802.11 Race Condition Exploiter
About:
This is the RCX project ("rcx") This project was registered on SourceForge.net on Aug 15, 2009 by Melchi salins.
RCX is a Proof of Concept tool that exploits race condition on a wifi network by responding to a HTTP GET request with a HTTP 301 redirect response and send the victim to any URL specified by the attacker.Supports WEP and Open networks (WPA not supported at the moment).
This project is still in its initial stage and contains few bugs.The functionality of the project will increase and become more diverse in nature in future releases.
Download
RCX in Action:
Victim
RCX victim screen from melchi on Vimeo.
Attacking Machine
Requirements:
You will need the following to use RCX
Useage:
Attack:
user@comp:~$ sudo airmon-ng start "interface" "channel no"
user@comp:~$ sudo rcx.py "interface"
Note: I've observed that being associated to the Access Point before putting the card into monitor mode helps improve the success rate of the race condition exploitation.
Attack Analysis:
user@comp:~$ cd analyzeruser@comp:~$ sudo rcx_plotter.py
This script should be run on another computer whose wifi card has monitor mode capablility. The script draw a plot showing the success/failure rate of an attack.
Limitation:
I have tested this program on a Intel Centrino Duo 1.8 Ghz 2GB RAM running Ubuntu 9.10 and following cards:
--> Intel IPW3945
--> Hawking HWUG1 USB (RT73)
--> ALFA Hi-Power USB AWUS036H
If you have a different card please test this program and let me know the results.
Although the application works pretty well, I have observed it does not have a 100% success rate.
Redirection of a link could fail because of many reasons, Out of which the most predominant reason being browser cache data retrieval
Redirection may also fail if the network is too busy and irrelevant data is sniffed, this leads to overload which slow down the execution and making the program lose the race condition to the authentic response.
The most important reason why the application may fail is due to its horrible design. :p , I feel the code can be optimized a bit more or be rewritten in C instead of Python which would surely increase the performance.