BIR - Lab WiFI 1

# BIR - Lab WiFI 1 ### Autorzy: Michał Wawrzyńczak Maciek Włodarczyk Paweł Gryka ## Ramka Beacon Zgodnie z zaleceniami znaleźliśmy i opisaliśmy przykładową ramkę Beacon podzieloną na części: Oznaczenie, że ramka jest typu Beacon ``` IEEE 802.11 Beacon frame, Flags: ........C Type/Subtype: Beacon frame (0x0008) ``` Time Stamp: ``` Timestamp: 101440215167 ``` Beacon Interval: ``` Beacon Interval: 0.102400 [Seconds] ``` Capability Info: ``` Capabilities Information: 0x0531 .... .... .... ...1 = ESS capabilities: Transmitter is an AP .... .... .... ..0. = IBSS status: Transmitter belongs to a BSS .... .... .... .0.. = Reserved: 0 .... .... .... 0... = Reserved: 0 .... .... ...1 .... = Privacy: Data confidentiality required .... .... ..1. .... = Short Preamble: Allowed .... .... .0.. .... = Reserved: 0 .... .... 0... .... = Reserved: 0 .... ...1 .... .... = Spectrum Management: Implemented .... ..0. .... .... = QoS: Not Implemented .... .1.. .... .... = Short Slot Time: In use .... 0... .... .... = Automatic Power Save Delivery: Not Implemented ...0 .... .... .... = Radio Measurement: Not Implemented ..0. .... .... .... = EPD: Not Implemented .0.. .... .... .... = Reserved: 0 0... .... .... .... = Reserved: 0 ``` SSID: ``` Tag: SSID parameter set: "IOT_Lab432_5GHz" Tag Number: SSID parameter set (0) Tag length: 15 SSID: "IOT_Lab432_5GHz" ``` FH Parameter Set: ``` Tag: Supported Rates 6(B), 9, 12(B), 18, 24(B), 36, 48, 54, [Mbit/sec] Tag Number: Supported Rates (1) Tag length: 8 Supported Rates: 6(B) (0x8c) Supported Rates: 9 (0x12) Supported Rates: 12(B) (0x98) Supported Rates: 18 (0x24) Supported Rates: 24(B) (0xb0) Supported Rates: 36 (0x48) Supported Rates: 48 (0x60) Supported Rates: 54 (0x6c) ``` DS Parameter Set: ``` Tag: DS Parameter set: Current Channel: 44 Tag Number: DS Parameter set (3) Tag length: 1 Current Channel: 44 ``` Lista kanałów: ``` Tag: AP Channel Report: Operating Class 5, Channel List : 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, Tag Number: AP Channel Report (51) Tag length: 20 Operating Class: 5 Channel List: 36 Channel List: 40 Channel List: 44 Channel List: 48 Channel List: 52 Channel List: 56 Channel List: 60 Channel List: 64 Channel List: 100 Channel List: 104 Channel List: 108 Channel List: 112 Channel List: 116 Channel List: 120 Channel List: 124 Channel List: 128 Channel List: 132 Channel List: 136 Channel List: 140 ``` Country information: ``` Tag: Country Information: Country Code EU, Environment All Tag Number: Country Information (7) Tag length: 60 Code: EU Environment: All (32) Country Info: First Channel Number: 36, Number of Channels: 1, Maximum Transmit Power Level: 17 dBm First Channel Number: 36 Number of Channels: 1 Maximum Transmit Power Level: 17 dBm Country Info: First Channel Number: 40, Number of Channels: 1, Maximum Transmit Power Level: 17 dBm Country Info: First Channel Number: 44, Number of Channels: 1, Maximum Transmit Power Level: 17 dBm Country Info: First Channel Number: 48, Number of Channels: 1, Maximum Transmit Power Level: 17 dBm Country Info: First Channel Number: 52, Number of Channels: 1, Maximum Transmit Power Level: 24 dBm Country Info: First Channel Number: 56, Number of Channels: 1, Maximum Transmit Power Level: 24 dBm Country Info: First Channel Number: 60, Number of Channels: 1, Maximum Transmit Power Level: 24 dBm Country Info: First Channel Number: 64, Number of Channels: 