If we want to look at some interesting data, we need to log it somewhere.
Now, unlike the interfaces,
this is probably something that you'll want enabled all the time,
so we can go ahead and edit the kismet.conf configuration.
If we search for log,
we can see that the logging options are actually included
from kismet_logging.conf because different files contain
different parts of the configuration.
So we can quit this one and open up the logging configuration file.
It's important that logging is enabled.
We will set the log types to kismet and pcapng.
Pcapng is a modern pcap format.
It doesn't work with every single pcap tool out there,
but it works great with Wireshark, and it includes more data than a regular pcap,
for example about what wireless network these packets were coming from.
If we scroll down,
you can see that there's some predefined file names with different variables,
and this is all good.
So I'm just going to save and run Kismet again with
the same command we used before.
You could specify the logging here, but it's already in our configuration file.
We are going to open the web interface again,
and I'm going to select my DangerZone Wi‑Fi right here. While it's
gathering data, if I just browse to my home directory,
which is where I ran Kismet from,
you can see there's three log files. There's a Kismet journal,
which is getting huge, there is the pcapng,
and there is the regular Kismet SQLite3database. So I'll
continue generating a little bit of traffic,
and we now have about 20 MB of pcaps.
So what I'll do is open up a new terminal, I'll list the files right here,
and I'll run Wireshark on the Kismet log file ending with pcapng. Wireshark
might complain that the capture file was cut short in the middle of a packet.
That's simply because Kismet is only running,
so the last packet to have been stored could have been corrupted.
But it's fine. So I'll just click OK on that, and I'll run
a search. From a device on that Wi‑Fi, I browse a website called neverssl.com,
which is a website that, as its name implies, is never using SSL. So I'm
going to search for the string never in the packet details.
It is now searching my pcap, which is pretty small, and it's taking a while.
So if you're doing this often,
it is definitely worth having a pretty powerful computer with a lot of RAM.
And as you can see, we can see that HTTP connection right here.
I can right‑click it, and I can open the packet in a new
window. And here we can see the actual content of the website
that was accessed over that Wi‑Fi.
This is the actual HTML.
So because that wireless network is in cleartext, we're able to see all of that.
That being said, cleartext is usually encountered in public Wi‑Fis,
hotels, airports,
coffee shops, so that is still a pretty useful thing to be able to do.
Now, if the data is encrypted,
you'll need to have access to the key or to be able to get access to the key
by cracking it before you're able to see that kind of data.
And if you had such a key, all you need to do in Wireshark is go to Edit,
select the Preferences menu, go to Protocols,
find 802.11, which is actually under IEEE 802.11, Enable decryption, and then
go to the Decryption keys menu where you can add the keys.
So any key you've previously cracked you can put in there, and then
Wireshark would make sure to decrypt the data.
Kismet is nonetheless the best way of storing these pcaps.
Now, if you remember,
we're running Kismet on channel 6 because that is where the
Wi‑Fi network we're interested in is running.
But we only have one interface.
If you had multiple interfaces, you could set them to different channels.
So either the hopping happens faster and you don't need to be locked to
a specific channel, or you could lock all of them on their own channel,
and that would look like the Wi‑Fi cactus,
which you might have seen a DevCon before.
So this is how we can eavesdrop on traffic using Kismet, by storing two pcaps.
You can store these pcaps every single time you run Kismet,
and then you can use any variety of tool to go through them.
And another interesting piece of data to add to those logs is location.
If we reopen the logging configuration and we search for GPS,
you'll see that it is possible to log GPS with these Kismet logs.
That is very useful if you have a GPS device connected to your laptop and
you want to locate the different networks you find.
So, for example, if you're doing wardriving around a huge building or a city,
make sure you enable GPS.
That way you'll actually be able to map the different networks that you found.