WiFiScan.cpp 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645
  1. #include "WiFiScan.h"
  2. //esp_err_t esp_wifi_80211_tx(wifi_interface_t ifx, const void *buffer, int len, bool en_sys_seq);
  3. class bluetoothScanAllCallback: public BLEAdvertisedDeviceCallbacks {
  4. void onResult(BLEAdvertisedDevice advertisedDevice) {
  5. String display_string = "";
  6. if (display_obj.display_buffer->size() >= 0)
  7. {
  8. display_string.concat(" RSSI: ");
  9. display_string.concat(advertisedDevice.getRSSI());
  10. Serial.print(" RSSI: ");
  11. Serial.print(advertisedDevice.getRSSI());
  12. display_string.concat(" ");
  13. Serial.print(" ");
  14. Serial.print("Device: ");
  15. if(advertisedDevice.getName().length() != 0)
  16. {
  17. display_string.concat(advertisedDevice.getName().c_str());
  18. Serial.print(advertisedDevice.getName().c_str());
  19. }
  20. else
  21. {
  22. display_string.concat(advertisedDevice.getAddress().toString().c_str());
  23. Serial.print(advertisedDevice.getAddress().toString().c_str());
  24. }
  25. int temp_len = display_string.length();
  26. for (int i = 0; i < 40 - temp_len; i++)
  27. {
  28. display_string.concat(" ");
  29. }
  30. Serial.println();
  31. while (display_obj.printing)
  32. delay(1);
  33. display_obj.loading = true;
  34. display_obj.display_buffer->add(display_string);
  35. display_obj.loading = false;
  36. }
  37. }
  38. };
  39. class bluetoothScanSkimmersCallback: public BLEAdvertisedDeviceCallbacks {
  40. void onResult(BLEAdvertisedDevice advertisedDevice) {
  41. String bad_list[bad_list_length] = {"HC-03", "HC-05", "HC-06"};
  42. if (display_obj.display_buffer->size() >= 0)
  43. {
  44. Serial.print("Device: ");
  45. String display_string = "";
  46. //display_string.concat(" RSSI: ");
  47. //display_string.concat(advertisedDevice.getRSSI());
  48. //display_string.concat(" ");
  49. if(advertisedDevice.getName().length() != 0)
  50. {
  51. //display_string.concat(advertisedDevice.getName().c_str());
  52. Serial.print(advertisedDevice.getName().c_str());
  53. for(int i = 0; i < bad_list_length; i++)
  54. {
  55. if(strcmp(advertisedDevice.getName().c_str(), bad_list[i].c_str()) == 0)
  56. {
  57. display_string.concat("Potential Skimmer: ");
  58. display_string.concat(" ");
  59. display_string.concat(advertisedDevice.getName().c_str());
  60. int temp_len = display_string.length();
  61. for (int i = 0; i < 40 - temp_len; i++)
  62. {
  63. display_string.concat(" ");
  64. }
  65. while (display_obj.printing)
  66. delay(1);
  67. display_obj.loading = true;
  68. display_obj.display_buffer->add(display_string);
  69. display_obj.loading = false;
  70. }
  71. }
  72. }
  73. else
  74. {
  75. Serial.print(advertisedDevice.getAddress().toString().c_str());
  76. //display_string.concat(advertisedDevice.getAddress().toString().c_str());
  77. }
  78. /*
  79. int temp_len = display_string.length();
  80. for (int i = 0; i < 40 - temp_len; i++)
  81. {
  82. display_string.concat(" ");
  83. }
  84. */
  85. Serial.print(" RSSI: ");
  86. Serial.println(advertisedDevice.getRSSI());
  87. /*
  88. while (display_obj.printing)
  89. delay(1);
  90. display_obj.loading = true;
  91. display_obj.display_buffer->add(display_string);
  92. display_obj.loading = false;
  93. */
  94. }
  95. }
  96. };
  97. WiFiScan::WiFiScan()
  98. {
  99. }
  100. // Function to prepare to run a specific scan
  101. void WiFiScan::StartScan(uint8_t scan_mode, uint16_t color)
  102. {
  103. //Serial.println("Starting Scan...");
  104. if (scan_mode == WIFI_SCAN_OFF)
  105. StopScan(scan_mode);
  106. else if (scan_mode == WIFI_SCAN_PROBE)
  107. RunProbeScan(scan_mode, color);
  108. else if (scan_mode == WIFI_SCAN_AP)
