I found out earlier today that you can capture wireless packets using your iPod Touch / iPhone, and I thought it was pretty cool, so I’m going to write a quick tutorial about it. Throughout the rest of this post, I’ll use the word iPhone to represent both iPod Touch and iPhone.
Note that some of the stuff here will get pretty technical, but I’ll write it so pretty much anyone can do it. However, if you don’t own an iPhone, don’t bother reading. Also, this will require you to jailbreak your iPhone, and install new software on your computer, so if you can’t/don’t want to do either, you won’t be able to go through with this.
First off, why would we want to capture wireless packets? Simply, if you have the ability to capture wireless traffic, you can go to any public Wi-Fi location (Starbucks, airport, etc.) and grab other people’s data (including passwords). That’s not why I’m writing this tutorial though, it’s more of a proof of concept.
Anyways, into the tech summary: we’re going to be using Pirni, which is a native network sniffer and ARP poisoner for iPhone. We can’t simply set the iPhone’s wireless card in promiscuous mode (like we usually would) due to hardware limitations (read: iPhone is gay), so we need to use gateway ARP poisoning. We’ll be capturing the packets on our iPhone, transfering them to our PC through SSH, then using Wireshark to analyse them.
So, into the actual tutorial. First thing we need to do is jailbreak our iPhone. If you’re feeling reluctant about doing this, just read this article about reasons to do it (especially note that it’s risk free). If you’ve already done this, and have Cydia, skip to the next paragraph. There are several ways to do a jailbreak, a google search will reveal as much. The way I’ve always done mine is ZiPhone, which works for both the iPod Touch and iPhone (just make sure you click the “iPod” button when doing it with an iPod, not the big button at the top). Download here, install, and follow instructions (yes, there’s a Mac version too). I’m not going to go through a whole jailbreaking tutorial, figure it out yourself. After jailbreaking, etc. you should have (among others) a new app called Cydia. If you used something different from ZiPhone, you might only have Installer. In this case, open up Installed, find Cydia, install it, restart iPhone.
Now, open up Cydia. If it’s your first time using Cydia, you’ll be presented with a dialog asking what kind of user you are (User, Hacker, or Developer). You must select Developer! If you’ve selected something different earlier, fear not: just tap Manage (in the bottom bar), then Settings (in the top left).
Now that we have Cydia working properly, the first package we’ll install is Terminal. Click the Search icon in the bottom bar of Cydia, and seach for “MobileTerminal”. Click it, then click “Install” in the top right, then click “Confirm” in the top right. After a bit of scary white-on-black text, the installation will complete, and you’ll be able to click the large button at the bottom of your screen.
Now you’ll notice that we have another new app: Terminal. Terminal is to Linux as Command Prompt is to Windows (yes, the iPhone is based on an Apple OS, which is based on Linux). Don’t go fucking around with Terminal yet though, we need to install some more packages.
Head back into Cydia, and search for “OpenSSH”. Then install it just like above. This time, you’ll notice that there’s no new icon that comes up. This is normal, because this is just a console package (to be used in Terminal). Next, search Cydia again for “Pirni”, and install.
So we’ll be using Pirni to capture packets, and OpenSSH to transfer them to our computer for analysing.
Next, we’ll install the required software onto our computer. We’ll be installing two programs: WinSCP (for the SSH connection (to transfer files from our iPhone to our computer)) and Wireshark (for analysing the capture files). Download WinSCP here and Wireshark here. (Macfags can find their version of Wireshark on the site, no SSH client required cause you can just use Terminal on your PC)
Install WinSCP first. It’s pretty straightforward, the only part to pay attention to is when it asks wether you want a Commander-style interface or an Explorer-style interface: I’ll be using the Explorer-style in my examples, so select it if you think you’ll get confused. Don’t run it yet.
Next, install Wireshark. It might bitch a bit if you don’t have admin privilages, but don’t worry about that. In the process, you’ll also install WinPcap, which is important. Don’t run this yet either.
Head back to your iPhone.
First off, we need to get the gateway IP of our current network, so head over to Settings > Wi-Fi. Click the blue arrow next to your network, and write down the IP beside Router (it’ll usually be something like 192.168.1.1). Then head back to the home screen.
Next, we’ll take care of some filesystem stuff that’s vital if we’ll be using SSH. Go ahead and open up Terminal. First thing we’ll be doing is setting a new root password, because we don’t want script kiddies hacking our iPhone when we go into a public place. First, type the command
su root
and press return (for the rest of this, I won’t tell you to press return, but do it after every line). It’ll ask for a password. Type in
alpine
(the default password). You won’t be able to see yourself typing. If all goes well, you’ll be able to see that you are now logged in as root.
