• Options
• Login
• Register
• Desktop Style

Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database

• Index

  • Forums
  • Automotive Hacking
  • Software
  • Hacking Software - Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database
• Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database

• Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database

  HackMaster > 03-18-2023, 10:03 AM

  Wifi_Db - Script To Parse Aircrack-ng Captures To A SQLite Database
  
  
  
  Script to parse Aircrack-ng captures into a SQLite database and extract useful information like handshakes (in 22000 hashcat format), MGT identities, interesting relations between APs, clients and it's Probes, WPS information and a global view of all the APs seen.
  
  Features

  • Displays if a network is cloaked (hidden) even if you have the ESSID.
    
  • Shows a detailed table of connected clients and their respective APs.
    
  • Identifies client probes connected to APs, providing insight into potential security risks usin Rogue APs.
    
  • Extracts handshakes for use with hashcat, facilitating password cracking.
    
  • Displays identity information from enterprise networks, including the EAP method used for authentication.
    
  • Generates a summary of each AP group by ESSID and encryption, giving an overview of the security status of nearby networks.
    
  • Provides a WPS info table for each AP, detailing information about the Wi-Fi Protected Setup configuration of the network.
    
  • Logs all instances when a client or AP has been seen with the GPS data and timestamp, enabling location-based analysis.
    
  • Upload files with capture folder or file. This option supports the use of wildcards (*) to select multiple files or folders.
    
  • Docker version in Docker Hub to avoid dependencies.
    
  • Obfuscated mode for demonstrations and conferences.
    
  • Possibility to add static GPS data.
    

  Code:

  docker pull r4ulcl/wifi_db

  
  Manual installation
  
  Debian based systems (Ubuntu, Kali, Parrot, etc.)
  
  Dependencies:
  

  • python3
    
  • python3-pip
    
  • tshark
    
  • hcxtools
    

  
  

  Code:

  sudo apt install tshark
sudo apt install python3 python3-pip

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make
sudo make install
cd ..

  
  
  Installation
  
  

  Code:

  git clone https://github.com/r4ulcl/wifi_db
cd wifi_db
pip3 install -r requirements.txt

  
  
  Arch
  
  Dependencies:

  • python3
    
  • python3-pip
    
  • tshark
    
  • hcxtools
    

  
  

  Code:

  sudo pacman -S wireshark-qt
sudo pacman -S python-pip python

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make
sudo make install
cd ..

  
  
  Installation
  
  

  Code:

  git clone https://github.com/r4ulcl/wifi_db
cd wifi_db
pip3 install -r requirements.txt

  
  Usage
  
  Scan with airodump-ng
  
  Run airodump-ng saving the output with -w:
  

  Code:

  sudo airodump-ng wlan0mon -w scan --manufacturer --wps --gpsd

  
  Create the SQLite database using Docker
  

  Code:

  #Folder with captures
CAPTURESFOLDER=/home/user/wifi

# Output database
touch db.SQLITE

docker run -t -v $PWD/db.SQLITE:/db.SQLITE -v $CAPTURESFOLDER:/captures/ r4ulcl/wifi_db

  
  To save de output in current folder db.SQLITE file
  

  Code:

  -v $PWD/db.SQLITE:/db.SQLITE

  
  To share the folder with the captures with the docker
  

  Code:

  -v $CAPTURESFOLDER:/captures/

  
  
  
  Create the SQLite database using manual installation
  Once the capture is created, we can create the database by importing the capture. To do this, put the name of the capture without format.
  

  Code:

  python3 wifi_db.py scan-01

  
  In the event that we have multiple captures we can load the folder in which they are directly. And with -d we can rename the output database.
  

  Code:

  python3 wifi_db.py -d database.sqlite scan-folder

  
  
  
  
  Open database
  
  The database can be open with:

  • sqlitebrowser
    

  
  
  
  Below is an example of a ProbeClientsConnected table.
  
