New version of AirSnare available

DigitalMDX · 12-17-2002

Version 0.6.1 is available.
Added the ability to Net Send a message to an unfriendly MAC/IP. To use this functionality AirSnare must be running on a Windows NT, Windows 2000 or a Windows XP machine. In order for the intruder to see this message, they also must be running NT, 2000 or XP or be running Winpopup (which most people don't). Not sure how Linux machines react to Net Send messages. Also added some extra internal error checking.
You can download the latest version at:
The AirSnare download page

Thanks,
Jay

blackwave · 12-17-2002

Great job DigitalMDX!
Time to send out Reverse spam!

Thorn · 12-17-2002

Cool!

This one should increase the pucker factor!

-=heineken=- · 12-17-2002

Quote:

Originally posted by DigitalMDX
Not sure how Linux machines react to Net Send messages.

Even if it is running Samba it will probably not respond to them...

You would see a response like this after trying to do a net send to a Linux box running samba: The message was sent but not received. And if it was not running samba, it would fail completely...

DigitalMDX · 12-18-2002

Version 0.6.1 had a bug where it would crash when it logged a DHCP attempt. That is fixed in the new version. Also the Net Send feature has been completly redone into the AirHorn Module. AirSnare passes the intruders IP address to the AirHorn module at which point you can send any custom message along with a custom "From" ID. One added feature of the AirHorn module is the "Send Message" button... click the "Send Message" button 100 times and the intruder is going to be closing 100 Messenger windows. Anway... feedback is always welcome.
-Jay

DigitalMDX · 12-18-2002

Not sure how to attach two pictures to a post so here is part two. The message that the intruder sees (providing they are running Windows NT, 2000 or XP).
-Jay

blackwave · 12-18-2002

DigitalMDX, would you be able to add a generic profile so that messges may be saved... or how about a template so let's say I wanted to have a specific automatic message to those who connected to .3-.30, but wanted a different to .31-45... etc.. also a chance to save the message and profile for these messages would be great

this could be in the config script or some type of gui feature...

DigitalMDX · 12-19-2002

Quote:

Originally posted by blackwave
DigitalMDX, would you be able to add a generic profile so that messges may be saved... or how about a template so let's say I wanted to have a specific automatic message to those who connected to .3-.30, but wanted a different to .31-45... etc.. also a chance to save the message and profile for these messages would be great this could be in the config script or some type of gui feature...

When you first launch the program (The AirHorn piece) it comes up with a default setting, usually all information pointing to the local machine except the "send to:" field. and the default message of "All you wardrivers are belong to us". Once you edit the "from field' and change the message (don't use carrage returns in the message, just type away or the message will stop at the carrage return). Go to the "Configuration" menu and choose to write the settings to the INI file. Then the next time the AirHorn module comes up it will have your saved settings.

Can you explain why you would want a different mesage for different IP's? If an "intruder" connects to your Access point, he is either going to be connecting DHCP (.3-.30) or via a static IP(.31-.45+?), are you looking to send message "A" for DHCP connections and message "B" for a static connect?

Thanks!
Jay

blackwave · 12-19-2002

Quote:

Originally posted by DigitalMDX
Can you explain why you would want a different mesage for different IP's? If an "intruder" connects to your Access point, he is either going to be connecting DHCP (.3-.30) or via a static IP(.31-.45+?), are you looking to send message "A" for DHCP connections and message "B" for a static connect?

That is part of it... though I was mainly concerned on using it for MAC-IP mapping... this wouldn't be so much an intruder feature since mac filtering would be enabled.

jsicuran · 12-20-2002

Cool DigitalMDX, one question in regards to the net send function. Is it possible that you can have a version that will send out the message automatically once a MAC/IP not on the trusted list is encountered? No intervention necessary. I have to see if there is some other utility that can scan your log file and email or net send me any occurrences when they happen.

Thanks...