Next, we’ll change the password. Think of a password you’ll remember, because you’ll be royally screwed if you forget it. Type in
passwd
You’ll be asked for your new password, then re-type to confirm. Next, we’ll navigate to the / directory, so type in
cd /
Next, we’ll actually be running Pirni and capturing some packets. Basic Pirni syntax is as follows:
pirni -s (router ip) -o (log file location)
So, in the prompt, type in the following (replace RouterIP with the gateway IP we wrote down earlier):
pirni -s RouterIP -o log.pcap
After hitting Return, you’ll see that Pirni has started capturing packets. Wait until it gets to over 100, then stop it by doing a bottom right to top left swipe on the black part of the screen (as shown in the image below).
Now that we’ve capture the packets into a log file, we need to transfer them to our computer to look at. But to do that, we need to SSH to our iPhone, so we need its IP address. Go go back to Settings > Wi-Fi, click the blue arrow next to your network, and write down what’s beside IP Address. Mine is 192.168.1.102, so that’s what I’ll be using in my examples.
Now, finally, go to your computer. However, don’t put your iPhone to sleep, leave the screen on. This is important because the iPhone turns off Wi-Fi to save battery when it’s in sleep mode, which means we can’t SSH to it.
So, on your computer, open up WinSCP. In the Host name field, write in the IP we got in the last step (for me, it was 192.168.1.102). Port number should be 22. User name is root, and Password is whatever you set your password to on your iPhone. You can leave everything else as is, so the dialog should look like this:
Click Login. If it gives you a box telling you it doesn’t have a response yet, don’t click Abort, just wait a couple minutes. This is a good time to go take a piss, or get more chips. It should only take a couple minutes, and you should be logged into your iPhone. From here, click the “/ (root)” at the top of the tree on the left. From here, you’ll see the file we specified earlier in the window, log.pcap.
Now, right-click the file, and select “Move…”. Now this part is a little tricky. Specify the folder you want to copy the file to, and add “\*.*” to the end. For example, I wanted to move mine to my desktop, so I have:
Now click Move, and if everything was okay, it’ll move the file over. This can take a few seconds, depending on how long you captured. Once it transfers successfully, close WinSCP (yes, you want to terminate the session).
Head over to where you moved the file to, and open it. If Wireshark installed all the associations right, it’ll open right in Wireshark. If it didn’t, just open Wireshark, click File > Open, and find the file.
So there you have it, there are your captured packets. I won’t be going into a detailed tutorial on how to extract what you want from these, but passwords and such will usually be in POST requests. I’m sure you can find plenty of tutorials on Google on how to analyse packet traffic using Wireshark.
To summarize, we captured traffic using our iPhone, then copied it via SSH to our computer, from which we can analyze it. You can easily see the practical use of this, as you can easily just go to Starbucks or something, run Pirni, sit there for a bit getting traffic, then go back home and analyse the traffic. Before I wrap up, pay attention to these keypoints:
If you go to a different location (such as a Starbucks), you’ll need to find the Router IP again, and use this new IP when in Pirni. If you go back home to transfer the file, it’s fine, but if you decide to take your laptop with you and do it there, you’ll need to find your iPhone’s IP again as well. Also, whenever you want to run Pirni again, you’ll first need to log in as root (so open Terminal, and type in
su root
then your new password). Then you’ll be able to run Pirni, with the new Router IP.
An important note is that most password traffic on big websites is encrypted with SSL, so you won’t be able to get email or Facebook passwords easily. But logins for most other sites (forums, etc.) are unencrypted, and most people are stupid enough to use the same password for everything. You’ll also be able to spy on virtually all traffic going in and out of their computer… so any email they read, and Facebook message they send, you’ll be able to see. At a busy place, there’ll be lots of traffic, but Wireshark supports filtering by IP (if you want to see the traffic from only one computer). In addition, Wireshark supports other types of filtering, which you’ll be able to use to filter your results to get rid of all the garbage.
SSH has many uses. For example, you can find screen captures under /private/var/mobile/Media/DCIM/999APPLE. All your music can be found under /private/var/mobile/Media/iTunes_Control/Music, although all the files are strangely names, so it’s better to just use a program to copy them to a different computer. Besides, it would take ages for music to copy over Wi-Fi via SSH.
Terminal also has many uses. You can make new directories, move files around, delete files, and just generally fuck around with the file system. Remember, anything you fuck up can be fixed… just plug it back into iTunes and select Restore. This is why I said that jailbreaking is risk-free.
So that’s pretty much it. As you can see from the timestamps on the screenshots, this was written around 4-5am, so I apologize for any spelling mistakes or sentence structure fails. If you have any problems or questions, feel free to leave a comment or just message me. Now it’s 05:43, so I’m heading off to bed.
Sebastian
Boutros Squared
GMAN
starforest