Introduction

Back in the old days, before everyone had broadband internet access, modems were the standard way of accessing other computers and consequently other networks. In order to connect to another computer, you first had to know what phone number to call. People would often run programs that would call huge amounts of phone numbers in an attempt to find computers that they could connect to. Often times people would find dial-in phone numbers to corporate, school, or other networks that they probably shouldn't have access to.

With the advent of the Internet, a similar activity has been born. Scanning. On the Internet, an IP address is analogous to a phone number. People often scan through large amounts of IP addresses looking for computers that are running certain types of servers.

The new wireless age has introduced a new brute force attack. Originally, WarDriving was when crackers drove around in a car equipped with wireless gear looking for unsecured wireless networks, to gain illicit access. Over time, the term has evolved to include harmless types like us simply checking on the RF environment. A year ago, TheRegister had an article about War driving. There are some tools to facilitate finding AccessPoints.

Tools

For a complete list of Wardriving Tools/Software visit: http://wardrivingonline.com/downloads/wardriving.htm

• A searchable web-based map displaying wardriving data contributed by users

  • http://www.wifimaps.com

• WiGLE.net consolidates location and information of wireless networks world-wide to a central database, and has user-friendly java, windows, and web applications that can map, query and update the database via the web. WiGLE.net currently accepts files in any of NetStumbler's exported file formats, DStumbler's text output, Kismet's CWGD, XML, CSV, or GPS formats, Pocket Warrior's text output, as well as via our online form. Screenshots of their client software can be found here, and a current map of findings across the United States is shown here.

  • WiGLE.net currently has 6,082,331 networks with locations in their database. (05-06-2006) --JasonMcArthur
    

  • http://www.wigle.net

• An IPAQ running familiar and GPE can run an application called arial

  • http://familiar.handhelds.org/

• Musatcha Advanced WiFi Mapping Engine - This is essentially a client program for WiGLE.net, the largest WiFi network database in the world. Note: This software is still in it's alpha stages! It's not even beta yet.

  • http://www5.musatcha.com/musatcha/computers/software/wifimapping/index.htm

• A Windows application by MariusMilner called NetStumbler.

  • http://www.netstumbler.com/

• A Mac OS X application by korben@cox.net called MacStumbler.

  • http://www.macstumbler.com/

• A Mac OS X application by captainsonic@gmail.com called ApScanner.

  • http://sourceforge.net/projects/apscanner

• A site dedicated to the advancement of WiFi and its research. Great articles with actual war driving data. Site still young & expanding looking for your input and visit!

  • http://zharov.net

• JimBinkley's Wscan which works under FreeBsd and Linux (currently true AccessPoint scanning is only available under the FreeBsd version, though the patches needed are supposed to be in the latest version of the 2.4 orinoco_cs driver). It's available in ports under FreeBSD-4.5

  • ftp://ftp.cs.pdx.edu/pub/mobile/

 # cd /usr/ports/x11/wscan 
 # make install clean 

• IBM's WirelessSecurityAuditor, a NetStumbler clone written for Linux on the iPAQ.

  • http://www.research.ibm.com/gsal/wsa/

• Paul Fox has written a simple, dynamic stumbler program, in shell, based on the iw-tools. It should work on any system where "iwlist ethX scan" works. It finds nets, lets you associate, can configure WEP etc for known networks, starts DHCP, shows connection status.

  • http://www.foxharp.boston.ma.us/shtumble/

• Bret Mounet's Netstumbler'ish program for Windows 2000 and it only works with Prism2Cards.

  • http://www.bretmounet.com/ApSniff

• A perl script by Peter Shipley to pull stats from FreeBsd's wicontrol and lat/long from a GPS unit. The scripts and maps are available. Two perl scripts by frisco@blackant.net which he used to map around Ann Arbor MI (supposedly there are some bugs in this so beware).

  • http://lists.bawug.org/pipermail/wireless/2001-April/000679.html

  • http://blackant.net/other/wireless.php

• Kismet (great curses based Linux auditor and stumbler)

  • http://www.kismetwireless.net/

• Wellenreiter is a GTK/Perl wireless network discovery and auditing tool. Prism2, Lucent, and Cisco based cards are supported. Its scanner window can be used to discover access-points, networks, and ad-hoc cards. It detects essid broadcasting or non-broadcasting networks and detects WEP capabilities and the manufacture automatically. Dhcp and arp traffic will be decoded and displayed to give you further informations about the networks. A flexible sound event configuration lets it work in unattended. An ethereal / tcpdump-compatible dumpfile can be created. GPS is used to track the location of the discovered networks immediately. Automatic associating is possible with randomly generated MAC addresses. Wellenreiter runs also on low-resolution devices that can run GTK/Perl and Linux/BSD (such as iPaqs). An uniq Essod-bruteforcer is now included too.

  • http://www.wellenreiter.net/

• PrismStumbler (command like and Perl-GTK)

  • http://prismstumbler.sourceforge.net/

  • http://home.attbi.com/~sboger1/prismstumbler.html

• AirTraf - AirTraf is a 100% passive wireless 802.11b network analyzer. It is capable of performing promiscuous channel scanning to detect access points in the area, as well as pick off 'other' connected wireless nodes, acquiring signal strength information for each node. It performs packet count/byte analysis on different layers (datalink, network, transport), as well as breaking down the 802.11b protocol. It is also capable of parsing higher level protocols such as IP, TCP, UDP, ICMP, and get packet statistics as well as bandwidth information. Furthermore, it supports Cisco Aironet cards & PrismII-chipset cards.

  • http://airtraf.sourceforge.net/

There are also some tools available to help you subvert the security of an AccessPoint (or more accurately audit the security of your own AccessPoint ... right?). These should be refactored into another page.

• THC-RUT (aRe yoU There) is a tool for attacking Lucent AccessPoint's

  • http://www.thehackerschoice.com/

• AirSnort

  • http://airsnort.sourceforge.net/

• WepCrack

  • http://wepcrack.sourceforge.net/

• macgen

  • http://www.hypervivid.com/tools/macgen.html

Power Inverters can be used to run laptops and computers in cars or trucks. The range in power from those able to power laptops to those able to power several computers in a van. A wide selection of power Inverters can be found at: http://www.4lots.com