1n3 / prism-ap

An automated Wireless RogueAP MITM attack framework.

Website

• https://sn1persecurity.com

Blog

• https://sn1persecurity.com/wordpress/blog/

Social Media

• https://twitter.com/xer0dayz
• https://twitter.com/sn1persecurity
• https://www.youtube.com/channel/sn1persecurity

Bug Bounty Profiles

• https://bugcrowd.com/1N3
• https://hackerone.com/xer0dayz

Public Exploits

• https://packetstormsecurity.com/files/author/1N3/
• https://www.exploit-db.com/?author=7787
• https://vulners.com/search?query=1N3

Open Source Security Tools

• Sn1per (https://github.com/1N3/Sn1per)
• Findsploit (https://github.com/1N3/Findsploit)
• BruteX (https://github.com/1N3/BruteX)
• BlackWidow (https://github.com/1N3/BlackWidow)
• ReverseAPK (https://github.com/1N3/ReverseAPK)
• GooHak (https://github.com/1N3/GooHak)
• PRISM-AP (https://github.com/1N3/PRISM-AP)

Certifications

• OSCE
• OSCP
• CISSP
• Security+
• CNA
• MCP
• Network+
• A+
• PCI-ASV
• SecurityTube Android Security For Penetration Testers

Public Exploits/PoC's/CVE's/Bug Bounties/CTF's

2023:

• CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (https://sn1persecurity.com/wordpress/cve-2024-21733-apache-tomcat-http-request-smuggling/) $4,660 bounty (https://hackerone.com/reports/2327341)

2021:

• Nutanix Stored DOM Cross-Site Scripting (XSS) & Reflected Cross-Site Scripting (XSS) 0day

2020:

• Discovered a critical vulnerability in Proofpoint affecting many customers and was added to the Hall of Fame (https://www.proofpoint.com/us/security)

2019 - Current:

• Founded Sn1perSecurity which provides offensive security solutions to professional penetration testers, bug bounty researchers and enterprise security teams.

2018:

• Featured in Hackin9 Magazine - Open Source Hacking Tools edition (https://hakin9.org/download/open-source-hacking-tools/) 8/2018
• Jetty 6.1.6 Cross-Site Scripting (XSS) (https://seclists.org/fulldisclosure/2018/Aug/15) (Full Disclosure) 8/2018
• Listed on the DoD Defense Travel System HoF 6/2018
• Qualified for the BugCrowd 2018 MVP researcher list (https://www.bugcrowd.com/bugcrowd-mvps-april-edition/) 4/2018
• CVE-2018-8917 Synology-SA-18:14 - Reflected XSS in DSM 6.1.5-15254 (https://www.synology.com/en-us/security/advisory/Synology_SA_18_14) 3/2018
• CVE-2018-6545 Ipswitch MoveIt v8.1 Stored Cross-Site Scripting (XSS) (https://www.exploit-db.com/exploits/43947) 2/2018
• Multiple Cross-Site Scripting (XSS) vulnerabilities in Illustra IP Cameras ($600 bounty) 2/2018
• Directory Traversal vulnerability in Illustra IP Cameras ($800 bounty) 2/2018
• Remote Command Execution vulnerability in Illustra IP Cameras ($900 bounty) 2/2018
• Listed on the BugCrowd 2017 MVP researcher list (https://www.bugcrowd.com/today-we-recognize-our-2017-mvp-researchers/) 1/2018

2017:

• Recieved Offensive Security Certified Expert (OSCE) cerfication 12/2017
• Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WEMO HomeKit Bridge ($3,000 bounty) 9/2017
• Stored Cross-Site Scripting (XSS) vulnerability in WEMO HomeKit Bridge ($500 bounty) 9/2017
• Systemic Stored XSS vulnerability in WEMO HomeKit Android Application ($1,500 bounty) 9/2017
• Systemic Local File Inclusion in WEMO HomeKit Android Application ($3,000 bounty) 9/2017
• Placed 7th in ToorConCTF CTF 8/2017
• Stored XSS in ModSecurity App for Splunk (Full Disclosure) 8/2017
• Directory Traversal in PSPDFKit/Atlassian Jira Cloud Android application Bug Bounty 7/2017
• Recieved Android Security For Penetration Testers (ASFP) certification from SecurityTube 5/2017
• Gave talk at ISSA/OWASP Phoenix to 90+ attendees titled "Man In The Browser Advanced Client Side Exploitation" (https://www.slideshare.net/1N3/man-in-the-browser-advanced-client-side-exploitation-using-beef) 4/2017
• PSV-2017-0227: Cross-Site Tracing Vulnerability in NETGEAR Arlo CVE 2/2017
• Directory traversal + multiple CSRF + multiple stored and reflected XSS in NETGEAR M4300-8X8F switches ($3,000+ bounty) 3/2017
• Recieved Department of Defense HackerOne Challenge coin for the Hack The Army Bug Bounty Program 2/2017
• Listed on the BugCrowd 2016 MVP list 1/2017

