Hello, everyone, welcome to a new video of our life I spent six years last time we learned how to
write our first Python tool to scan for access points using raw stock hitting.
Today, we will talk about other frames and how to detect connected clients using raw sockets as well.
First, do you remember the steps the client or mobile device has taken to to take to connect to an
access point?
Well, don't worry.
I'll remind you.
Supernet department from before.
Here you go.
First, the client scans for the access for the Wi-Fi access points, then send probe requests, then
authenticate with the access point and finally associate with it.
You might find in Google or in some books, people use probe requests to detect connected clients.
That's not correct.
Probe requests are not sent only when a device is connected to an access point because your device might
be sending those frames.
Even if the access point is out of range and your device is looking for previously connected ones,
even if you get probe response still doesn't mean that your device is connected to this access.
Find these scripts that you might find in Google are just copying from each other.
I mean, so how do we know if a device is really connected to an access point?
Well, we can check for any association response or we could check the data exchange itself like request
to send and clear to send.
These two frames are usually sent from a device using wireless network to avoid collision.
So if your device wants to send data, it will send a request to send first and wait for clear to send
once received it then sends the data so we can check for these frames as well to verify if a client
is already connected to network or not.
So let's do that.
Let's check for both clear to send frames and association response frames.
Let's start with the association response frames first.
First, we need to check what's a subtype of the association response request to send and clear to send,
it's easy.
You can look it up and go.
But the subtype for association response is one.
Let's confirm that using Wireshark.
So my shirt.
What sort of scan?
All right, I think we're just stop here for now.
Let's start started over so without setting and then I'm going to do now is turn off wi fi from my phone
since my phone is already connected to this two point four gigahertz access point.
I'm going to turn off the Wi-Fi from my phone and turn it back on.
So I'm making my phone to reconnect to this access point.
All right, turn it off.
WI fi disconnected.
OK, I'm going to turn around back and turn off.
Turn on the Wi-Fi again, OK?
I think we should have captured the friendly.
Let's stop this now.
Let's use the filters here to look for it.
I believe, like I said before, it was number one.
So I just type one here.
Oh, nothing here.
Well, they didn't capture anything.
Let's try again.
I'm going to disconnect my phone from the Wi-Fi.
Uh, OK.
Connected back again.
Oh, I forgot to capture.
OK, let's do it again one more time.
Disconnect.
OK, let's continue again.
Nothing yet.
I think I've figured out why it's because the channel is not number one.
It's 11, so it's changed channel to 11.
Let's try one more time to you.
I'm going to disconnect my phone real quick.
Connected again.
We got it nice it started here now.
Now let's check the type, the subtyping tax.
Subtype is 10, right?
Can you see it here?
So let's add to add that to our code of case.
I'm going to stop there.
Very well, I'm typing because I don't want this video to be long.
So let's check for the frame type and then print something to the screen confirming that we received
it like this.
Like just print.
Oh, got
response.
OK.
Now, let's try to disconnect my phone again.
Connected back.
Nice, we got it, got association response.
So far, so good.
Now let's fund the Mac address of that client means get the Mac out of my palm again.
We open the frame and go to Tripoli to 11 here.
OK.
Let's check the receiver address here.
It starts from bite number 40 to 45.
This is the receiver Mac address.
So that means we need to do it in Python two to be from bite number three to four or five.
Sorry, but no free text.
So it's due to just in.
Come here.
Receive an equal pay packet from 40 to provide 40 to 46, the PIN code as eggs now printed.
Let's try again.
Justin.
Do one more time.
Disconnect the phone.
Connected back, got it.
OK, so let's fix the McAdoo's format a little bit from before we do this, just copy this one here
and.
Oh, my.
And this is.
Can use the this time because I'm bored.
OK.
One more time.
Connect, connect again, nice.
Oh, still the same.
I'll see what happens.
Oh, my pet, I used the plus signs instead of equal time here, so OK.
I mean.
One last time disconnect.
OK, it's fixed now.
That's good.
That was it.
Now you know how to detect a new connected client, but if you want to detect an already connected client,
then check for the request to send in the clear to send friends the same way we did this.
I'll leave that to you as an exercise.
Thank you for watching this video.
See you in the next one.