1, Maximum Transmit Power Level: 24 dBm Country Info: First Channel Number: 100, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 104, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 108, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 112, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 116, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 120, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 124, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 128, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 132, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 136, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm Country Info: First Channel Number: 140, Number of Channels: 1, Maximum Transmit Power Level: 30 dBm ``` ## Inne eksperymenty Oprócz analizy pakietu Beacon, szukaliśmy też wymiany kluczy powiązanej z uwierzytelnieniem, ale nie udało się to ze względu na poziom zabezpieczeń oferowany przez WPA2. Poniżej przedstawiamy za to znalezione przez nas rzeczy: ### Pakiety odpowiadające odłączeniu i podłączeniu się do sieci ![image](https://hackmd.io/_uploads/ry4CYUmSp.png) ### Uwierzytelnienie rozłożone na podstawowe części Ten pakiet rozpoczyta uwierzytelnienia. Ustawiony jest Open System. Kiedys odbywala sie tu wymiana sekretu. ``` IEEE 802.11 Wireless Management Fixed parameters (6 bytes) Authentication Algorithm: Open System (0) Authentication SEQ: 0x0001 Status code: Successful (0x0000) ``` AP odpowiada. ``` IEEE 802.11 Wireless Management Fixed parameters (6 bytes) Authentication Algorithm: Open System (0) Authentication SEQ: 0x0002 Status code: Successful (0x0000) ``` Potem nastepuje association: ``` IEEE 802.11 Wireless Management Fixed parameters (4 bytes) Capabilities Information: 0x0431 Listen Interval: 0x0001 Tagged parameters (149 bytes) Tag: SSID parameter set: "IOT_Lab432" Tag Number: SSID parameter set (0) Tag length: 10 SSID: "IOT_Lab432" Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6, 9, 12, 18, [Mbit/sec] Tag Number: Supported Rates (1) Tag length: 8 Supported Rates: 1(B) (0x82) Supported Rates: 2(B) (0x84) Supported Rates: 5.5(B) (0x8b) Supported Rates: 11(B) (0x96) Supported Rates: 6 (0x0c) Supported Rates: 9 (0x12) Supported Rates: 12 (0x18) Supported Rates: 18 (0x24) Tag: Extended Supported Rates 24, 36, 48, 54, [Mbit/sec] Tag Number: Extended Supported Rates (50) Tag length: 4 Extended Supported Rates: 24 (0x30) Extended Supported Rates: 36 (0x48) Extended Supported Rates: 48 (0x60) Extended Supported Rates: 54 (0x6c) Tag: RSN Information Tag Number: RSN Information (48) Tag length: 20 RSN Version: 1 Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM) Pairwise Cipher Suite Count: 1 Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM) Auth Key Management (AKM) Suite Count: 1 Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK RSN Capabilities: 0x0000 Tag: Supported Operating Classes Tag Number: Supported Operating Classes (59) Tag length: 20 Current Operating Class: 81 Alternate Operating Classes: 81, 83, 84, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129 Tag: HT Capabilities (802.11n D1.10) Tag Number: HT Capabilities (802.11n D1.10) (45) Tag length: 26 HT Capabilities Info: 0x09ad A-MPDU Parameters: 0x17 Rx Supported Modulation and Coding Scheme Set: MCS Set HT Extended Capabilities: 0x0000 Transmit Beam Forming (TxBF) Capabilities: 0x01000000 Antenna Selection (ASEL) Capabilities: 