Re: Wireless SSID discovery

From: Michael Puchol (mpuchol_at_sonar-security.com)
Date: 12/22/04

  • Next message: robert_at_dyadsecurity.com: "Re: Port Scanning." 
    Date: Wed, 22 Dec 2004 09:31:06 +0100
To: pen-test@securityfocus.com

    Hi Andrew,

    I know you have got some answers that point you in the right direction,
    but for the record, some APs use the 'hide SSID' function to remove the
    SSID from the beacon frames, but they still include it in the probe
    replies (i.e. Netstumbler will still catch it). A passive scanner such
    as Kismet would have to wait until a client probed or associated or
    reassociated to the AP. Other APs will also remove the SSID from the
    probe responses, or not respond to probes at all (the early Intel APs
    did this by default, their out-of-the-box SSID was 101).

    Hiding the SSID is false security, any person one step higher than a
    kiddie will be able to get it from sniffing one way or another. It can
    also affect the network's performance.

    Best regards,

    Mike
    mother@netstumbler.com

    Andrew Bagrin wrote:
    > I'm doing a wireless pen-test and am able to use aircrack to crack
    > the wep key, however, when I use Kismet, Cain, airdump etc.. I can't
    > get the SSID of a the access point if the SSID broadcast has been
    > disabled. Does anyone know how to do this, or is there any tools that
    > will let you get the SSID even if its not being broadcasted.
    >
    > Thanks,
    >
    > Andrew
    >
    >

  • Next message: robert_at_dyadsecurity.com: "Re: Port Scanning."

    Relevant Pages

    • Re: SSID for multiple access points
      ... The AP SSIDs, I believe, should all be the same but the individual APs should be set to different ... Al Jarvi (MS-MVP Windows Networking) ... and gave each of the APs distinct SSID names. ... > Outgoing mail is certified Virus Free. ...
      (microsoft.public.pocketpc.wireless)
    • Re: SSID for multiple access points
      ... SSID, and as they are all in a row, we put the center on on channel 11 and ... and gave each of the APs distinct SSID names. ... > Outgoing mail is certified Virus Free. ...
      (microsoft.public.pocketpc.wireless)
    • Re: Wireless laptop roaming through various access points
      ... and if you had included a snippet of the message you were replying ... Are you switching between APs with the same SSID? ... different channels or the same channel, ...
      (alt.internet.wireless)
    • Re: SSID for multiple access points
      ... Actually, for proper roaming, the APs MUST have the same SSID. ... >>> Outgoing mail is certified Virus Free. ... > probably the most challenging as you can only use 3 channels to be ...
      (microsoft.public.pocketpc.wireless)
    • Fedora Core 5 on vmware?
      ... Has anybody had any luck getting Fedora 5 running under Vmware? ... Re: WPA needs SSID broadcast? ... NetworkManager supports it out-of-the-box in FC5. ...
      (Fedora)