about summary refs log tree commit diff stats
path: root/examples/parse_eapol
diff options
context:
space:
mode:
Diffstat (limited to 'examples/parse_eapol')
-rw-r--r--examples/parse_eapol/README.md74
-rw-r--r--examples/parse_eapol/parse_eapol.c140
2 files changed, 214 insertions, 0 deletions
diff --git a/examples/parse_eapol/README.md b/examples/parse_eapol/README.md new file mode 100644 index 0000000..4aa206a --- /dev/null +++ b/examples/parse_eapol/README.md
@@ -0,0 +1,74 @@
1# Parsing 802.11 Handshake / EAPOL Frames
2This example shows the reader how to parse 802.11 Handshakes from a pcap, outputting the EAPOL version, type, length, and data such as Nonce, IV, MIC and EAPOL Key Data.
3
4# Building and Using
5```
6>> cd examples/parse_eapol/
7>> make
8clang -Wall -Werror -O3 -o parse_eapol -c -o parse_eapol.o parse_eapol.c
9clang -Wall -Werror -O3 -o parse_eapol parse_eapol.c -lpcap -lwifi
10>> ./parse_eapol --file ~/libwifi-handshake.pcap
11[+] Setup Complete
12WPA Handshake Message: 1 (Message 1)
13EAPOL: Version: 2
14EAPOL: Type: 3
15EAPOL: Length: 95
16EAPOL: Descriptor: 2
17EAPOL: Key Info: Information: 0x008a
18EAPOL: Key Info: Key Length: 16
19EAPOL: Key Info: Replay Counter: 1
20EAPOL: Key Info: Nonce: 43 79 98 09 6a 0e dc 73 8d 44 3b 55 ce b5 47 2c fd 39 0c 87 51 e4 f0 77 d9 5b 5c e1 dc 59 bd 75
21EAPOL: Key Info: IV: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
22EAPOL: Key Info: RSC: 00 00 00 00 00 00 00 00
23EAPOL: Key Info: ID: 00 00 00 00 00 00 00 00
24EAPOL: Key Info: MIC: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
25EAPOL: Key Info: Key Data Length: 0
26
27WPA Handshake Message: 2 (Message 2)
28EAPOL: Version: 1
29EAPOL: Type: 3
30EAPOL: Length: 123
31EAPOL: Descriptor: 2
32EAPOL: Key Info: Information: 0x010a
33EAPOL: Key Info: Key Length: 0
34EAPOL: Key Info: Replay Counter: 1
35EAPOL: Key Info: Nonce: de ed a2 79 e3 c4 96 ba 25 8b ba 84 76 0a 00 69 2e 2c 10 41 24 1a f3 6f 70 9a 4b db 5f 93 47 80
36EAPOL: Key Info: IV: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
37EAPOL: Key Info: RSC: 00 00 00 00 00 00 00 00
38EAPOL: Key Info: ID: 00 00 00 00 00 00 00 00
39EAPOL: Key Info: MIC: 6c 23 fe 8d 68 35 c9 5a 77 82 25 4b 56 41 70 71
40EAPOL: Key Info: Key Data Length: 28
41EAPOL: Key Info: Key Data: 30 1a 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 80 00 00 00 00 0f ac 06
42
43WPA Handshake Message: 4 (Message 3)
44EAPOL: Version: 2
45EAPOL: Type: 3
46EAPOL: Length: 183
47EAPOL: Descriptor: 2
48EAPOL: Key Info: Information: 0x13ca
49EAPOL: Key Info: Key Length: 16
50EAPOL: Key Info: Replay Counter: 2
51EAPOL: Key Info: Nonce: 43 79 98 09 6a 0e dc 73 8d 44 3b 55 ce b5 47 2c fd 39 0c 87 51 e4 f0 77 d9 5b 5c e1 dc 59 bd 75
52EAPOL: Key Info: IV: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