0x00 Tag: VHT Capabilities Tag Number: VHT Capabilities (191) Tag length: 12 VHT Capabilities Info: 0x3391f992 VHT Supported MCS Set Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Information Element Tag Number: Vendor Specific (221) Tag length: 7 OUI: 00:50:f2 (Microsoft Corp.) Vendor Specific OUI Type: 2 Type: WMM/WME (0x02) WME Subtype: Information Element (0) WME Version: 1 WME QoS Info: 0x00 Tag: Vendor Specific: Qualcomm Inc. Tag Number: Vendor Specific (221) Tag length: 11 OUI: 8c:fd:f0 (Qualcomm Inc.) Vendor Specific OUI Type: 1 Vendor Specific Data: 0101020100020101 Tag: Vendor Specific: Samsung Electronics Co.,Ltd Tag Number: Vendor Specific (221) Tag length: 11 OUI: 00:00:f0 (Samsung Electronics C Vendor Specific OUI Type: 34 Vendor Specific Data: 220001040000000d ``` A AP odpowiada swoja czescia, na tej podstawie ustalane sa parametry komunikacji. ``` IEEE 802.11 Wireless Management Fixed parameters (6 bytes) Capabilities Information: 0x0411 Status code: Successful (0x0000) ..00 0000 0000 0101 = Association ID: 0x0005 Tagged parameters (167 bytes) Tag: Supported Rates 1(B), 2(B), 5.5(B), 11(B), 6, 9, 12, 18, [Mbit/sec] Tag Number: Supported Rates (1) Tag length: 8 Supported Rates: 1(B) (0x82) Supported Rates: 2(B) (0x84) Supported Rates: 5.5(B) (0x8b) Supported Rates: 11(B) (0x96) Supported Rates: 6 (0x0c) Supported Rates: 9 (0x12) Supported Rates: 12 (0x18) Supported Rates: 18 (0x24) Tag: Extended Supported Rates 24, 36, 48, 54, [Mbit/sec] Tag Number: Extended Supported Rates (50) Tag length: 4 Extended Supported Rates: 24 (0x30) Extended Supported Rates: 36 (0x48) Extended Supported Rates: 48 (0x60) Extended Supported Rates: 54 (0x6c) Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element Tag Number: Vendor Specific (221) Tag length: 24 OUI: 00:50:f2 (Microsoft Corp.) Vendor Specific OUI Type: 2 Type: WMM/WME (0x02) WME Subtype: Parameter Element (1) WME Version: 1 WME QoS Info: 0x80 Reserved: 00 Ac Parameters ACI 0 (Best Effort), ACM no, AIFSN 3, ECWmin/max 4/10 (CWmin/max 15/1023), TXOP 0 Ac Parameters ACI 1 (Background), ACM no, AIFSN 7, ECWmin/max 4/10 (CWmin/max 15/1023), TXOP 0 Ac Parameters ACI 2 (Video), ACM no, AIFSN 2, ECWmin/max 3/4 (CWmin/max 7/15), TXOP 94 Ac Parameters ACI 3 (Voice), ACM no, AIFSN 2, ECWmin/max 2/3 (CWmin/max 3/7), TXOP 47 Tag: HT Capabilities (802.11n D1.10) Tag Number: HT Capabilities (802.11n D1.10) (45) Tag length: 26 HT Capabilities Info: 0x086f A-MPDU Parameters: 0x17 Rx Supported Modulation and Coding Scheme Set: MCS Set HT Extended Capabilities: 0x0000 Transmit Beam Forming (TxBF) Capabilities: 0x1807ff1f Antenna Selection (ASEL) Capabilities: 0x00 Tag: HT Information (802.11n D1.10) Tag Number: HT Information (802.11n D1.10) (61) Tag length: 22 Primary Channel: 1 HT Information Subset (1 of 3): 0x00 HT Information Subset (2 of 3): 0x0004 HT Information Subset (3 of 3): 0x0000 Rx Supported Modulation and Coding Scheme Set: Basic MCS Set Tag: Overlapping BSS Scan Parameters Tag Number: Overlapping BSS Scan Parameters (74) Tag length: 14 Scan Passive Dwell: 20 Scan Active Dwell: 10 Channel Width Trigger Scan Interval: 180 Scan Passive Total Per Channel: 200 Scan Active Total Per Channel: 20 Width Channel Transition Delay Factor: 5 Scan Activity Threshold: 25 Tag: Extended Capabilities (8 octets) Tag Number: Extended Capabilities (127) Tag length: 8 Extended Capabilities: 0x01 (octet 1) Extended Capabilities: 