WEBVTT 00:00:00.940 --> 00:00:03.100 You might remember from the beginning of this course 00:00:03.110 --> 00:00:05.260 that Kismet works for more than Wi‑Fi. 00:00:05.940 --> 00:00:09.510 It also works with software‑defined radios and Bluetooth. 00:00:10.340 --> 00:00:13.750 For Bluetooth, there is no special hardware that is needed. 00:00:13.750 --> 00:00:17.040 You just need a Bluetooth dongle that works with the Linux HCI. 00:00:17.050 --> 00:00:21.800 The thing is, if you're using one of these types of dongles, built‑in or USB, 00:00:21.810 --> 00:00:23.230 the scan will be active. 00:00:23.240 --> 00:00:26.180 That means people could detect that you're scanning Bluetooth with it. 00:00:26.190 --> 00:00:28.820 So I'm going to quit my text editor right here, 00:00:28.830 --> 00:00:34.360 and I am going to list the different HCI devices available on my computer. 00:00:34.370 --> 00:00:38.200 As you can see, I have hc0, which is my Bluetooth dongle, 00:00:38.200 --> 00:00:40.270 which I made available to my virtual machine. 00:00:40.280 --> 00:00:43.340 So all I have to do now is run Kismet and specify the 00:00:43.340 --> 00:00:46.860 source as hc0, just like we did with Wi‑Fi. 00:00:47.240 --> 00:00:49.460 And I'll give it a name, I'll just call it bluetooth. 00:00:51.440 --> 00:00:55.450 Once I start running this, the dongle is going to start scanning for devices. 00:00:55.460 --> 00:00:59.130 So if I open the Kismet UI, right away we see a lot of different 00:00:59.130 --> 00:01:03.660 devices connected. And similar to the Wi‑Fi interface, we see how 00:01:03.660 --> 00:01:05.700 many packets are coming through, and so on. 00:01:05.710 --> 00:01:09.720 Now with this type of dongle, we're not storing actual packets, we're 00:01:09.720 --> 00:01:13.530 only gathering metadata about the different devices that are around us. 00:01:13.530 --> 00:01:16.510 And again, someone could detect you doing this. 00:01:16.520 --> 00:01:17.410 That being said, 00:01:17.410 --> 00:01:20.320 that could be great for gathering information about different 00:01:20.330 --> 00:01:23.840 Bluetooth devices that you'll see in one area over and over if you're 00:01:23.840 --> 00:01:28.180 trying to track if a specific device is in the same area at the same 00:01:28.180 --> 00:01:32.250 time of day or simply if you're just trying to do a proper survey in 00:01:32.250 --> 00:01:35.420 an entire building. It is surprising the amount of Bluetooth devices 00:01:35.420 --> 00:01:39.850 you'll find, especially if you have a dongle that supports Bluetooth Low Energy. 00:01:39.860 --> 00:01:42.390 Now, if you have more advanced Bluetooth requirements, 00:01:42.400 --> 00:01:45.420 you might want to look into a Texas Instrument chip that can be 00:01:45.420 --> 00:01:49.230 molded to be a sniffer‑only card or a Ubertooth One, 00:01:49.240 --> 00:01:52.300 which also lets you do similar. Now if you remember 00:01:52.300 --> 00:01:53.570 at the beginning of this course, 00:01:54.240 --> 00:01:57.560 I said that Kismet also supported software‑defined radios, 00:01:57.670 --> 00:02:01.040 specifically the RTL SDR. 00:02:01.050 --> 00:02:03.930 So what we're going to do now is see how we can use it, 00:02:03.940 --> 00:02:06.420 starting with just installing some prerequisites. 00:02:06.430 --> 00:02:11.070 I am simply going to install a new radio as it will include a lot 00:02:11.070 --> 00:02:13.860 of dependencies for making the RTL SDR work. 00:02:18.140 --> 00:02:19.730 Now that this is all installed, 00:02:19.740 --> 00:02:25.070 I'm going to run rtl_test just to see if my dongle is recognized properly. 