53EAPOL: Key Info: RSC: 00 00 00 00 00 00 00 00
54EAPOL: Key Info: ID: 00 00 00 00 00 00 00 00
55EAPOL: Key Info: MIC: b7 e7 f1 60 f8 cf 3f ec 8f b3 c5 29 e4 a1 d0 05
56EAPOL: Key Info: Key Data Length: 88
57EAPOL: Key Info: Key Data: 5e b1 a7 ef db 8d 55 06 d5 c8 89 e7 ca 55 ea cf f5 fa 08 18 ef 4e 46 6e b6 3e 62 d1 30 e7 e5 38 ef 2b 37 61 55 03 9e 84 31 75 3e 44 bd 87 12 9c 94 52 db fb 6a 58 4e 1f 94 e0 16 a9 e9 cb 36 48 c8 ed 20 d3 ff 37 a6 7e 12 3f 0b fc 2c a6 cb 72 c3 6a bf 01 32 b1 6e 1b
58
59WPA Handshake Message: 8 (Message 4)
60EAPOL: Version: 1
61EAPOL: Type: 3
62EAPOL: Length: 95
63EAPOL: Descriptor: 2
64EAPOL: Key Info: Information: 0x030a
65EAPOL: Key Info: Key Length: 0
66EAPOL: Key Info: Replay Counter: 2
67EAPOL: Key Info: Nonce: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
68EAPOL: Key Info: IV: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
69EAPOL: Key Info: RSC: 00 00 00 00 00 00 00 00
70EAPOL: Key Info: ID: 00 00 00 00 00 00 00 00
71EAPOL: Key Info: MIC: 13 6e 07 be 17 51 01 e2 03 5d 4c b1 43 e1 4b c7
72EAPOL: Key Info: Key Data Length: 0
73>>
74```
diff --git a/examples/parse_eapol/parse_eapol.c b/examples/parse_eapol/parse_eapol.c new file mode 100644 index 0000000..259ee5f --- /dev/null +++ b/examples/parse_eapol/parse_eapol.c
@@ -0,0 +1,140 @@
1#include <libwifi.h>
2
3#include <pcap.h>
4
5#include <stdio.h>
6#include <stdlib.h>
7#include <string.h>
8
9static int has_radiotap = 0;
10
11void handle_pkt(unsigned char *args, const struct pcap_pkthdr *header, const unsigned char *packet) {
12 unsigned long data_len = header->caplen;
13 unsigned char *data = (unsigned char *) packet;
14
15 // Initialise a libwifi_frame struct and populate it
16 struct libwifi_frame frame = {0};
17 int ret = libwifi_get_wifi_frame(&frame, data, data_len, has_radiotap);
18 if (ret != 0) {
19 return;
20 }
21
22 // Ensure the parsed frame is a data frame
23 if (frame.frame_control.type == TYPE_DATA) {
24 // Ensure the parsed data frame is a WPA handshake
25 if (libwifi_check_wpa_handshake(&frame) > 0) {
26 // Use libwifi to get the EAPOL message part, and also pretty-print it
27 int part = libwifi_check_wpa_message(&frame);
28 printf("WPA Handshake Message: %d (%s)\n", part, libwifi_get_wpa_message_string(&frame));
29
30 // Initlaise a WPA Authentication Data struct and populate it
31 struct libwifi_wpa_auth_data data = {0};
32 libwifi_get_wpa_data(&frame, &data);
33
34 // Print all of the available WPA Auth data
35 printf("EAPOL: Version: %d\n", data.version);
36 printf("EAPOL: Type: %d\n", data.type);
37 printf("EAPOL: Length: %d\n", data.length);
38 printf("EAPOL: Descriptor: %d\n", data.descriptor);
39 printf("EAPOL: Key Info: Information: 0x%04x\n", data.key_info.information);
40 printf("EAPOL: Key Info: Key Length: %d\n", data.key_info.key_length);