  109. RunBeaconScan(scan_mode, color);
  110. else if (scan_mode == WIFI_ATTACK_BEACON_SPAM)
  111. RunBeaconSpam(scan_mode, color);
  112. else if (scan_mode == WIFI_ATTACK_RICK_ROLL)
  113. RunRickRoll(scan_mode, color);
  114. else if (scan_mode == BT_SCAN_ALL)
  115. RunBluetoothScan(scan_mode, color);
  116. else if (scan_mode == BT_SCAN_SKIMMERS)
  117. RunBluetoothScan(scan_mode, color);
  118. WiFiScan::currentScanMode = scan_mode;
  119. }
  120. // Function to stop all wifi scans
  121. void WiFiScan::StopScan(uint8_t scan_mode)
  122. {
  123. if ((currentScanMode == WIFI_SCAN_PROBE) ||
  124. (currentScanMode == WIFI_SCAN_AP) ||
  125. (currentScanMode == WIFI_SCAN_ST) ||
  126. (currentScanMode == WIFI_SCAN_ALL) ||
  127. (currentScanMode == WIFI_ATTACK_BEACON_SPAM) ||
  128. (currentScanMode == WIFI_ATTACK_RICK_ROLL))
  129. {
  130. esp_wifi_set_promiscuous(false);
  131. WiFi.mode(WIFI_OFF);
  132. }
  133. else if ((currentScanMode == BT_SCAN_ALL) ||
  134. (currentScanMode == BT_SCAN_SKIMMERS))
  135. {
  136. Serial.println("Stopping BLE scan...");
  137. pBLEScan->stop();
  138. Serial.println("BLE Scan Stopped");
  139. }
  140. display_obj.display_buffer->clear();
  141. Serial.print("display_buffer->size(): ");
  142. Serial.println(display_obj.display_buffer->size());
  143. display_obj.tteBar = false;
  144. }
  145. void WiFiScan::RunRickRoll(uint8_t scan_mode, uint16_t color)
  146. {
  147. //Serial.println("Rick Roll...");
  148. display_obj.TOP_FIXED_AREA_2 = 32;
  149. display_obj.tteBar = true;
  150. display_obj.print_delay_1 = 15;
  151. display_obj.print_delay_2 = 10;
  152. display_obj.clearScreen();
  153. display_obj.initScrollValues(true);
  154. display_obj.tft.setTextWrap(false);
  155. display_obj.tft.setTextColor(TFT_BLACK, color);
  156. display_obj.tft.fillRect(0,0,240,16, color);
  157. display_obj.tft.drawCentreString(" Rick Roll Beacon ",120,0,2);
  158. display_obj.touchToExit();
  159. display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
  160. packets_sent = 0;
  161. //esp_wifi_set_mode(WIFI_MODE_STA);
  162. WiFi.mode(WIFI_AP_STA);
  163. esp_wifi_set_promiscuous_filter(NULL);
  164. esp_wifi_set_promiscuous(true);
  165. esp_wifi_set_max_tx_power(78);
  166. initTime = millis();
  167. //display_obj.clearScreen();
  168. //Serial.println("End of func");
  169. }
  170. // Function to prepare for beacon spam
  171. void WiFiScan::RunBeaconSpam(uint8_t scan_mode, uint16_t color)
  172. {
  173. //Serial.println("Beacon Spam...");
  174. display_obj.TOP_FIXED_AREA_2 = 32;
  175. display_obj.tteBar = true;
  176. display_obj.print_delay_1 = 15;
  177. display_obj.print_delay_2 = 10;
  178. display_obj.clearScreen();
  179. display_obj.initScrollValues(true);
  180. display_obj.tft.setTextWrap(false);
  181. display_obj.tft.setTextColor(TFT_BLACK, color);
  182. display_obj.tft.fillRect(0,0,240,16, color);
  183. display_obj.tft.drawCentreString(" Beacon Spam Random ",120,0,2);
  184. display_obj.touchToExit();
  185. display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
  186. packets_sent = 0;
  187. //esp_wifi_set_mode(WIFI_MODE_STA);
  188. WiFi.mode(WIFI_AP_STA);
  189. esp_wifi_set_promiscuous_filter(NULL);
  190. esp_wifi_set_promiscuous(true);
  191. esp_wifi_set_max_tx_power(78);
  192. initTime = millis();
  193. //display_obj.clearScreen();
  194. //Serial.println("End of func");
  195. }
  196. // Function to start running a beacon scan
  197. void WiFiScan::RunBeaconScan(uint8_t scan_mode, uint16_t color)
  198. {
  199. display_obj.TOP_FIXED_AREA_2 = 32;
  200. display_obj.tteBar = true;
  201. display_obj.print_delay_1 = 15;
  202. display_obj.print_delay_2 = 10;
  203. display_obj.clearScreen();
