airpwn-ng – New and Improved Version of airpwn

Features

• Inject to all visible clients (a.k.a Broadcast Mode)
• Inject on both open networks and WEP/WPA protected networks
• Targeted injection with -t MAC:ADDRESS [MAC:ADDRESS]
• Gather all visible cookies (Broadcast Mode)
• Gather cookies for specific websites (–websites websites_list.txt)
  • In this scenario, airpwn-ng will auto-generate invisible iframes for injection that trigger the request for each website in websites_list.txt
  • [BETA] Can be used with –covert flag that attempts to inject a big iframe with the real requested website along with the generated invisible iframes. If successful, the victim should get no indication of compromise. This is still beta and doesn’t work with all websites.
  • [BETA] Airpwn-ng API so you can make your own custom attacks. Examples: https://github.com/ICSec/airpwn-ng/blob/master/work-in-progress/api-examples/

How do we do it?

• We inject packets into a pre-existing TCP stream
  • For a more detailed and in-depth explanation as to how this occurs, read the original documentation for airpwn:
    • http://airpwn.sourceforge.net/Documentation.html

Download