A lot of the comments here are saying that a pineapple can configure their subnet to use 10.x.x.x or 192.168.x.x. Is there any other way to determine if an access point is compromised?
Do some online banking. If your balance goes down more than expected, it’s probably compromised.
ooooof
Unless the pineapple operator also has solved DHKE and symmetric keys in general, using https means you’re safe to do whatever on public wifi.
Unless your device has exposed vulnerabilities over the local network
Setup a firewall with the minimum exposed ports, even on Linux. UFW is reasonable
Thanks Lain.
The only part of this I didn’t immediately realize is the wifi pineapples default IP range.
From now on, I’m going to set that as my clients default public IP range to troll anyone who knows.
Does this matter if the traffic is encrypted, such as an https website instead of http? Like, really how often is internet traffic unencrypted?
Yes, back when I was playing around with my WiFi pineapple there were a wide variety of tricks to break SSL authentication without it being obvious to users. Easiest was to terminate the SSL connection on the pineapple and re-encrypt it with a new SSL cert from there to the users browser, so to the user it looked like everything was secure but in reality their traffic was only encrypted from them to the pineapple, then decrypted, sniffed and re-encrypted to pass along to the target websites with normal SSL.
Man in the middle attacks really do give the attacker tons of options
That kind of ssl interception would normally be quite visible without your client device having the pineapples cert in your devices trust store, or am I wrong?
I’m sure a lot has changed in 10 years ago so this won’t be relevant today, but back when I was last playing with this, sslstrip was the tool I was using on the pineapple to enable SSL mitm attacks - https://github.com/moxie0/sslstrip
I’d imagine there are new techniques to counteract new defenses - this stuff is always cat & mouse
Not often. For web browsing - and the majority of apps - your session is encrypted and certified. Breaking SSL is possible but you’ll know about it due to the lack of certs.
Thank you Lain.
Thank you, Lain
deleted by creator
neither is that range pineapple exclusive nor should ppl use public wifi without a proper vpn.
so the meme makes no sense. if you recognize the pineapple default range but yet dont use a vpn…then you re a dumbass.
172.16.0.0/12 is a valid prefix for private networks. In fact, you get more hosts than 192.168.0.0/16, but less than 10.0.0.0/8.
Yeah, it’s not that it’s not valid for private networks, it’s that 172.16.42.x is common for WiFi Pineapples
Every “well ackqually” person in this thread is insufferable
IDK, I find them quite sufferable and in fact I’m learning something from this thread.
Can’t argue with that, I guess
Thank you lain.
Thank you Lain!
Thank you Lain.
Thank you Lain.
My ass, Lain.
*connects to pineapple
*sets subnet to 10.0.0.0/16 so I don’t have to type a yee yee ass class B/C address everytime I wanna do something with an address
Or
*connects to pineapple
*Sets subnet to same as target network so paranoid user doesn’t realize he connected to evil twin
sets subnet to 10.0.0.0/16 so I don’t have to type a yee yee ass class B/C address everytime I wanna do something with an address
Personally I find 172.16.0.0/12 addresses are easier for me to quickly type accurately than any other private range. 192.168.0.0/16 is just too many similar-but-different digits, and 10.0.0.0/8 is too many similar/the same digits before I get to the digits I actually care about, so both are more error prone for me
Always do transparent tunneling with selective MITM, lol
(not gonna help script kiddies any more than this either, lol)