/JS

DigitalMDX · 12-20-2002

Quote:

Originally posted by jsicuran
Cool DigitalMDX, one question in regards to the net send function. Is it possible that you can have a version that will send out the message automatically once a MAC/IP not on the trusted list is encountered? No intervention necessary. I have to see if there is some other utility that can scan your log file and email or net send me any occurrences when they happen.
Thanks...
/JS

The auto send feature is something I have been thinking about, the only problem is AirSnare has MAC and IP information long before the person has even logged into Windows (say, if you were to bootup Windows in the area of the AP). So there would have to be some delay from the time of detection to the message being sent. (I'm thinking something like X number of packets from the Intruder MAC then send the message). As to the e-mail option. This is something else I've been thinking about adding, I just need to do a little research. That way you could send an e-mail on a detection to either an e-mail account or to a pager, since most pagers have an e-mail address through the pager service provider.
Also, for anyone else reading this, a minor update will be posted this evening which allows you to bring up the AirHorn module when you click on "Send Message" instead of getting a message that says "Sorry, no IP to send to"... that way you'll be able to play with the AirHorn piece without having to wait for an intrusion.
Thanks,
Jay

jsicuran · 12-20-2002

Great on the update that is exactly what I was getting, "the no ip address". I was just in the process of changing the mac address of one of my oronico cards or changing the trusted mac list so I can test. I will now wait..

Thanks..

/JS

DigitalMDX · 12-20-2002

Quote:

Originally posted by jsicuran
... I will now wait...

Wait no longer... it is posted...
-Jay
AirSnare Download Page

DigitalMDX · 12-21-2002

version 0.6.4 is posted as AirSnareBeta.
This includes the AirMail module which allows AirSnare to send you e-mail alerts via an SMTP server. One alert per unfriendly MAC detected.
Copy the AirSnareBeta.exe into your current AirSnare directory. The directions are on the download page.
Let me know how it works and please report any bugs.
Thanks,
Jay
AirSnare download page

jsicuran · 12-21-2002

I will test the beta this weekend and let you know of any issues. Man, I cannot keep up with you...

Have great weekend and Holiday Season..

12-17-2002	#1 (permalink)
DigitalMDX Digital Stumbler Join Date: Jul 2002 Location: Pacific Northwest Posts: 236	New version of AirSnare available Version 0.6.1 is available. Added the ability to Net Send a message to an unfriendly MAC/IP. To use this functionality AirSnare must be running on a Windows NT, Windows 2000 or a Windows XP machine. In order for the intruder to see this message, they also must be running NT, 2000 or XP or be running Winpopup (which most people don't). Not sure how Linux machines react to Net Send messages. Also added some extra internal error checking. You can download the latest version at: The AirSnare download page Thanks, Jay

12-18-2002	#7 (permalink)
blackwave Do I look like I'm joking Join Date: Apr 2002 Location: SoCal, OC Posts: 4,507	DigitalMDX, would you be able to add a generic profile so that messges may be saved... or how about a template so let's say I wanted to have a specific automatic message to those who connected to .3-.30, but wanted a different to .31-45... etc.. also a chance to save the message and profile for these messages would be great this could be in the config script or some type of gui feature... __________________ -=BW=-

12-20-2002	#10 (permalink)
jsicuran So let it be written. Join Date: May 2002 Location: NYC Posts: 74	Cool DigitalMDX, one question in regards to the net send function. Is it possible that you can have a version that will send out the message automatically once a MAC/IP not on the trusted list is encountered? No intervention necessary. I have to see if there is some other utility that can scan your log file and email or net send me any occurrences when they happen. Thanks... /JS __________________ /JS

12-20-2002	#12 (permalink)
jsicuran So let it be written. Join Date: May 2002 Location: NYC Posts: 74	Great on the update that is exactly what I was getting, "the no ip address". I was just in the process of changing the mac address of one of my oronico cards or changing the trusted mac list so I can test. I will now wait.. Thanks.. /JS __________________ /JS

12-21-2002	#14 (permalink)
DigitalMDX Digital Stumbler Join Date: Jul 2002 Location: Pacific Northwest Posts: 236	Looking for beta testers version 0.6.4 is posted as AirSnareBeta. This includes the AirMail module which allows AirSnare to send you e-mail alerts via an SMTP server. One alert per unfriendly MAC detected. Copy the AirSnareBeta.exe into your current AirSnare directory. The directions are on the download page. Let me know how it works and please report any bugs. Thanks, Jay AirSnare download page

12-21-2002	#15 (permalink)
jsicuran So let it be written. Join Date: May 2002 Location: NYC Posts: 74	I will test the beta this weekend and let you know of any issues. Man, I cannot keep up with you... Have great weekend and Holiday Season.. __________________ /JS

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode