Wifi Autoscaning w/ Raspberry Pi and Kali Linux

I love Raspberry Pis. I currently have 2 Model B rev 2s, an original Model B rev 1, and now a Model A. One of the project's that I'm really looking forward to doing is working with the Model A as a battery powered device for wireless penetration testing, and as a mobile tool for reconnaissance. With it's credit-card size and low power requirements, the Raspberry Pi Model A is perfectly suited for the job.

Here's the main components for my layout (you should be able to purchase the major components for less than $120):

1. A Raspberry Pi Model A complete with Pibow ModelA Case. You can order the set here.
2. An Alfa Network 802.11b/g/n Long Range Wireless USB Adapter
3. 2.4GHz 20DBi High Gain WIFI Directional YAGI Antenna
4. 12000mah External USB Battery Pack
5. 8GB SD Flash Card recommended, minimum 4GB
6. You will also need the necessary USB cables, keyboard, and a display for the initial setup. Since these are not part of the final rig, and are custom requirements depending on your lab, I'll assume you can handle them yourself.

Note: The antenna and wireless card are a little over-powered for this setup, but I wanted to see what the rig would do given the most power hungry components I had. Using a mini-usb wireless adapter would be much better if you don't need the long range. In my test runs of this setup I ran the system for 12 hours to see how the battery would hold up, battery showed one bar and was good for another few hours.

Your first step is to install the default Kali Linux Raspberry Pi image to your SD Card. The instructions are available on the Kali Linux Documentation site.

After you have the SD Card loaded with the image, fire up your favorite terminal and run "fdisk" on the device. Create a new partition out of the remaining space on the card. Once that is done, run "mke2fs -t ext4" on the new partition to format it. Now we could have been fancy and grown the Kali Linux partition to use the full device, but I prefer to have a separate partition. This prevents the packet capture files from filling the entire card and possibly causing problems for the Kali Linux installation. Since we are basically running a headless capturing system, we won't know how much data it will sniff off the air until we get it back to our lab.

Now we will need a script to automatically start airmon-ng and airodump-ng on boot. I've written a quick bash script for this, with an easy config file to tailor it for each engagement. Feel free to use these and tailor them to your needs, they have worked for me so far.

/root/autoscan

• #!/bin/bash
• #
• # autoscan - simple auto scanner for kali linux on raspberry pi
•  
• source /root/.autoscan.cfg
•  
• airmon-ng start ${AIRMON_DEV}
•  
• while [ ! -e "/tmp/.autoscan.stop" ]; do
  • airodump-ng -w ${STORAGE} ${AIRODUMP_OPTS} ${AIRMON_MON} > /dev/null 2>&1 &
  • PID=$!
  • sleep ${RUN_TIME}
  • kill ${PID}
  • FS="$(df `dirname ${STORAGE}` | tail -n1 | awk '{print $4}')"
  • test ${FS} -lt ${SAFETY_NET} && touch "/tmp/.autoscan.stop"
• done
•  
• airmon-ng stop ${AIRMON_MON}

The script is pretty basic. We start out importing the config file and starting the wireless card in monitor mode. Then we enter a loop to capture our packets. The script will sleep for a period of time before killing the airodump-ng process. Then before starting the next iteration, the script will verify that there is a safe amount of space on the storage partition. If the partition gets too full, it will trigger the script to end.

Next up is the configuration file.

/root/.autoscan.cfg

• #!/bin/bash
• # autoscan config file
•  
• # This is your wireless device, probably wlan0 unless you have a
• # more advanced setup
• export AIRMON_DEV="wlan0"
• export AIRMON_MON="mon0"
•  
• # Pass these extra parameters to airodump-ng
• # (see "man airodump-ng" for info)
• export AIRODUMP_OPTS="-c 6"
•  
• # Where to store the packet files, this is the full path plus
• # the prefix
• export STORAGE="/root/store/auto"
•  
• # Split packet capturing into multiple files.
• # Every scan will record for this number of seconds before
• # starting a new scan.
• export RUN_TIME="900s"
•  
• # Do not allow scanning to consume the entire disk.
• # Do not start another scan if there is less than SAFETY_NET
• # space left (in k).
• export SAFETY_NET=100000

A couple notes on the configuration. Make sure you change the "AIRODUMP_OPTS" variable to suit your needs. You may want to add some "-o" output formats if space is an issue.

All that's left is to mount the extra storage, and start the script on boot. For ease of use I'm going to just put both into "/etc/rc.local". I've mounted the storage partition that we created earlier to "/root/store", if you place it somewhere else on the system make sure you update the /root/.autoscan.cfg to point to the correct location.

/etc/rc.local

• #!/bin/sh -e
• #
• # rc.local
•  
• mount /dev/mmcblk0p3 /root/store
• /root/autoscan > /dev/null 2>&1 &
• exit 0

Now that the SD Card is prepared, it's time to fire up the Raspberry Pi. Once the system is up, log in as "root" with the default password of "toor". Don't forget to change it! Then verify that the script is running and working.

One thing I've noticed in testing, the wlan0 interface didn't always come up, and the airmon-ng command would fail. Fortunately the wireless card activity light gives me a clue to this happening, so it's not a big deal. Restarting the Raspberry Pi fixes it.