  204. display_obj.initScrollValues(true);
  205. display_obj.tft.setTextWrap(false);
  206. display_obj.tft.setTextColor(TFT_WHITE, color);
  207. display_obj.tft.fillRect(0,0,240,16, color);
  208. display_obj.tft.drawCentreString(" Beacon Sniffer ",120,0,2);
  209. display_obj.touchToExit();
  210. display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
  211. display_obj.setupScrollArea(display_obj.TOP_FIXED_AREA_2, BOT_FIXED_AREA);
  212. wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
  213. esp_wifi_init(&cfg);
  214. esp_wifi_set_storage(WIFI_STORAGE_RAM);
  215. esp_wifi_set_mode(WIFI_MODE_NULL);
  216. esp_wifi_set_promiscuous(true);
  217. esp_wifi_set_promiscuous_filter(&filt);
  218. esp_wifi_set_promiscuous_rx_cb(&beaconSnifferCallback);
  219. esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
  220. initTime = millis();
  221. }
  222. // Function for running probe request scan
  223. void WiFiScan::RunProbeScan(uint8_t scan_mode, uint16_t color)
  224. {
  225. display_obj.TOP_FIXED_AREA_2 = 32;
  226. display_obj.tteBar = true;
  227. display_obj.print_delay_1 = 15;
  228. display_obj.print_delay_2 = 10;
  229. display_obj.clearScreen();
  230. display_obj.initScrollValues(true);
  231. display_obj.tft.setTextWrap(false);
  232. display_obj.tft.setTextColor(TFT_BLACK, color);
  233. display_obj.tft.fillRect(0,0,240,16, color);
  234. display_obj.tft.drawCentreString(" Probe Request Sniffer ",120,0,2);
  235. display_obj.touchToExit();
  236. display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
  237. display_obj.setupScrollArea(display_obj.TOP_FIXED_AREA_2, BOT_FIXED_AREA);
  238. wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
  239. esp_wifi_init(&cfg);
  240. esp_wifi_set_storage(WIFI_STORAGE_RAM);
  241. esp_wifi_set_mode(WIFI_MODE_NULL);
  242. esp_wifi_set_promiscuous(true);
  243. esp_wifi_set_promiscuous_filter(&filt);
  244. esp_wifi_set_promiscuous_rx_cb(&probeSnifferCallback);
  245. esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
  246. initTime = millis();
  247. }
  248. // Function to start running any BLE scan
  249. void WiFiScan::RunBluetoothScan(uint8_t scan_mode, uint16_t color)
  250. {
  251. display_obj.print_delay_1 = 50;
  252. display_obj.print_delay_2 = 20;
  253. BLEDevice::init("");
  254. pBLEScan = BLEDevice::getScan(); //create new scan
  255. if (scan_mode == BT_SCAN_ALL)
  256. {
  257. display_obj.TOP_FIXED_AREA_2 = 32;
  258. display_obj.tteBar = true;
  259. display_obj.clearScreen();
  260. display_obj.initScrollValues(true);
  261. display_obj.tft.setTextWrap(false);
  262. display_obj.tft.setTextColor(TFT_BLACK, color);
  263. display_obj.tft.fillRect(0,0,240,16, color);
  264. display_obj.tft.drawCentreString(" Bluetooth Sniff ",120,0,2);
  265. display_obj.touchToExit();
  266. display_obj.tft.setTextColor(TFT_CYAN, TFT_BLACK);
  267. display_obj.setupScrollArea(display_obj.TOP_FIXED_AREA_2, BOT_FIXED_AREA);
  268. pBLEScan->setAdvertisedDeviceCallbacks(new bluetoothScanAllCallback());
  269. }
  270. else if (scan_mode == BT_SCAN_SKIMMERS)
  271. {
  272. display_obj.TOP_FIXED_AREA_2 = 160;
  273. display_obj.tteBar = true;
  274. display_obj.clearScreen();
  275. display_obj.tft.fillScreen(TFT_DARKGREY);
  276. display_obj.initScrollValues(true);
  277. display_obj.tft.setTextWrap(false);
  278. display_obj.tft.setTextColor(TFT_BLACK, color);
  279. display_obj.tft.fillRect(0,0,240,16, color);
  280. display_obj.tft.drawCentreString(" Detect Card Skimmers ",120,0,2);
  281. display_obj.twoPartDisplay("Scanning for\nBluetooth-enabled skimmers\nHC-03, HC-05, and HC-06...");
  282. display_obj.tft.setTextColor(TFT_BLACK, TFT_DARKGREY);
  283. display_obj.setupScrollArea(display_obj.TOP_FIXED_AREA_2, BOT_FIXED_AREA);