  
  Arguments
  
  usage: wifi_db.py [-h] [-v] [--debug] [-o] [-t LAT] [-n LON] [--source [{aircrack-ng,kismet,wigle}]] [-d DATABASE] capture [capture ...]
  
  positional arguments:
    capture              capture folder or file with extensions .csv, .kismet.csv, .kismet.netxml, or .log.csv. If no extension is provided, all types will
                          be added. This option supports the use of wildcards (*) to select multiple files or folders.
  
  options:
    -h, --help            show this help message and exit
    -v, --verbose        increase output verbosity
    --debug              increase output verbosity to debug
    -o, --obfuscated      Obfuscate MAC and BSSID with AA:BB:CC:XX:XX:XX-defghi (WARNING: replace all database)
    -t LAT, --lat LAT    insert a fake lat in the new elements
    -n LON, --lon LON    insert a fake lon i  n the new elements
    --source [{aircrack-ng,kismet,wigle}]
                          source from capture data (default: aircrack-ng)
    -d DATABASE, --database DATABASE
                          output database, if exist append to the given database (default name: db.SQLITE)
  
  
  Database
  
  wifi_db contains several tables to store information related to wireless network traffic captured by airodump-ng. The tables are as follows:

  • Code:

    AP
    : This table stores information about the access points (APs) detected during the captures, including their MAC address
    

  
  

  • Network name bssidssidWhether the network is cloakedcloakedManufacturer manuf  Channel channel Frequency frequency Carrier carrier Encryption typeencryption and total packets received from this AP packetsTotalThe table uses the MAC address as a primary key
    
  • Code:

    Client
    
    This table stores information about the wireless clients detected during the captures, including their MAC address
    
    Code:

    mac
    
    Network name
    
    
    Code:

    ssid
    
    
    Manufacturer
    
    Code:

    manuf
    
    
    

           Device type

  • Code:

    type
    
    
    and total packets received from this client
    
    Code:

    packetsTotal
    The table uses the MAC address as a primary key.
    
  • Code:

    SeenClient
    
    
    
    This table stores information about the clients seen during the captures, including their MAC address
    
    Code:

    mac
    
    
    Time of detection
    
    Code:

    time
    
    
    
    Tool used to capture the data
    
    Code:

    tool
    
    
    Signal strength
    
    Code:

    signal_rssi
    
    
    Latitude
    
    Code:

    lat
    
    
    Longitude
    
    Code:

    lon
    
    
    Altitude
    
    Code:

    alt
    
    
    The table uses the combination of MAC address and detection time as a primary key, and has a foreign key relationship with the table
    
    
    Code:

    Client
     
    

  
           This table stores information about the wireless clients that are connected to an access point, including the MAC address of the access point

  • Code:

    Connected
    
    
    
    Code:

    bssid
    
    
    and the client
    
    
    Code:

    mac
    
    
    The table uses a combination of access point and client MAC addresses as a primary key, and has foreign key relationships with both the 
    
    
    Code:

    AP
     and 
    
    
    
    Code:

    Client
    
    
    Tables
    
  • Code:

    WPS
    
    
    This table stores information about access points that have Wi-Fi Protected Setup (WPS) enabled, including their MAC address
    
    
    Code:

    bssid
    
    
    Network name
    
    
    Code:

    wlan_ssid
    
    
    WPS version
    
    
    Code:

    wps_version
    
    
    Device name
    
    
    Code:

    wps_device_name
    
    
    Model name
    
    
    Code:

    wps_model_name
    
    
    Model number
    
    
    Code:

    wps_model_number
    
    
    Configuration methods
    
    
    Code:

    wps_config_methods
    
    
    Keypad configuration methods
    
    
    Code:

    wps_config_methods_keypad
    
    
    The table uses the MAC address as a primary key, and has a foreign key relationship with the table
    
    
    Code:

    AP
     .
    
  • Code:

    SeenAp
    
    
    This table stores information about the access points seen during the captures, including their MAC address
    
    
    Code:

    bssid
    
    
    Time of detection
    
    
    Code:

    time
    
    
    Tool used to capture the data
    
    
    Code:

    tool
    
    
    Signal strength
    
    
    Code:

    signal_rssi
    
    
    Latitude
    
    
    Code:

    lat
    
    
    Longitude
    
    Code:

    lon
    
    
    Altitude
    
    Code:

    alt
    
    
    and timestamp
    
    
    Code:

    bsstimestamp
    
    
    The table uses the combination of access point MAC address and detection time as a primary key, and has a foreign key relationship with the  table
    
    Code:

    AP
     .
    