0x00 (octet 2) Extended Capabilities: 0x00 (octet 3) Extended Capabilities: 0x00 (octet 4) Extended Capabilities: 0x00 (octet 5) Extended Capabilities: 0x00 (octet 6) Extended Capabilities: 0x00 (octet 7) Extended Capabilities: 0x00 (octet 8) Tag: VHT Capabilities Tag Number: VHT Capabilities (191) Tag length: 12 VHT Capabilities Info: 0x338b7932 VHT Supported MCS Set Tag: VHT Operation Tag Number: VHT Operation (192) Tag length: 5 VHT Operation Info Basic MCS Map: 0xffc0 Tag: Vendor Specific: Microsoft Corp.: WPS Tag Number: Vendor Specific (221) Tag length: 24 OUI: 00:50:f2 (Microsoft Corp.) Vendor Specific OUI Type: 4 Type: WPS (0x04) Version: 0x10 Response Type: AP (0x03) Vendor Extension ``` # Dodatek do zadania pierwszego W ramach dalszych ekperymentów sprawdziliśmy też jak dobrze ChatGPT radzi sobie z analizą ramek. Zadaliśmy mu następujący prompt: ``` Poniżej wkleję ramkę Beacon złapaną przez WIFI, podziel ją na części i opisz używając markdown: <RAMKA ZŁAPANA Z WIRESHARK> ``` ChatGPT odpisał w następujący (całkiem sensowny) sposób: ``` # Analiza Ramki Beacon ## Szczegóły Ramki - **Rozmiar Ramki:** 379 bajtów na łączu (3032 bity) - **Rozmiar Przechwycony:** 379 bajtów (3032 bity) - **Interfejs:** wlan0 - **ID:** 0 ## Nagłówek Radiotap - Wersja: 0 - Długość: 32 ## Ramka Beacon 802.11 - Flagi: ........C - Typ/Podtyp: Ramka Beacon (0x0008) - Pole Kontroli Ramki: 0x8000 - Wersja: 0 - Typ: Ramka zarządzająca (0) - Podtyp: 8 - Flagi: 0x00 - Status DS: Bez opuszczania DS lub sieć działa w trybie AD-HOC - Więcej fragmentów: Ostatni fragment - Retry: Ramka nie jest retransmitowana - PWR MGT: STA pozostanie w górze - Więcej danych: Brak buforowanych danych - Chroniona flaga: Dane nie są chronione - +HTC/Order flag: Kolejność niestandardowa - Czas trwania: 0 mikrosekund - Adres odbiorcy: Broadcast (ff:ff:ff:ff:ff:ff) - Adres docelowy: Broadcast (ff:ff:ff:ff:ff:ff) - Adres nadawcy: BelkinIn_1a:0b:9a (e8:9f:80:1a:0b:9a) - Adres źródłowy: BelkinIn_1a:0b:9a (e8:9f:80:1a:0b:9a) - Identyfikator BSS: BelkinIn_1a:0b:9a (e8:9f:80:1a:0b:9a) - Numer fragmentu: 0 - Numer sekwencji: 3653 - Suma kontrolna ramki: 0x98cdd2ca [niezweryfikowana] ## Zarządzanie Bezprzewodowe IEEE 802.11 ### Parametry Stałe (12 bajtów) - Znacznik czasu: 101440215167 - Interwał Beacon: 0,102400 sekundy - Informacje o możliwościach: 0x0531 - Możliwości ESS: Nadajnik to AP - Status IBSS: Nadajnik należy do BSS - Prywatność: Wymagane uwierzytelnienie danych - Krótki przedambuł: Dozwolony - Zarządzanie widmem: Wdrożone - Krótki czas szczeliny: W użyciu ### Parametry Oznaczone (307 bajtów) - Zestaw parametrów SSID: "IOT_Lab432_5GHz" - Obsługiwane prędkości: 6(B), 9, 12(B), 18, 24(B), 36, 48, 54, [Mbit/s] - Zestaw parametrów DS: Bieżący kanał: 44 - Mapa Indeksu Ruchu (TIM): DTIM 2 z 3 bitmapy - Informacje o kraju: Kod kraju EU, Środowisko Wszystkie - Ograniczenie mocy: 3 - Informacje RSN - Możliwości HT (802.11n D1.10) - Informacje HT (802.11n D1.10) - Raport Kanału AP: Klasa pracy 5, Lista kanałów: 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, - Rozszerzone Możliwości (8 oktetów) - Możliwości VHT - Operacja VHT - Koperta Mocy TX - Specyficzny dla Producenta: Marvell Semiconductor, Inc. - Specyficzny dla Producenta: Microsoft Corp.: WMM/WME: Element Parametru - Rozszerzone Możliwości (6 oktetów) - Specyficzny dla Producenta: Microsoft Corp.: WPS ```

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.