  284. pBLEScan->setAdvertisedDeviceCallbacks(new bluetoothScanSkimmersCallback());
  285. }
  286. pBLEScan->setActiveScan(true); //active scan uses more power, but get results faster
  287. pBLEScan->setInterval(100);
  288. pBLEScan->setWindow(99); // less or equal setInterval value
  289. pBLEScan->start(0, scanCompleteCB);
  290. Serial.println("Started BLE Scan");
  291. initTime = millis();
  292. }
  293. // Function that is called when BLE scan is completed
  294. void WiFiScan::scanCompleteCB(BLEScanResults scanResults) {
  295. printf("Scan complete!\n");
  296. printf("Found %d devices\n", scanResults.getCount());
  297. scanResults.dump();
  298. } // scanCompleteCB
  299. // Function to extract MAC addr from a packet at given offset
  300. void WiFiScan::getMAC(char *addr, uint8_t* data, uint16_t offset) {
  301. sprintf(addr, "%02x:%02x:%02x:%02x:%02x:%02x", data[offset+0], data[offset+1], data[offset+2], data[offset+3], data[offset+4], data[offset+5]);
  302. }
  303. void WiFiScan::beaconSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
  304. {
  305. wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
  306. WifiMgmtHdr *frameControl = (WifiMgmtHdr*)snifferPacket->payload;
  307. wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)snifferPacket->rx_ctrl;
  308. int len = snifferPacket->rx_ctrl.sig_len;
  309. String display_string = "";
  310. if (type == WIFI_PKT_MGMT)
  311. {
  312. int fctl = ntohs(frameControl->fctl);
  313. const wifi_ieee80211_packet_t *ipkt = (wifi_ieee80211_packet_t *)snifferPacket->payload;
  314. const WifiMgmtHdr *hdr = &ipkt->hdr;
  315. // If we dont the buffer size is not 0, don't write or else we get CORRUPT_HEAP
  316. if ((snifferPacket->payload[0] == 0x80) && (display_obj.display_buffer->size() == 0))
  317. {
  318. delay(random(0, 10));
  319. Serial.print("RSSI: ");
  320. Serial.print(snifferPacket->rx_ctrl.rssi);
  321. Serial.print(" Ch: ");
  322. Serial.print(snifferPacket->rx_ctrl.channel);
  323. Serial.print(" BSSID: ");
  324. char addr[] = "00:00:00:00:00:00";
  325. getMAC(addr, snifferPacket->payload, 10);
  326. Serial.print(addr);
  327. display_string.concat(addr);
  328. Serial.print(" ESSID: ");
  329. display_string.concat(" -> ");
  330. for (int i = 0; i < snifferPacket->payload[37]; i++)
  331. {
  332. Serial.print((char)snifferPacket->payload[i + 38]);
  333. display_string.concat((char)snifferPacket->payload[i + 38]);
  334. }
  335. for (int i = 0; i < 19 - snifferPacket->payload[37]; i++)
  336. {
  337. display_string.concat(" ");
  338. }
  339. Serial.print(" ");
  340. if (display_obj.display_buffer->size() == 0)
  341. {
  342. display_obj.loading = true;
  343. display_obj.display_buffer->add(display_string);
  344. display_obj.loading = false;
  345. }
  346. Serial.println();
  347. }
  348. }
  349. }
  350. void WiFiScan::probeSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
  351. wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
  352. WifiMgmtHdr *frameControl = (WifiMgmtHdr*)snifferPacket->payload;
  353. wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)snifferPacket->rx_ctrl;
  354. int len = snifferPacket->rx_ctrl.sig_len;
  355. String display_string = "";
  356. if (type == WIFI_PKT_MGMT)
  357. {
  358. int fctl = ntohs(frameControl->fctl);
  359. const wifi_ieee80211_packet_t *ipkt = (wifi_ieee80211_packet_t *)snifferPacket->payload;
  360. const WifiMgmtHdr *hdr = &ipkt->hdr;
  361. // If we dont the buffer size is not 0, don't write or else we get CORRUPT_HEAP
  362. if ((snifferPacket->payload[0] == 0x40) && (display_obj.display_buffer->size() == 0))
  363. {
  364. delay(random(0, 10));
  365. Serial.print("RSSI: ");
