Pandora Pentesting Guide (Mostly Pandian)


Alperoot

Welcome! Welcome to Airstrip 17.
Joined
Apr 11, 2015
Messages
642
Hello everyone! You probably know me from my question threads. (Btw this is my first tutorial thread) Today (differently), I will make a guide. I am not an advanced Linux user, so don't expect something perfect!

1. Requirements - Preparing your Pandora

Requirements :

1- If you are unlucky like me, a PC ;)

2- Pandian Image (download from the Pandian thread)

3- iw - just type terminal

sudo opkg update

sudo opkg install iw

4- Download Scapy.all. (download link : https://bitbucket.org/secdev/scapy/downloads/scapy-2.3.1.zip ) After downloading, open a terminal on the file directory. Type

Code:
sudo python setup.py install
2. Install Pandian on your Pandora (if dd doesn't work, you can burn the image file with an sd card image burner software)

3. Installing Websploit




Websploit is a powerful tool from the makers of Metasploit. It can do basic MITM attacks as well as DoS, Bluetooth PoD and Wi-Fi Jamming attacks. You can also find tutorials on the Youtube. As a user, I recommend installing it to Pandian, I couldn't get most of the features working in SuperZaxxon, but you can install it to SuperZaxxon, too.

Download it from here : ( http://sourceforge.net/projects/websploit/ )

If you didn't installed scapy already, install it. After, unzip it. Then, type this to a terminal :


Code:
sudo -i

cd /media/yoursdcard/websploitdirectory/

sh install.sh
This process installs Websploit. After installing, you will notice that it fails somewhere. For example, when trying to use Wi-Fi jammer, it will say : "bash : command aircrack-ng not found". This means you will need to install some dependencies. I don't have a list of needed dependencies, but you can understand it easily. If it isn't able to find aircrack-ng, the you should install aircrack-ng. In Pandian, this process is easy. You will just need to type : "sudo apt-get update && sudo apt-get install aircrack-ng". This is the same on SuperZaxxon (sudo opkg install aircrack-ng) but not everything is the same. For example, you need driftnet for sniffing photos with MITM but driftnet isn't available on the Pandora repo. However, it is available on the Debian repo. Like I said before, type "apt-get install driftnet" to install driftnet.



4. Installing Metasploit



To install metasploit, you need to install its "gems" and to install some gems, you need some packages which isn't available in the Pandora repo. So this tutorial will be mostly about Pandian. Type this to install these packages :


Code:
sudo apt-get install build-essential libreadline-dev libssl-dev libpq5 libpq-dev libreadline5 libsqlite3-dev libpcap-dev openjdk-7-jre git-core autoconf postgresql pgadmin3 curl zlib1g-dev libxml2-dev libxslt1-dev vncviewer libyaml-dev curl zlib1g-dev nmap
Also, to install ruby, type this : "sudo apt-get install ruby ruby-full"

Type


Code:
cd /opt

sudo git clone [URL="https://github.com/rapid7/metasploit-framework.git"]https://github.com/rapid7/metasploit-framework.git[/URL]

sudo chown -R `whoami` /opt/metasploit-framework

cd metasploit-framework
Or you can download Metasploit from here : "https://github.com/rapid7/metasploit-framework".

After opening the terminal, type "bundle install" to install the gems(If you downloaded it manually, change the directory to there). If it doesn't work, try "gem install bundler" first.




5. Using Built-In Nmap, Installing Nmap


I don't know why, but SuperZaxxon OS comes installed with nmap. If you are using Pandian, type these into the terminal :


Code:
mkdir ~/Development

cd ~/Development

svn co https://svn.nmap.org/nmap

cd nmap

./configure

make

sudo make install

make clean
I didn't tried it yet, but you can just try "sudo apt-get install nmap" without typing all these.



6. Configuring Metasploit



If you don't want to change the directory every time you log in, type this :


Code:
cd metasploit-framework

sudo bash -c 'for MSF in $(ls msf*); do ln -s /opt/metasploit-framework/$MSF /usr/local/bin/$MSF;done'
Then type msfconsole. It probably won't open. If it does, you are very lucky If it doesn't and it says something like "cannot find the gem", try installing the gem manually by typing : "gem install missinggemname".

You probably should do it for 4-5 times or more. Afterall, it should open with no problem

7. Reaver with PixieWPS

@illuminatus85 said he is able to compile PixieWPS for the Pandora :


I compiled it (with pixiewps) for the Pandora and it runs fine:

RhmtMM4.jpg
You can use his libraries(link:http://www.filedropper.com/reaverarm) to install it.

8. Some Tools

This is not really a guide. I will just post some good tools here.

sudo apt-get install w3af-gui

sudo apt-get install reaver

sudo apt-get install macchanger

After figuring out how-to, I will post here more tutorials about Penetration Testing.

If something doesn't work, you can comment here your problems. Also, I will be very glad if you can post here your own tutorials :p
 
Last edited:
Oh, I made a logic mistake here :)  If you just want to use some features of websploit, you can install it to Angstrom without switching it to debian. To say it in a different way :
iw is for aircrack-ng and scapy is for Websploit.
 
Oh, I made a logic mistake here :)  If you just want to use some features of websploit, you can install it to Angstrom without switching it to debian. To say it in a different way :
iw is for aircrack-ng and scapy is for Websploit.

FWIW, aircrack-ng is available as a PND.  I don't think Websploit is though, so you may still need to install scapy
 
Oh, I made a logic mistake here :)  If you just want to use some features of websploit, you can install it to Angstrom without switching it to debian. To say it in a different way :
iw is for aircrack-ng and scapy is for Websploit.

FWIW, aircrack-ng is available as a PND.  I don't think Websploit is though, so you may still need to install scapy
The problem is, I downloaded it from the PNDStore and it still cries for iw when I try to go on monitor mode.
 
Oh, I made a logic mistake here :)  If you just want to use some features of websploit, you can install it to Angstrom without switching it to debian. To say it in a different way :iw is for aircrack-ng and scapy is for Websploit.

FWIW, aircrack-ng is available as a PND.  I don't think Websploit is though, so you may still need to install scapy
The problem is, I downloaded it from the PNDStore and it still cries for iw when I try to go on monitor mode.
PNDStore? that has been removed from the OS image for at least 2 years... How old is your firmware?, there has been some wifi updates in the last several patches...
 
Last edited by a moderator:
Oh, I made a logic mistake here :)  If you just want to use some features of websploit, you can install it to Angstrom without switching it to debian. To say it in a different way :
iw is for aircrack-ng and scapy is for Websploit.

FWIW, aircrack-ng is available as a PND.  I don't think Websploit is though, so you may still need to install scapy
The problem is, I downloaded it from the PNDStore and it still cries for iw when I try to go on monitor mode.
PNDStore? that has been removed from the OS image for at least 2 years... How old is your firmware?, there has been some wifi updates in the last several patches...
I've not read this fully yet, but why do you need to install iw and scapy to Angstrom before switching to Debian?
I mean, I downloaded it from the repo. It wasn't PNDStore, something different.
 
I think I'm running it on superzaxxon in the picture there. You can see the multicoloured console messages you get when you run the aircrack pnd. You have to run the aircrack-ng pnd for it to work on superzaxxon iirc.
 
I should note I think I cross complied it to ARM on a virtual machine. Didn't mention that. Then moved it over to Superzaxxon.
 
Back
Top