8. Operating Systems Pentoo GNU Radio Live Windows Kali

  9. Software Tools Aircrack-ng Kismet-ng Airodump-ng Wireshark TCPDump Nmap PGP/GPG inssider Reaver   Pyrit OCLHashcat Wifite Fern-wifi-cracker Airdrop gqrx dsd Channelizer multimon-ng smartnet-scanner GNUradio OsmoComSDR EyeP.A. SpecTools Baudline Gr-fosphor pixiedust Custom tools

  10. Hardware Tools Metageek Wispy DBx Signal Hound BB60(x) GSG HackRF Nuand BladeRF Any RTL-SDR GSG Ubertooth zigbee radios Rosewill RNX-N600UBE Alfa AWUS036NHA Alfa AWUS051NH v2 Ubiquiti SR-71 Airpcap Nx TP-Link WN722N Globalsat BU-353 GPS Custom transmitters Rokland n3 Pwnie Express PWNPad Hak5 Wifi Pineapple Wired and wireless Tap USB hub USB power USB ethernet Headphones Antennas (assorted)

  11. Helpful Radios Alfa radios (ABGN) Rokland N3 (BGN) Rosewill N600 UBE (ABGN) SR-71 (ABG) AirPcapNx (ABGN) WiSpy DBX (2.4 and 5Ghz) TP-Link TL-WN722N (BGN) Ubertooth One (many uses) HackRF One (SDR) RTL-SDR (SDR) Nuand BladeRF EnGenius EUB 1200AC (ABGNAC) Signal Hound B60

  12. Headphones • There are thousands of headphones • Headphones are a very personal decision • They range in price and quality • Find a pair that are comfortable and clear • Avoid ones with bass boost or other signal processing • Reference type headphones tend to be cheap and well suited

  13. Something to carry it in • Pack • Pelican case • Vehicle (MRAP)

  14. Antennas for WCTF • Two relevant polarization types • Horizontal • Vertical • Three basic radiation patterns • Omni-Directional • Most common type • Radiates “equally” in all directions (horizontal) • Semi-directional • Radiates stronger signal in certain directions • Highly-Directional • Radiates a much stronger signal in one direction

  15. Omni Directional • Radiates equally In all directions on the horizontal plane

  16. Semi-Directional • Radiates stronger signal in multiple directions

  17. Highly Directional • Radiates strong signal in a signal direction

  18. Target Selection • Look for “hot spots” • Determine what the limits are that you are working within • Look for beacons that are within your target set

  19. Transmitters to be found

  20. Putting it together • In WCTF as in the real world: Right Tools for the Right Job • Know your tools and limitations • SDRs and GNURadio provides easy access to much of RF and rapid construction of custom tools! • Now to put it into practice…

  21. What am I seeing/hearing? http://www.sigidwiki.com/wiki/ Signal_Identification_Guide

  22. Common problems in SDR labs • Antennas • Lightning • Static • Noise • Clocks and Drift

  23. Static protection is a must! • The cheaper RTL’s do NOT have static protection • Wind generates static • Rubbing things… generates static

  24. Noise Reduction Must Reads • The-Mitigation-of-Radio-Noise-from-External-Sources-at-Radio-Receiving-Sites http://www.dtic.mil/cgi- bin/GetTRDoc?AD=ADA468464 • Naval RFI Handbook http://www.arrl.org/files/file/Techn ology/RFI%20Main%20Page/Naval _RFI_Handbook.pdf

  25. BFG

  26. Clocks • The cheaper SDR’s have a lot of noise in them • Choke them out and isolate noise sources • Use a unified PPM if you use more than one for IQ

  27. A bit of fun - Hardware Mods Multichannel Receivers http://yo3iiu.ro/blog/?p=1450

  28. Wireless Capture the FlagWCTF • Always new changes • Typically between 12-25 challenges for different disciplines • Challenges are all RF 30MHz – 5.9GHz

  29. Challenges

  30. Let’s get started Welcome to WCTF! This is your first challenge. Use the municipal Wi-Fi to confirm you can connect, then submit the flag to confirm you can use the scoring engine for +10 point.

  31. Budget Your Time • Challenges do not have to be solved in order • Difficulty range easy-insane • Pay attention to details • Don’t dwell on the problem • Ask questions • Learn things • HAVE FUN

  32. The talk… Time to talk about the challenges

  33. Welcome to Voltronville Zarkon Industries has the strongest wireless network in the galaxy. Attempts to hack this are futile. Seek life elsewhere. +500

  34. It’s getting serious The dark underbelly of Zarkon's network has lots of delicious flags for your benefit, if you happen to ever gain access. Some are easy, some are insane puzzles that you could lose a day in. Budget your time wisely! Points vary: +20-50 each

  35. Coffee time! Grap a cup at Lotor’s!

  36. Pizza! Pizza!

  37. Swag Don’t forget to grab a souvenir at the gift shop!

  38. Voltronville Bank Banking hours are limited, but even the CEO visits this vault. Know the key and learn all his secrets, just hurry! (points vary!)

  39. Residential Area Not all residents of Voltronville use the municipal Wi-Fi; some are still so hopelessly broken. +300

  40. Residential Area Sometimes people connect. Sometimes they don't. +150

  41. Fox & Hound • Fox & Hound: first team to capture gets 750pts! • SSID: Allura_the_Fox • MAC: D2:E4:0B:F6:66:B8

  42. Fox & Hound • Fox & Hound: first team to capture gets 750pts! • SSID: Lamina_the_Fox • MAC: D2:E4:0B:F9:E2:F5

  43. Hide & Seek! • Hide and Seek! These flags decay over time starting at +1000 so hurry!!! • SSID: Voltronville_Hotel_1

  44. Hide & Seek • Hide and Seek! These flags decay over time starting at +1000, so hurry!!!! • SSID: Voltronville_Hotel_2

  45. Convention Center The local HAM Radio club is having a HAM Fest; find and capture their error prone signals. 50 to 100 points that can decay

  46. Movie Theatre The local movie theatre is branching into digital movie broadcasts! Find their management system. 50 to 250 points that can decay

More Related