  366. Serial.print(snifferPacket->rx_ctrl.rssi);
  367. Serial.print(" Ch: ");
  368. Serial.print(snifferPacket->rx_ctrl.channel);
  369. Serial.print(" Client: ");
  370. char addr[] = "00:00:00:00:00:00";
  371. getMAC(addr, snifferPacket->payload, 10);
  372. Serial.print(addr);
  373. display_string.concat(addr);
  374. Serial.print(" Requesting: ");
  375. display_string.concat(" -> ");
  376. for (int i = 0; i < snifferPacket->payload[25]; i++)
  377. {
  378. Serial.print((char)snifferPacket->payload[26 + i]);
  379. display_string.concat((char)snifferPacket->payload[26 + i]);
  380. }
  381. // Print spaces because of the rotating lines of the hardware scroll.
  382. // The same characters print from previous lines so I just overwrite them
  383. // with spaces.
  384. for (int i = 0; i < 19 - snifferPacket->payload[25]; i++)
  385. {
  386. display_string.concat(" ");
  387. }
  388. if (display_obj.display_buffer->size() == 0)
  389. {
  390. //while (display_obj.printing)
  391. // delay(1);
  392. display_obj.loading = true;
  393. display_obj.display_buffer->add(display_string);
  394. display_obj.loading = false;
  395. }
  396. Serial.println();
  397. }
  398. }
  399. }
  400. // Function to send beacons with random ESSID length
  401. void WiFiScan::broadcastSetSSID(uint32_t current_time, char* ESSID) {
  402. set_channel = random(1,12);
  403. esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
  404. delay(1);
  405. // Randomize SRC MAC
  406. packet[10] = packet[16] = random(256);
  407. packet[11] = packet[17] = random(256);
  408. packet[12] = packet[18] = random(256);
  409. packet[13] = packet[19] = random(256);
  410. packet[14] = packet[20] = random(256);
  411. packet[15] = packet[21] = random(256);
  412. /////////////////////////////
  413. //int essid_len = random(6, 10);
  414. // random prefix to beacon essid
  415. //uint8_t rand_reg[essid_len] = {};
  416. //for (int i = 0; i < essid_len; i++)
  417. // rand_reg[i] = alfa[random(65)];
  418. int ssidLen = strlen(ESSID);
  419. //int rand_len = sizeof(rand_reg);
  420. int fullLen = ssidLen;
  421. packet[37] = fullLen;
  422. // Insert random prefix
  423. //for (int i = 0; i < rand_len; i++)
  424. // packet[38+i] = rand_reg[i];
  425. // Insert my tag
  426. for(int i = 0; i < ssidLen; i++)
  427. packet[38 + i] = ESSID[i];
  428. /////////////////////////////
  429. packet[50 + fullLen] = set_channel;
  430. uint8_t postSSID[13] = {0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c, //supported rate
  431. 0x03, 0x01, 0x04 /*DSSS (Current Channel)*/ };
  432. // Add everything that goes after the SSID
  433. for(int i = 0; i < 12; i++)
  434. packet[38 + fullLen + i] = postSSID[i];
  435. esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  436. esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  437. esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  438. //esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  439. //esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  440. //esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  441. packets_sent = packets_sent + 3;
  442. }
  443. // Function for sending crafted beacon frames
  444. void WiFiScan::broadcastRandomSSID(uint32_t currentTime) {
  445. set_channel = random(1,12);
  446. esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
  447. delay(1);
  448. // Randomize SRC MAC
  449. packet[10] = packet[16] = random(256);
  450. packet[11] = packet[17] = random(256);
  451. packet[12] = packet[18] = random(256);
  452. packet[13] = packet[19] = random(256);
  453. packet[14] = packet[20] = random(256);
  454. packet[15] = packet[21] = random(256);
  455. packet[37] = 6;
  456. // Randomize SSID (Fixed size 6. Lazy right?)
