Will Chatham is an Information Security Analyst, OSCP, Ethical Hacker, and Penetration Tester at a federal data center in Asheville, NC. Since Netscape 2.0, he has worked in a wide array of environments including non-profit, corporate, small business, and government. His varied background, from developer to search engine optimizer to security professional, has helped him build a wide range of skills that help those with whom he works and teaches.

Find more about me on:

Here are my most recent posts

Will Chatham is an Information Security Analyst, OSCP, Ethical Hacker, and Penetration Tester at a federal data center in Asheville, NC. Since Netscape 2.0, he has worked in a wide array of environments including non-profit, corporate, small business, and government. His varied background, from developer to search engine optimizer to security professional, has helped him build a wide range of skills that help those with whom he works and teaches.

4 External USB Wifi Adapters for Kali Linux Pentesting

If you are like me, you have been working with Kali Linux, the Linux distribution for penetration testing and ethical hacking, and have been running it as a virtual machine on your 2015 Macbook Pro. And, you have been having issues with sniffing packets because your 2015 Macbook’s built-in wifi adapter is not going into true promiscuous mode — only a limited version that doesn’t give you everything you need. Sadly, other versions of the Macbook don’t seem to have this problem at all, so you may be finding yourself in need of an additional interface.

Or, perhaps you are not like me, and the chipset driving your PC’s Wifi adapter doesn’t let you do much at all, and you just want an external USB Wifi adapter that will make it easy to use tools such as Aircrack-ng for ethical hacking jobs.

Whatever the case, I’ve done some research and will present a few options that don’t break the bank and should provide you with a quick and easy way to do all the proper packet sniffing you deserve.

TP-Link N150

The first option on this list is the $13.45 TP-Link N150 dongle. A small USB device that sports a detachable antenna, it should get the job done if you prefer portability over power. This device uses the Atheros AR9271 chipset, which is known to work smoothly in Kali Linux (and probably most other distros).

USB Rt3070

The cheapest USB adapter, at a paltry $11.99, is the generic USB Rt3070, another dongle style device that is also the smallest you will find here. With similar specs as the TP-Link device, this one is even easier to conceal, and probably won’t raise any suspicions if you have it plugged into your laptop in a crowded place. While not the most powerful device by any means, if you are near the router you want to connect to, it shouldn’t be a problem.

Alfa AWUS051NH

Taking a big step up in everything, including features, power, and profile, we have the Alfa AWUS051NH. This one has been sitting on my Amazon wishlist for quite a while, and I think it’s about time I pick it up. It even has a holster with suction cups to stick to a window, and it will pick signals up from long range.

If you are needing to physically stay away from the target you are testing, while still being able to test it, try this sucker.

Alfa AWUS036NHA

Lastly, we have another Alfa device, both of which get really good reviews for Kali Linux in particular. At only $6 more than the AWUS051NH, the Alfa AWUS036NHA looks cooler and has a boost in power to let it pick up signals from even farther away. It also comes with the holster and suction cups for the windows of your vehicle, office, or home. According to its description, what sets it apart is the “High Transmitter Power of 28dBm – for Long-Rang and High Gain Wi-Fi.”

 

Are there others?

Have you tried any of these? What did you think? Know of any others that do a good job?

A Review of EaseUS Data Recovery Software for Mac

I have never really had the need for data recovery software until recently, when I mistakenly deleted a bunch of data off of a USB thumb drive, thinking I had backed it up somewhere. Much to my chagrin, I had not in fact backed it up. There were some files I was really going to miss, such as recordings of music I had made in Logic, and some various photos I’ve carried around with me over the years.

As I quickly learned, these type of apps do not run cheap. After doing some digging, I ran across a promising candidate called EaseUS Data Recovery. As far as data recovery software goes, they seemed to have been around a while, and had some good reviews. At $89.95, though, I expected it to do great things. Not only did I want Mac data recovery, I wanted a tool that would let me recover data from external hard drives, USB thumbs drives, and more. EaseUS promised to do that.

Installing The App

There were a few concerning things that happened during the installation process. For starters, Little Snitch reported outbound connections to track.easus.com. I could understand the need to reach out and check the license key, but over port 80? The subdomain “track” indicated that this was collecting some sort of metrics. I’m not sure I feel OK about that, especially over an unencrypted connection.

I let it pass through, and the installation continued. Another outbound connection warning appeared:

Hmm…another non-SSL connection to their website. I would hope that a company charging $90 for an application would be able to (and be smart enough to) get an SSL certificate to encrypt these connections, thereby helping protect their customer’s privacy.

Post Installation

Once installed, I went to plug in the license information that EaseUS had provided to me to register the product and assure I was getting all the features. When I did this, another unencrypted outbound alert appeared, which I can only assume contained my license key information as the software called home to validate it:

EaseUS doesn’t seem to care about encrypted data transfers. Not good!

The last complaint about the installation process is that I was left with a new taskbar widget that looked like a weather alert. 35 degrees? What is that?

Turns out this is a widget that provides “S.M.A.R.T.” monitoring of my drives. I’m not sure what that acronym stands for, but this widget was added for me without my knowledge, and it was promising to monitor my drives for issues. I decided to disable it since I am not a fan of widgets being added for me without asking.

Recovering Data with the Recovery Wizard

At this point, things got considerably better. The application was a breeze to figure out and use. I was first asked what type of files I wanted to recover. I left all of them checked since I wasn’t sure what all was on my deleted USB thumb drive.

From there, I was given a list of drives on my system:

Selecting my USB drive, I proceeded. Within a minute I was shown a bunch of files that were recoverable from my USB drive. I was able to choose what I wanted to be restored.

After that, all it took was clicking the Restore button, and I was asked where I wanted to save everything. Another 2 minutes later, I had all my files back! I’m not sure why I’d want to Tweet about that or “share my happiness” on Facebook, but I was given that option when the operation was complete.

MP3’s worked, images were viewable, and everything was good. I did notice a few filename characters had been replaced with a “#” sign, but they still operated normally. The EaseUS software did exactly what it said it would do.

Summary

All in all, this is a good product based my testing experience, and I’d recommend it if you need to recover data from a computer or external drive. There are some installation shenanigans to be aware of, as the software tries to install its monitoring widget without your consent. The worst part of it all is that the outbound calls to easus.com are not encrypted. EaseUS: get your stuff encrypted, please!

Tool Sharpening

As honest Abe Lincoln said, “Give me six hours to chop down a tree and I will spend the first four sharpening the axe.”

For the last six months, I have been playing the part of Hey Blinkin, getting the tools in my toolbox sharpened, honed, configured, and ready as I am inches away from starting the PWK/OSCP course. As soon as some paperwork clears, I’ll be signing up, hopefully to start in mid-July. You may have seen me posting things I’ve learned so far here on my blog. I intend to keep it up, as finding other OSCP adventurer blogs, tips, and tools along my journey has been invaluable. I hope to pay it forward here.

That said, here are a few very sharp tools I’ve come to love (as recently as this evening):

iTerm 2 – http://iterm2.com/ – a better Terminal app for Mac. Highly configurable, integrative, and versatile. Not exactly a pentesting tool, but something anyone doing command line work on a Mac should check out.

Sn1per – https://github.com/1N3/Sn1per – a super-thorough and invasive reconnaissance tool. It is very noisy and not recommended for actual pentesting, but it is great for working on CTF and Vulnhub VMs.

OSINT Framework – http://osintframework.com/ – a hefty, well-organized set of free tools for gathering all kinds of information. Originally geared towards security, it includes a lot of other fields as well. Follow it on GitHub here.

 

Microsoft Windows has Free Virtual Machines

Wish I had know about these earlier. Microsoft offers free Windows virtual machines for VirtualBox, VMWare, and others. You can choose from Windows 7, Windows 8, or Windows 10 (a few different flavors of each). They last 90 days before expiring, but you can snapshot them right after you install them to make it easy to reset that 90 days by rolling back to the snapshot.

Officially, these are for testing out the Edge browser, but you can also use them for whatever else 😉

Check them out here:

https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/

 

 

Metasploit Tidbits

I’ve been working through Metasploit Unleashed in preparation for the PWK course and the ensuing OSCP exam. Looks like I’ll be signing up for that in early July. While you can’t use Metasploit on the OSCP exam, they do teach it in the PWK course itself, and it’s a very powerful tool anyway, so learning it now seemed like a good idea.

I’ve been taking a lot of notes in OneNote as I progress on all things OSCP, but I thought I’d share some of the handier Metasploit tricks that I might find myself using from day to day. Additionally, writing all this out and thinking about it as I do so helps me commit it to memory, so this blog post isn’t an entirely selfless effort 😉

Find Hosts on Your Network

The arp_sweep auxiliary module comes in handy to find hosts on your network. In the below example, you select the arp_sweep tool, show its options, then set the RHOSTS variable accordingly for you your network range.

Running the above will return some output that looks something like this:

If you want to be sneaky when you do this (and why would you need to be sneaky on your home network? 😉 ) you can spoof the source host (you) and the source MAC address so that it doesn’t look like you have been scanning anything. Typically, you might set this to appear to be coming from your router.

Scan a Host

Metasploit lets you scan hosts that you discover.

You can set THREADS (10) and CONCURRENCY (20) too, to help speed things up without getting too crazy.

You can even use nmap from within Metasploit, and store the results in the database, or import normal nmap results (saved as xml) into the Metasploit database. The advantage of doing this is that you can save your work and results in workspaces in Metasploit. Workspaces let you create projects and keep things organized, which is useful when working on many targets, or with a team.

I will provide some examples of this soon. Stay tuned. For now, here’s what looks like a great reference for this.