Everyone, welcome to another video of our wi fi pantheistic series, last time we learned how to write
a simple python tool with the help of Skype to scan for wireless clients and get to, as I said, be
a society and channel no.
Right.
Today, we are going to learn how to do the same.
But using raw sockets, we're not going to use Skype today.
All right, let's get started.
Let's create a Python script and import all of these modules that you see here, since we are going
to use all of them in this video and later videos as well.
The next thing that we need to do is to create our socket.
Let's create our socket first.
I'm going to copy and paste it because I don't want this video to be long, so I'm just going to stick
here.
Do you remember how to create a socket from before, it's fine if you don't, this socket will be a
little different.
We need to use the socket that offenders or packet instead of offenders.
KLEMET from before TSIPI And if you remember, the RF underscore packett allows us to send and receive
raw packets through the kernel.
The Hex zero zero zero three means that we want to capture all packets.
We are interested in all of them, not just one or more few.
Then we bind on the interface, which is the lens through Mond.
Now we're going to start an infinite while loop to start receiving everything.
And since we're only interested in the first part of the frame, we will use the first element of the
list, which is the bracket zero.
Here we go.
Now if you remember from the slides, our subtype byte is number thirty six.
Again, this could be another byte if you're using a different kind of wi fi adapter.
I'm using tippling from now.
So if you have an Alpha, it could be, I don't know, like a different number.
Like, you have to look for that.
You have to look it up yourself.
So if byte number thirty six is equal to 80 in X, which is a beacon frame, that's where where we are
looking for.
Right.
So if packets three six equal to 80 in Hex, we know now this is a beacon frame.
What do we do now?
Well, let's first unpack the header length because we will need it in a bit.
The header length starts from the second byte to the fourth, but let's see that in one first.
OK, let's go to the radio tab header length.
This one, she is selected here.
OK, the header length, this one, if you look at the bottom, it says bites two to three.
I mean, if you count one, two, three, four.
Right.
So in our code, we needed to be from two to four, because if you're in the list, it will be when
you say two, four to four basically means from the second to the third.
OK, so let's do that.
So, OK, we say here from the second to the fourth, but in Wireshark, let's let's take a look at
it again, the header length here and it's selected.
Yep.
So this is zero one two.
Right.
So this is the second and this is the fourth.
But if in Python, if you do two to four here, one, two, three, four.
So it's basically the third and the fourth.
But in Python, we need to do it this way.
Two to four.
So now we got our header length and some people might be asking why we need to have length.
Yeah, we will get to that in a bit.
Now, let's create another variable which has the beacon frame itself.
So big Phryne Cool Pacard starts from the header length that we just got up until twenty four, adding
twenty four bytes to the length that we got because the beacon frame starts from that byte number thirty
six, which, which is actually the subtype byte.
Right.
So from byte number one to bite number thirty five is the radio tab.
Now let's open Warshak again and take a look at the beacon frame.
We can frame this one year, so this beacon frame from here, if we click on it again up until this
F seven, which is fifty nine right now, the transmitter, which is the access point, the BSA side
is the 20th byte of the beacon frame up to the 30 second byte.
Let's see it again.
Let's actually expand it first here.
A transmitter.
This one here, if we select it and go here and hover over the six eight index, it says here from forty
six to fifty one, right.
But since we have it in a variable like the actual beacon frame, so we are counting from zero.
So if you count it, you count it on your own.
Later you'll find that it's from the 20th but up to the 30 second byte.
So we need to create a variable called a society.
Come here.
This is a vehicle beacon frame starts from the 20 to 30 second.
This is the business idea, Mac address that we want now.
Our side length is byte number seventy three, remember from before.
So we get that and we store our as a side name from the next byte.
Seventy four up to the length of the society.
So let's get the length of the society first.
Let's do try here and the length of this side we're doing, we're using four because we need to convert
in packets.
Seventy three.
This is the length of this side.
After that we say this is ID equal packet from seventy four up to seventy four plus the lane and the
score of this side that we have here.
OK, except I'll just say society is equal to a known unknown in society.
Now, again, we check if the business side is not in our list, which we we haven't created yet, so
a business called Last Equal, you're creating a list here.
If we decide this, when we got here is not in the access point list, we added we appended to our list
because we don't want to keep printing the access point over and over, and then we print our business
aside.
And as I said here.
Right, OK, so far so good.
Let's try.
OK, nice.
We got our business side and society here.
OK, so far so good.
But our Mac address, as you see it here, it doesn't look good.
Right.
Let's fix that.
Let's go after the business side line here and add this one, which will format a little bit or make
it like look like an actual business idea, like actual Mac address.
Let's try again.
OK, now it looks like a Mac address, right?
That was all, I guess, for this video.
I hope you enjoyed doing what Skype did.
And Ross Orcharding, thank you for watching and see you in the next video.