  • Code:

    Probe
    
    
    This table stores information about the probes sent by clients, including the client MAC address
    
    
    Code:

    mac
    
    
    Network name
    
    
    Code:

    ssid
    
    
    and time of probe
    
    
    Code:

    time
    
    
    The table uses a combination of client MAC address and network name as a primary key, and has a foreign key relationship with the table
    
    
    Code:

    Client
     .
    

  
            This table stores information about the handshakes captured during the captures, including the MAC address of the access point

  • Code:

    Handshake
    
    
    
    Code:

    bssid
    
    
    The client
    
    
    Code:

    mac
    
    
    File name
    
    
    Code:

    file
    
    
    The hashcat format
    
    
    Code:

    hashcat
    The table uses a combination of access point and client MAC addresses, and file name as a primary key, and has foreign key relationships with both the 
    
    
    
    Code:

    AP
     and 
    
    
    
    Code:

    Client
     tables.
    
  • Code:

    Identity
    : This table represents EAP (Extensible Authentication Protocol) identities and methods used in wireless authentication. The 
    
    
    
    Code:

    bssid
     and 
    
    
    
    Code:

    mac
     fields are foreign keys that reference the 
    
    
    
    Code:

    AP
     and 
    
    
    
    Code:

    Client
     tables, respectively. Other fields include the identity and method used in the authentication process.
    

  Views

  • Code:

    ProbeClients
    : This view selects the MAC address of the probe, the manufacturer and type of the client device, the total number of packets transmitted by the client, and the SSID of the probe. It joins the 
    
    
    
    Code:

    Probe
     and 
    
    
    
    Code:

    Client
     tables on the MAC address and orders the results by SSID.
    
  • Code:

    ConnectedAP
    : This view selects the BSSID of the connected access point, the SSID of the access point, the MAC address of the connected client device, and the manufacturer of the client device. It joins the 
    
    
    
    Code:

    Connected
    , 
    
    
    
    Code:

    AP
    , and 
    
    
    
    Code:

    Client
     tables on the BSSID and MAC address, respectively, and orders the results by BSSID.
    
  • Code:

    ProbeClientsConnected
    : This view selects the BSSID and SSID of the connected access point, the MAC address of the probe, the manufacturer and type of the client device, the total number of packets transmitted by the client, and the SSID of the probe. It joins the 
    
    
    
    Code:

    Probe
    , 
    
    
    
    Code:

    Client
    , and 
    
    
    
    Code:

    ConnectedAP
     tables on the MAC address of the probe, and filters the results to exclude probes that are connected to the same SSID that they are probing. The results are ordered by the SSID of the probe.
    
  • Code:

    HandshakeAP
    : This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the handshake, the manufacturer of the client device, the file containing the handshake, and the hashcat output. It joins the 
    
    
    
    Code:

    Handshake
    , 
    
    
    
    Code:

    AP
    , and 
    
    
    
    Code:

    Client
     tables on the BSSID and MAC address, respectively, and orders the results by BSSID.
    
  • Code:

    HandshakeAPUnique
    : This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the handshake, the manufacturer of the client device, the file containing the handshake, and the hashcat output. It joins the 
    
    
    
    Code:

    Handshake
    , 
    
    
    
    Code:

    AP
    , and 
    
    
    
    Code:

    Client
     tables on the BSSID and MAC address, respectively, and filters the results to exclude handshakes that were not cracked by hashcat. The results are grouped by SSID and ordered by BSSID.
    
  • Code:

    IdentityAP
    : This view selects the BSSID of the access point, the SSID of the access point, the MAC address of the client device that performed the identity request, the manufacturer of the client device, the identity string, and the method used for the identity request. It joins the 
    
    
    
    Code:

    Identity
    , 
    
    
    
    Code:

    AP
    , and 
    
    
    
    Code:

    Client
     tables on the BSSID and MAC address, respectively, and orders the results by BSSID.
    
  • Code:

    SummaryAP
    : This view selects the SSID, the count of access points broadcasting the SSID, the encryption type, the manufacturer of the access point, and whether the SSID is cloaked. It groups the results by SSID and orders them by the count of access points in descending order.
    
• Next Oldest Next Newest