search

secgroundzero / warberry

WarBerryPi - Tactical Exploitation
2.22k stars 288 forks source link

NAC detection #57

Closed Chappy59711 closed 8 years ago

Chappy59711 commented 8 years ago

When I insert the WarBerry into the network, the device is detected by the NAC. Once I start the WarBerry software, the NAC cannot detect the device anymore until discovery is completed. Once the WarBerry, enters poisoning mode, the NAC can detect it. How can I configure the WarBerry so the NAC cannot detect it in poisoning mode? What is different while the WarBerry is doing discovery and simply poisoning?

Thanks,

secgroundzero commented 8 years ago

it is most probably picked up because of the poisoning but it is very hard to pinpoint the exact trigger as i dont know your setup.

Q: if the device is picked up when plugged it how do you do discovery? does the warberry get an IP?

Chappy59711 commented 8 years ago

The warberry does get an IP. The NAC discovers the warberry if the warberry software is not running discovery. I am running the warberry software with the defaults.

secgroundzero commented 8 years ago

i find it strange that it gets an IP with NAC because it beats the purpose of NAC.

For the poisoning part it is going to be hard as the warberry is poisoning the network and it is more "loud"

Chappy59711 commented 8 years ago

I was doing some testing today and found the following.

The WarBerry is detectable with responder running in poisoning mode as long as the WarBerry device is not actively scanning on the network. I tested it with nmap also. I was running responder in poisoning mode without the WarBerry or nmap scanners running and the NAC found the device. Once I started either the WarBerry scanners or nmap with responder running, the WarBerry device disappeared from the NAC view until the scans were done.

secgroundzero commented 8 years ago

What is the nac solution in place?

Sent from my iPhone

On 27 Oct 2016, at 3:59 PM, Chappy59711 notifications@github.com wrote:

I was doing some testing today and found the following.

The WarBerry is detectable with responder running in poisoning mode as long as the WarBerry device is not actively scanning on the network. I tested it with nmap also. I was running responder in poisoning mode without the WarBerry or nmap scanners running and the NAC found the device. Once I started either the WarBerry scanners or nmap with responder running, the WarBerry device disappeared from the NAC view until the scans were done.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

secgroundzero commented 8 years ago

should i close this issue?

Chappy59711 commented 8 years ago

This issue can be closed.

Thanks,