  457. packet[38] = alfa[random(65)];
  458. packet[39] = alfa[random(65)];
  459. packet[40] = alfa[random(65)];
  460. packet[41] = alfa[random(65)];
  461. packet[42] = alfa[random(65)];
  462. packet[43] = alfa[random(65)];
  463. packet[56] = set_channel;
  464. uint8_t postSSID[13] = {0x01, 0x08, 0x82, 0x84, 0x8b, 0x96, 0x24, 0x30, 0x48, 0x6c, //supported rate
  465. 0x03, 0x01, 0x04 /*DSSS (Current Channel)*/ };
  466. // Add everything that goes after the SSID
  467. for(int i = 0; i < 12; i++)
  468. packet[38 + 6 + i] = postSSID[i];
  469. //Serial.println("About to send packets...");
  470. esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  471. esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  472. esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  473. //esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  474. //esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  475. //esp_wifi_80211_tx(WIFI_IF_AP, packet, sizeof(packet), false);
  476. packets_sent = packets_sent + 3;
  477. //Serial.print("Packets sent: ");
  478. //Serial.println(packets_sent);
  479. //Serial.println("Sent packets");
  480. }
  481. //void WiFiScan::sniffer_callback(void* buf, wifi_promiscuous_pkt_type_t type) {
  482. // wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
  483. // showMetadata(snifferPacket, type);
  484. //}
  485. // Function to cycle to the next channel
  486. void WiFiScan::channelHop()
  487. {
  488. set_channel = set_channel + 1;
  489. if (set_channel > 13) {
  490. set_channel = 1;
  491. }
  492. esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
  493. delay(1);
  494. }
  495. // Function for updating scan status
  496. void WiFiScan::main(uint32_t currentTime)
  497. {
  498. // WiFi operations
  499. if ((currentScanMode == WIFI_SCAN_PROBE) ||
  500. (currentScanMode == WIFI_SCAN_AP) ||
  501. (currentScanMode == WIFI_SCAN_ST) ||
  502. (currentScanMode == WIFI_SCAN_ALL))
  503. {
  504. if (currentTime - initTime >= 1000)
  505. {
  506. initTime = millis();
  507. channelHop();
  508. }
  509. }
  510. else if ((currentScanMode == WIFI_ATTACK_BEACON_SPAM))
  511. {
  512. // Need this for loop because getTouch causes ~10ms delay
  513. // which makes beacon spam less effective
  514. for (int i = 0; i < 55; i++)
  515. broadcastRandomSSID(currentTime);
  516. if (currentTime - initTime >= 1000)
  517. {
  518. initTime = millis();
  519. //Serial.print("packets/sec: ");
  520. //Serial.println(packets_sent);
  521. String displayString = "";
  522. String displayString2 = "";
  523. displayString.concat("packets/sec: ");
  524. displayString.concat(packets_sent);
  525. for (int x = 0; x < STANDARD_FONT_CHAR_LIMIT; x++)
  526. displayString2.concat(" ");
  527. display_obj.showCenterText(displayString2, 160);
  528. display_obj.showCenterText(displayString, 160);
  529. packets_sent = 0;
  530. }
  531. }
  532. else if ((currentScanMode == WIFI_ATTACK_RICK_ROLL))
  533. {
  534. // Need this for loop because getTouch causes ~10ms delay
  535. // which makes beacon spam less effective
  536. for (int i = 0; i < 7; i++)
  537. {
  538. for (int x = 0; x < (sizeof(rick_roll)/sizeof(char *)); x++)
  539. {
  540. broadcastSetSSID(currentTime, rick_roll[x]);
  541. }
  542. }
  543. if (currentTime - initTime >= 1000)
  544. {
  545. initTime = millis();
  546. //Serial.print("packets/sec: ");
  547. //Serial.println(packets_sent);
  548. String displayString = "";
  549. String displayString2 = "";
  550. displayString.concat("packets/sec: ");
  551. displayString.concat(packets_sent);
  552. for (int x = 0; x < STANDARD_FONT_CHAR_LIMIT; x++)
  553. displayString2.concat(" ");
  554. display_obj.showCenterText(displayString2, 160);
  555. display_obj.showCenterText(displayString, 160);
  556. packets_sent = 0;
  557. }
  558. }
  559. }