Download presentation
Presentation is loading. Please wait.
Published byProsper Hodges Modified over 9 years ago
1
Intro for new WCTFers
2
Reason behind the WCTF Use of RF technology has exploded RF used to require special and expensive equipment Safe Environment $20 gets most signals of interest
3
Legal issues to be aware of IANAL, neither are you Consult your local laws (fcc.gov) Restrictions for telco services (pagers and cell) Wiretap/Dual Party Consent
4
How we do this WiFi Flags –Crypto –Keys –Hashes –Communication interception SDR Flags –Protocol reversal –Demodulate files –Rx/Tx
5
Recon Know your wireless neighborhood WiFi –Kismet –Airodump-ng SDR –Freqwatch –gqrx
6
Exploitation Do your homework on the tools Practice in a safe environment Score the points!
7
Platform Selection Internet access A device with USB tether Laptop (PC or MAC) Multi core processor (high end for SDR) 16 GB ram or more (especially for VMs) Hard drive space for all the things Screen with space for multiple terminals External Radios/antennas Internal radios generally do not give the optimal capability Built in antennas rarely give flexibility needed Power-Supply Enough outlets to power all of your gear Possibly powered USB hubs
8
Operating Systems Pentoo GNU Radio Live Windows Kali
9
Software Tools Aircrack-ng Kismet-ng Airodump-ng Wireshark TCPDump Nmap PGP/GPG inssider Reaver Pyrit OCLHashcat Wifite Fern-wifi-cracker Airdrop gqrx dsd Channelizer multimon-ng smartnet-scanner GNUradio OsmoComSDR EyeP.A. SpecTools Baudline Gr-fosphor pixiedust Custom tools
10
Hardware Tools Metageek Wispy DBx Signal Hound BB60(x) GSG HackRF Nuand BladeRF Any RTL-SDR GSG Ubertooth zigbee radios Rosewill RNX-N600UBE Alfa AWUS036NHA Alfa AWUS051NH v2 Ubiquiti SR-71 Airpcap Nx TP-Link WN722N Globalsat BU-353 GPS Custom transmitters Rokland n3 Pwnie Express PWNPad Hak5 Wifi Pineapple Wired and wireless Tap USB hub USB power USB ethernet Headphones Antennas (assorted)
11
Helpful Radios Alfa radios (ABGN) Rokland N3 (BGN) Rosewill N600 UBE (ABGN) SR-71 (ABG) AirPcapNx (ABGN) WiSpy DBX (2.4 and 5Ghz) TP-Link TL-WN722N (BGN) Ubertooth One (many uses) HackRF One (SDR) RTL-SDR (SDR) Nuand BladeRF EnGenius EUB 1200AC (ABGNAC) Signal Hound B60
12
Headphones There are thousands of headphones Headphones are a very personal decision They range in price and quality Find a pair that are comfortable and clear Avoid ones with bass boost or other signal processing Reference type headphones tend to be cheap and well suited
13
Something to carry it in Pack Pelican case Vehicle (MRAP)
14
Antennas for WCTF Two relevant polarization types –Horizontal –Vertical Three basic radiation patterns –Omni-Directional Most common type Radiates “equally” in all directions (horizontal) –Semi-directional Radiates stronger signal in certain directions –Highly-Directional Radiates a much stronger signal in one direction
15
Omni Directional Radiates equally In all directions on the horizontal plane
16
Semi-Directional Radiates stronger signal in multiple directions
17
Highly Directional Radiates strong signal in a signal direction
18
Target Selection Look for “hot spots” Determine what the limits are that you are working within Look for beacons that are within your target set
19
Transmitters to be found
20
Putting it together In WCTF as in the real world: Right Tools for the Right Job Know your tools and limitations SDRs and GNURadio provides easy access to much of RF and rapid construction of custom tools! Now to put it into practice…
21
What am I seeing/hearing? http://www.sigidwiki.com/wiki/ Signal_Identification_Guide
22
Common problems in SDR labs Antennas Lightning Static Noise Clocks and Drift
25
Static protection is a must! The cheaper RTL’s do NOT have static protection Wind generates static Rubbing things… generates static
27
Noise Reduction Must Reads The-Mitigation-of-Radio-Noise-from- External-Sources-at-Radio-Receiving- Sites http://www.dtic.mil/cgi- bin/GetTRDoc?AD=ADA468464 Naval RFI Handbook http://www.arrl.org/files/file/Techn ology/RFI%20Main%20Page/Naval _RFI_Handbook.pdf
28
BFG
29
Clocks The cheaper SDR’s have a lot of noise in them Choke them out and isolate noise sources Use a unified PPM if you use more than one for IQ
30
Multichannel Receivers http://yo3iiu.ro/blog/?p=1450 A bit of fun - Hardware Mods
32
Wireless Capture the Flag WCTF Always new changes Typically between 12-25 challenges for different disciplines Challenges are all RF 30MHz – 5.9GHz
33
Challenges
34
Let’s get started Welcome to WCTF! This is your first challenge. Use the municipal Wi-Fi to confirm you can connect, then submit the flag to confirm you can use the scoring engine for +10 point.
