Some STA’s (stations) are connected to your AP (access point) and you need now more informations about them? No Problem! In this tiny tutorial I will show some command line possibilities. Together we will look who is connected, will try to detect the OS (incl. ports and services). Important is that for this examples your need to share internet connect to Wifi Pineapple, otherwise downloads/installations will not work.

Objectives

With different command line technics we actively gather information from connected STA’s.

Step 1: install nmap

As usual, the installation via opkg is very simple. Update list of available packages, search for package, read about dependencies and start the installation.

# update list of available packages
$ opkg update

# search for package
$ opkg list nmap

# get some informations
$ opkg info nmap

# check if dependencies are already installed
$ opkg status libpcap1

# install all needed packages
$ opkg install libpcap1 nmap

# verify installation
$ nmap --help

Step 2: get connected clients via command line

With following nmap commands you could start to detect STA’s, but to be honest this is slow and not really the optimal solution. But I will show them.

# layer 2 discovery (IP range)
$ nmap -PR -sn 172.16.42.1-255

# layer 3 discovery (IP range)
$ nmap -PE -sn 172.16.42.1-255

# layer 4 (udp) discovery (IP range)
$ nmap -PU53 -sn 172.16.42.1-255

# layer 4 (tcp) discovery (IP range)
$ nmap -PA80 -sn 172.16.42.1-255

# find all Netbios servers (on subnet)
$ nmap -sV -v -p 139,445 172.16.42.0/24

If you tried out, you feel already that this cannot the best way. With iw or iwinfo commands we found them much faster. To get fast the IP you could grep inside the file /tmp/dhcp.leases.

# show STA's via iw
$ iw dev wlan0 station dump

# show STA's via iwinfo
$ iwinfo wlan0 assoclist

# get specific IP via dhcp.leases
$ cat /tmp/dhcp.leases | grep -i '70:48:0F:C3:31:7A' | cut -d ' ' -f3

Step 3: run nmap against specific client

Now the nmap scans will be used only for specific STA’s. Here are a few scan command examples.

# classical ping
$ nmap -PE 172.16.42.x

# scanning the entire port range
$ nmap -v -p- 172.16.42.x

# detect services
$ nmap -v -sV 172.16.42.x

# detect OS
$ nmap -v -O 172.16.42.x

# detect services and OS
$ nmap -v -O -sV 172.16.42.x

# aggressive scan (includes -O, -sV, -sC and --traceroute)
$ nmap -v -A 172.16.42.x

You need to find the best parameters for yourself but the output in combinations with tools like searchsploit (GitHub) it can be very powerful.