These scripts are designed to make it easy and straight-forward to configure a Ubuntu virtual machine to act as a WiFi access point (AP), and forward traffic to your favorite web proxy or other tool. I personally use this for doing mobile and other embedded device testing. If you've used my PPTP helper, you should feel right at home configuring and using this tool!
Note: There is no black magic here - simply some utilities to make it easier to use.
The typical work flow would be a VM that has one wired (or could even be wireless) interface, we'll call it 'eth0', and a USB WiFi dongle. mitm-wifi will generate a hostapd configuration file, create a WiFi access point from the USB WiFi dongle, and then apply appropriate iptables rules so that you can intercept and modify traffic as you please.
This tool is designed to work on Ubuntu virtual machines operating in 'bridged' mode. Your mileage will vary if you use another VM, but I suppose Kali Linux should also work fine.
To download and setup the tool, run the following commands:
$ git clone https://github.com/jakev/mitm-helper-wifi
$ cd mitm-helper-wifi
$ sudo ./install_dependencies.sh
$ sudo dpkg -i build/mitm-helper-wifi_*.deb
The following operating systems are fully supported:
- Ubuntu 14 - 16
The following systems are known to work, but require manual dependency installation:
- Kali Linux "Sana"
- Kali Linux "Kali Rolling"
Manual dependency installation should be as simple as:
$ sudo apt-get install dnsmasq hostapd iptables python
I tried to make configuration of the tool both straightforward and flexible. I use a TP Link TL-WN722N, that cost me about 12 dollars on Amazon and does everything I need. If you use a similiar adapter, your setup should work completely out of the box.
The configuration file can be found at /etc/mitm-wifi.conf. The only setting you need to specify is a WPA passphrase, but you can also select a custom SSID in the section 'Global':
[Global]
Ssid=CoolNetwork
Key=M0bileisfuN
What does this do? This configures a 802.11g network on channel 1, using WPA2 PSK/CCMP. If this doesn't work for you, check out the next section on overriding.
If you're connecting multiple devices to your AP, for example, 1 rooted device you'd like to intercept traffic, and 1 device you're not so concerned with all (or the same) traffic, you can define users. Users are based on MAC addresses. By default, mitm-wifi supports 5 users: user0 - user4. Users can then be applied to whichever proxy rule section you'd like.
The following adds the host 00:11:22:33:44:55 to user group "user0":
[Global]
Ssid=CoolNetwork
Key=M0bileisfuN
user0=00:11:22:33:44:55
If for some reason the hostapd configuration I'm using by default doesnt fit your setup, powerusers can manually override any hostapd configuration settings. You're own your own for validation here, and you might not be able to achieve exactly what you'd like.
As an example, let's say that channel 1 is not ideal and you'd rather use 10. We can override these parameters in the /etc/mitm-wifi.conf file by specifying the exact hostapd config equivalent to overrider
[Global]
Ssid=CoolNetwork
Key=M0bileisfuN
[Override]
channel=10
If you need more control than this, please message me and we can talk about adding additional features.
We'll also add sections to the /etc/mitm-wifi.conf file to configure how you will intercept traffic. By default, traffic is simply passed through (no proxy). This should work if you just want to observe traffic using a tool like Wireshark. In our case, let's assume we have Burp running on port 9999, and we'd like to forward traffic on ports 80 and 443 to this proxy. We configure the /etc/mitm-wifi.conf file as follows:
...
[HTTP Proxies]
ProxyPort:9999
ForwardPorts:80,443
Now, let's say that we determine our app/device uses a custom protocol on port 1234, and Burp is not useful for intercepting this traffic. We created a python script, and it is listening on port 8888. Let's add rules for this:
...
[HTTP Proxies]
ProxyPort:9999
ForwardPorts:80,443
[Binary Coolness Proxy]
ProxyPort:8888
ForwardPorts:1234
This configuration can be found in the file sample.mitm-wifi.conf. Note that the section names in the mitm-wifi.conf can be named anything except 'Global' and 'Override'.
If for some reason you'd only like to capture ports 1234 on a specifc device (for example 00:11:22:33:44:55 above), you can apply the proxy rules to specific user or comma delimited users:
[Global]
...
user0=00:11:22:33:44:55
...
[Binary Coolness Proxy]
ProxyPort:8888
ForwardPort:1234
UserIds:user0
Side note for Burp users: You'll likely need to listen on all interfaces AND enable the invisible proxying to have your setup work properly.
Once you're ready to start, run:
$ sudo mitm-wifi -v
If you want to specify a custom configuration file, you can do so with the -c argument:
$ sudo mitm-wifi -v -c my-wifi.conf
By default, hostapd will attempt to find the USB dongle on wlan0, but if your adapter is named different, use the -w argument:
$ sudo mitm-wifi -v -w ath1
If you want to set static A records, you can use the -m argument (or hostmap in the Global section of your config). The format should be:
hostname:IP[,hostname:IP]
Example:
$ sudo mitm-wifi -v -w ath1 -m www.acme.com:10.6.9.1
If your host machine is connected to a VPN, you may also need to tell mitm-wifi about the upstream DNS servers provided by the VPN client. For example, if your host machine was using a DNS server of 172.16.1.50, you can tell mitm-wifi to use this DNS server, using the -s argument:
$ sudo mitm-wifi -v -s 172.16.1.50
By hitting Ctrl+C, the script will begin the shutdown process.