35
Budget Your Time Challenges do not have to be solved in order Difficulty range easy-insane Pay attention to details Don’t dwell on the problem Ask questions Learn things HAVE FUN
36
The talk… Time to talk about the challenges
37
Welcome to Voltronville Zarkon Industries has the strongest wireless network in the galaxy. Attempts to hack this are futile. Seek life elsewhere. +500
38
It’s getting serious The dark underbelly of Zarkon's network has lots of delicious flags for your benefit, if you happen to ever gain access. Some are easy, some are insane puzzles that you could lose a day in. Budget your time wisely! Points vary: +20-50 each
39
Coffee time! Grap a cup at Lotor’s!
40
Pizza!
41
Swag Don’t forget to grab a souvenir at the gift shop!
42
Voltronville Bank Banking hours are limited, but even the CEO visits this vault. Know the key and learn all his secrets, just hurry! (points vary!)
43
Residential Area Not all residents of Voltronville use the municipal Wi-Fi; some are still so hopelessly broken. +300
44
Residential Area Sometimes people connect. Sometimes they don't. +150
45
Fox & Hound Fox & Hound: first team to capture gets 750pts! SSID: Allura_the_Fox MAC: D2:E4:0B:F6:66:B8
46
Fox & Hound Fox & Hound: first team to capture gets 750pts! SSID: Lamina_the_Fox MAC: D2:E4:0B:F9:E2:F5
47
Hide & Seek! Hide and Seek! These flags decay over time starting at +1000 so hurry!!! SSID: Voltronville_Hotel_1
48
Hide & Seek Hide and Seek! These flags decay over time starting at +1000, so hurry!!!! SSID: Voltronville_Hotel_2
49
Convention Center The local HAM Radio club is having a HAM Fest; find and capture their error prone signals. 50 to 100 points that can decay
50
Movie Theatre The local movie theatre is branching into digital movie broadcasts! Find their management system. 50 to 250 points that can decay
51
Convention Center There is an amateur radio SSTV broadcast; 75 points decaying
52
Who There are spies amongst us; find their transmissions, decode, demodulate, decrypt and analyze. 250 to 500 points decaying.
53
Water Control Plant The water station has misconfigured their SCADA controller. Find it and explore. 100 points decaying.
54
SDR Fox Frequency: 192 MHz
55
Duck Hunt Frequency: 172.75MHz Details: http://sdr.ninja/training-events/sdr-dunk-hunt/ How to shoot: #!/bin/sh while true ; do echo "bang" | minimodem --tx -f -8 1200 -f /home/pi/bang.wav && /home/pi/pifm /home/pi/sentence.wav 80.0 48000 ; sleep 4;done
56
Duck Pond Find the duck Shoot at the duck Receive the MD5 Flag Submit for points
57
SDR Roulette Receive the transmissions Analyze them Strap the toy to your leg Transmit to win –Beep, Shock, Flash or Vibrate
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.