41 printf("EAPOL: Key Info: Replay Counter: %lu\n", data.key_info.replay_counter);
42 printf("EAPOL: Key Info: Nonce: ");
43 for (size_t i = 0; i < sizeof(data.key_info.nonce); ++i) {
44 printf("%02x ", data.key_info.nonce[i]);
45 }
46 printf("\n");
47
48 printf("EAPOL: Key Info: IV: ");
49 for (size_t i = 0; i < sizeof(data.key_info.iv); ++i) {
50 printf("%02x ", data.key_info.iv[i]);
51 }
52 printf("\n");
53
54 printf("EAPOL: Key Info: RSC: ");
55 for (size_t i = 0; i < sizeof(data.key_info.rsc); ++i) {
56 printf("%02x ", data.key_info.rsc[i]);
57 }
58 printf("\n");
59
60 printf("EAPOL: Key Info: ID: ");
61 for (size_t i = 0; i < sizeof(data.key_info.id); ++i) {
62 printf("%02x ", data.key_info.id[i]);
63 }
64 printf("\n");
65
66 printf("EAPOL: Key Info: MIC: ");
67 for (size_t i = 0; i < sizeof(data.key_info.mic); ++i) {
68 printf("%02x ", data.key_info.mic[i]);
69 }
70 printf("\n");
71
72 printf("EAPOL: Key Info: Key Data Length: %d\n", data.key_info.key_data_length);
73 if (data.key_info.key_data_length) {
74 printf("EAPOL: Key Info: Key Data: ");
75 for (size_t i = 0; i < data.key_info.key_data_length; ++i) {
76 printf("%02x ", data.key_info.key_data[i]);
77 }
78 printf("\n");
79 }
80
81 // Cleanup the WPA Data
82 libwifi_free_wpa_data(&data);
83
84 printf("\n");
85 }
86 }
87
88 // Clean up the libwifi frame
89 libwifi_free_wifi_frame(&frame);
90}
91
92void helpexit() {
93 fprintf(stderr, "[!] Usage: ./parse_eapol --file <file.pcap>\n");
94 exit(EXIT_FAILURE);
95}
96
97int main(int argc, char **argv) {
98 struct bpf_program *filter = NULL;
99 pcap_t *handle = NULL;
100 pcap_dumper_t *dumper = NULL;
101 char errbuf[PCAP_ERRBUF_SIZE];
102
103 if (argc < 2) {
104 helpexit();
105 }
106 if (strcmp(argv[1], "--file") == 0) {
107 if ((handle = pcap_open_offline(argv[2], errbuf)) == NULL) {
108 fprintf(stderr, "[!] Error opening file %s (%s)\n", argv[2], errbuf);
109 exit(EXIT_FAILURE);
110 }
111 } else {
112 helpexit();
113 }
114
115 int linktype = pcap_datalink(handle);
116 if (linktype == DLT_IEEE802_11_RADIO) {
117 has_radiotap = 1;
118 }
119 if (linktype != DLT_IEEE802_11 && linktype != DLT_IEEE802_11_RADIO) {
120 fprintf(stderr, "[!] 802.11 and radiotap headers not provided (%d)\n", pcap_datalink(handle));
121 pcap_close(handle);
122 exit(EXIT_FAILURE);
123 }
124
125 if ((filter = malloc(sizeof(struct bpf_program))) == NULL) {
126 fprintf(stderr, "[!] There was an error allocating memory for the filter.\n");
127 pcap_close(handle);
128 exit(EXIT_FAILURE);
129 }
130
131 printf("[+] Setup Complete\n");
132
133 dumper = pcap_dump_open(handle, "/tmp/parse_eapol.pcap");
134 pcap_loop(handle, -1 /*INFINITY*/, &handle_pkt, (unsigned char *) dumper);
135
136 pcap_dump_close(dumper);
137 pcap_close(handle);
138
139 return 0;
140}
generated by cgit-pink 1.4.1 (git 2.36.1) at 2025-07-04 09:54:47 +0000