WEBVTT

00:00:00.840 --> 00:00:04.200
If we want to look at some interesting data, we need to log it somewhere.

00:00:04.210 --> 00:00:06.390
Now, unlike the interfaces,

00:00:06.390 --> 00:00:08.840
this is probably something that you'll want enabled all the time,

00:00:08.840 --> 00:00:12.060
so we can go ahead and edit the kismet.conf configuration.

00:00:14.240 --> 00:00:15.890
If we search for log,

00:00:15.890 --> 00:00:18.530
we can see that the logging options are actually included

00:00:18.530 --> 00:00:23.460
from kismet_logging.conf because different files contain

00:00:23.460 --> 00:00:25.150
different parts of the configuration.

00:00:25.160 --> 00:00:28.760
So we can quit this one and open up the logging configuration file.

00:00:29.840 --> 00:00:31.970
It's important that logging is enabled.

00:00:31.970 --> 00:00:35.550
We will set the log types to kismet and pcapng.

00:00:36.140 --> 00:00:38.430
Pcapng is a modern pcap format.

00:00:38.430 --> 00:00:41.170
It doesn't work with every single pcap tool out there,

00:00:41.170 --> 00:00:46.590
but it works great with Wireshark, and it includes more data than a regular pcap,

00:00:46.600 --> 00:00:49.850
for example about what wireless network these packets were coming from.

00:00:51.640 --> 00:00:52.740
If we scroll down,

00:00:52.750 --> 00:00:58.020
you can see that there's some predefined file names with different variables,

00:00:58.020 --> 00:00:58.840
and this is all good.

00:00:58.840 --> 00:01:02.800
So I'm just going to save and run Kismet again with

00:01:02.800 --> 00:01:04.280
the same command we used before.

00:01:04.290 --> 00:01:07.760
You could specify the logging here, but it's already in our configuration file.

00:01:09.940 --> 00:01:12.250
We are going to open the web interface again,

00:01:12.840 --> 00:01:18.280
and I'm going to select my DangerZone Wi‑Fi right here. While it's

00:01:18.280 --> 00:01:21.630
gathering data, if I just browse to my home directory,

00:01:21.640 --> 00:01:23.200
which is where I ran Kismet from,

00:01:23.840 --> 00:01:26.910
you can see there's three log files. There's a Kismet journal,

00:01:26.920 --> 00:01:30.150
which is getting huge, there is the pcapng,

00:01:30.160 --> 00:01:35.010
and there is the regular Kismet SQLite3database. So I'll

00:01:35.010 --> 00:01:36.860
continue generating a little bit of traffic,

00:01:37.740 --> 00:01:41.070
and we now have about 20 MB of pcaps.

00:01:41.540 --> 00:01:47.660
So what I'll do is open up a new terminal, I'll list the files right here,

00:01:47.670 --> 00:01:53.790
and I'll run Wireshark on the Kismet log file ending with pcapng. Wireshark

00:01:53.790 --> 00:01:57.120
might complain that the capture file was cut short in the middle of a packet.

00:01:57.120 --> 00:01:59.210
That's simply because Kismet is only running,

00:01:59.210 --> 00:02:03.160
so the last packet to have been stored could have been corrupted.

00:02:03.170 --> 00:02:06.750
But it's fine. So I'll just click OK on that, and I'll run

00:02:06.750 --> 00:02:13.890
a search. From a device on that Wi‑Fi, I browse a website called neverssl.com,

00:02:13.890 --> 00:02:19.310
which is a website that, as its name implies, is never using SSL. So I'm

00:02:19.310 --> 00:02:24.560
going to search for the string never in the packet details.

00:02:26.340 --> 00:02:29.520
It is now searching my pcap, which is pretty small, and it's taking a while.

00:02:29.520 --> 00:02:31.180
So if you're doing this often,

00:02:31.190 --> 00:02:34.950
it is definitely worth having a pretty powerful computer with a lot of RAM.

00:02:35.740 --> 00:02:38.650
And as you can see, we can see that HTTP connection right here.

00:02:39.040 --> 00:02:42.390
I can right‑click it, and I can open the packet in a new

00:02:42.390 --> 00:02:49.250
window. And here we can see the actual content of the website

00:02:49.640 --> 00:02:51.650
that was accessed over that Wi‑Fi.

00:02:52.140 --> 00:02:53.970
This is the actual HTML.

00:02:55.140 --> 00:02:59.790
So because that wireless network is in cleartext, we're able to see all of that.

00:02:59.800 --> 00:03:04.790
That being said, cleartext is usually encountered in public Wi‑Fis,

00:03:04.800 --> 00:03:06.360
hotels, airports,

00:03:06.660 --> 00:03:10.940
coffee shops, so that is still a pretty useful thing to be able to do.

00:03:10.950 --> 00:03:13.200
Now, if the data is encrypted,

00:03:13.210 --> 00:03:17.180
you'll need to have access to the key or to be able to get access to the key

00:03:17.180 --> 00:03:20.250
by cracking it before you're able to see that kind of data.

00:03:20.540 --> 00:03:24.470
And if you had such a key, all you need to do in Wireshark is go to Edit,

00:03:26.140 --> 00:03:28.780
select the Preferences menu, go to Protocols,

00:03:28.790 --> 00:03:38.590
find 802.11, which is actually under IEEE 802.11, Enable decryption, and then

00:03:38.590 --> 00:03:42.760
go to the Decryption keys menu where you can add the keys.

00:03:43.540 --> 00:03:47.420
So any key you've previously cracked you can put in there, and then

00:03:47.430 --> 00:03:50.260
Wireshark would make sure to decrypt the data.

00:03:51.040 --> 00:03:54.160
Kismet is nonetheless the best way of storing these pcaps.

00:03:54.540 --> 00:03:56.070
Now, if you remember,

00:03:56.080 --> 00:03:59.930
we're running Kismet on channel 6 because that is where the

00:03:59.930 --> 00:04:02.350
Wi‑Fi network we're interested in is running.

00:04:02.360 --> 00:04:04.310
But we only have one interface.

00:04:04.320 --> 00:04:08.540
If you had multiple interfaces, you could set them to different channels.

00:04:08.550 --> 00:04:11.780
So either the hopping happens faster and you don't need to be locked to

00:04:11.780 --> 00:04:16.140
a specific channel, or you could lock all of them on their own channel,

00:04:16.140 --> 00:04:19.079
and that would look like the Wi‑Fi cactus,

00:04:19.079 --> 00:04:21.450
which you might have seen a DevCon before.

00:04:21.940 --> 00:04:26.580
So this is how we can eavesdrop on traffic using Kismet, by storing two pcaps.

00:04:26.580 --> 00:04:29.510
You can store these pcaps every single time you run Kismet,

00:04:29.510 --> 00:04:32.440
and then you can use any variety of tool to go through them.

00:04:32.490 --> 00:04:36.510
And another interesting piece of data to add to those logs is location.

00:04:36.620 --> 00:04:40.660
If we reopen the logging configuration and we search for GPS,

00:04:40.840 --> 00:04:46.130
you'll see that it is possible to log GPS with these Kismet logs.

00:04:46.140 --> 00:04:50.160
That is very useful if you have a GPS device connected to your laptop and

00:04:50.160 --> 00:04:53.730
you want to locate the different networks you find.

00:04:53.740 --> 00:04:58.860
So, for example, if you're doing wardriving around a huge building or a city,

00:04:59.040 --> 00:05:00.730
make sure you enable GPS.

00:05:00.740 --> 00:05:04.770
That way you'll actually be able to map the different networks that you found.