00:02:25.640 --> 00:02:30.670 As you can see, it did find a tuner, including a serial number. 00:02:31.240 --> 00:02:35.700 That serial number does look a bit suspicious at 0001, but not 00:02:35.710 --> 00:02:38.560 all RTL SDRs have proper serial numbers. 00:02:39.040 --> 00:02:43.220 So what we need to do now is start Kismet and specify that as the 00:02:43.220 --> 00:02:47.000 source. Now for this part of the demo, I skipped ahead a little bit 00:02:47.000 --> 00:02:49.580 because this is something that requires a little bit more time to 00:02:49.580 --> 00:02:54.050 gather information, but here I want to gather information on ADS‑B, 00:02:54.050 --> 00:02:56.510 specifically. What does ADS‑B mean? 00:02:56.520 --> 00:02:59.920 Well, it means Automatic Dependent Surveillance‑Broadcast. 00:02:59.930 --> 00:03:03.570 It's the technology which planes used to broadcast a bunch of information. 00:03:03.540 --> 00:03:08.070 So I've actually ran that command about 20 minutes ago so I can show you what 00:03:08.070 --> 00:03:11.920 happens in a Kismet UI. So just like with Bluetooth and Wi‑Fi, 00:03:11.930 --> 00:03:16.450 you'll start seeing the planes show up as devices. They are devices, 00:03:16.450 --> 00:03:19.750 or I guess collections of devices, flying in the sky, and you 00:03:19.750 --> 00:03:22.970 can see them here, what channel they're on, and if you've 00:03:22.970 --> 00:03:25.590 received any packets from them. What's interesting is their 00:03:25.590 --> 00:03:30.130 location is actually transmitted, and Kismet is able to decode that information. 00:03:30.130 --> 00:03:35.270 So it'll show you in the ADSB Live tab some information about these planes. 00:03:35.280 --> 00:03:38.600 So as you can see, I'm located in Montreal, 00:03:38.610 --> 00:03:41.950 and that plane right here is actually pretty much over my 00:03:41.950 --> 00:03:46.440 house at 32,000 feet going 461 miles an hour. 00:03:46.450 --> 00:03:48.710 So this might not be the most useful thing if you're 00:03:48.710 --> 00:03:51.080 trying to do a red team engagement, 00:03:51.080 --> 00:03:54.360 for example, but it just goes to show that Kismet is able to do 00:03:54.360 --> 00:03:56.610 a lot with a lot of different radio types. 00:03:56.840 --> 00:03:57.880 We've seen Wi‑Fi, 00:03:57.880 --> 00:04:00.870 which is the reason Kismet was invented in the first place, 00:04:00.880 --> 00:04:03.390 we've seen Bluetooth with active scans, 00:04:03.390 --> 00:04:05.300 but you know you can also do passive scans, 00:04:05.300 --> 00:04:08.660 and now we're looking at ADS‑B so we can detect planes. 00:04:08.740 --> 00:04:13.870 You can also use this SDR feature to look at electricity counters, for example. 00:04:13.880 --> 00:04:15.100 And as we're speaking, 00:04:15.100 --> 00:04:19.750 a third plane was discovered and should appear under Devices here. 00:04:20.940 --> 00:04:22.330 There it is, a third plane. 00:04:22.330 --> 00:04:25.920 So that was over a period of about 10 to 20 minutes. 00:04:25.930 --> 00:04:29.520 So I hope you enjoyed all these different ways to use Kismet. And keep in mind, 00:04:29.530 --> 00:04:33.320 look at the Compatibility page on the Kismet documentation to make 00:04:33.320 --> 00:04:35.880 sure that the hardware you buy is going to work and that you're 00:04:35.880 --> 00:04:37.260 going to have a lot of fun with it.