2016:

• Placed 3rd on BugCrowd's Operation Code CTF 9/2016
• 1st place @DEFCON CMD+CTRL CTF 8/2016
• HTTPoxy Exploit Scanner Exploit/PoC 7/2016
• CVE-2016-1034 Zabbix SQL Injection 0day (www.cvedetails.com/cve/CVE-2016-10134/) 7/2016
• CVE-2016-4401 Unauthenticated Database Credential Leak in Aruba ClearPass ($1,500 bounty) (https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-010.txt) 6/2016
• Tied for 2nd place in BugCrowd Operation Code CTF 6/2016
• Made the top 10 researcher list on BugCrowd 6/2016
• Placed 2nd at CactusCon 2016 RootTheBox CTF 5/2016
• Ranked 19th on BugCrowd's Worldwide Leaderboard Bug Bounty 5/2016
• Charts 4 PHP 1.2.3 Cross Site Scripting (Full Disclosure) (https://packetstormsecurity.com/files/135666/Charts-4-PHP-1.2.3-Cross-Site-Scripting.html) 2/2016
• Open Web Analytics 1.5.7 Cross Site Scripting (Full Disclosure) (https://packetstormsecurity.com/files/135948/Open-Web-Analytics-1.5.7-Cross-Site-Scripting.html) 2/2016
• WordPress All In One SEO Pack 2.2.2 Cross Site Scripting (Full Disclosure) 2/2016
• PSV-2016-0127: Directory Traversal In NETGEAR R7800 Routers 0day (https://kb.netgear.com/000053136/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2016-0127) 1/2016
• PSV-2016-0124: Cleartext Submission of Password In NETGEAR R7800 Routers 0day (https://kb.netgear.com/000055105/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Extenders-PSV-2016-0124) 1/2016
• PSV-2016-0116: Denial of Service (DoS) in NETGEAR R7800 Routers 0day 1/2016
• PSV-2016-0136: Unrestricted Arbitrary File Upload In NETGEAR R7800 Routers 0day (https://kb.netgear.com/000049063/Security-Advisory-for-Security-Misconfiguration-Vulnerability-on-R7800-Routers-PSV-2017-0136) 1/2016
• PSV-2016-0114: Directory Traversal In NETGEAR R7800 Routers 0day (https://kb.netgear.com/000053135/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2016-0114) 1/2016
• PSV-2016-0113: Denial of Service (DoS) in NETGEAR R7800 Routers 0day 1/2016
• PSV-2016-0131: Server Side Request Forgery in NETGEAR R7800 Routers 0day (https://kb.netgear.com/000053137/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2016-0131) 1/2016

2015:

• Founded CrowdShield (https://crowdshield.com) A bug bounty startup based in Toronto, Canada.
• Made the top 10 researcher list on BugCrowd 11/2015
• Wordpress XMLRPC System Multicall Brute Force Exploit (0day) Exploit/PoC 10/2015
• Aruba AP-205 Remote Command Injection Vulnerability ($750 bounty) (https://www.youtube.com/watch?v=TZqDkN1NQf4) 10/2015
• Apache Range Header Denial of Service Exploit (CVE-2011-3192) Exploit/PoC 8/2015
• Listed on AT&T's Bug Bounty Hall of Fame Bug Bounty (https://bugbounty.att.com/hof.php) 8/2015
• Won the InfoSec Institute Practical Web CTF #2 Challenge (https://resources.infosecinstitute.com/ctf-2-practical-web-hacking-winners/#gref) 8/2015
• HP Photosmart 7520 Printers Stored Cross Site Scripting (0day) Exploit/CVE 7/2015
• Supermicro IPMI/BMC Cleartext Password Scanner Exploit/PoC 3/2015
• WebFOCUS 533 Server XSS & Directory Traversal Vulnerabilities (0day) Exploit/CVE 2/2015
• Imgur Server Side Request Forgery (SSRF) ($1600 bounty) (https://hackerone.com/reports/91816) 1/2015
• CVE-2015-0235 GHOST glibc gethostbyname buffer overflow Exploit (https://www.exploit-db.com/exploits/35951) 1/2015
• Hak5 Wifi PinnappleV Remote Code Execution Exploit/CVE 1/2015
• Hak5 Wifi PinnappleV SSLSplit Cross Site Scripting Exploit/CVE 1/2015

2014:

• Lyris ListManagerWeb 8.95a Cross Site Scripting (Full Disclosure) (https://packetstormsecurity.com/files/127672/Lyris-ListManagerWeb-8.95a-Cross-Site-Scripting.html) 7/2014
• MyConnection Server (MCS) 9.7i Cross Site Scripting (Full Disclosure) (https://0day.today/exploit/description/22526) 7/2014
• AlogoSec FireFlow 6.3 Cross Site Scripting (Full Disclosure) (https://packetstormsecurity.com/files/127001/AlogoSec-FireFlow-6.3-Cross-Site-Scripting.html) 7/2014
• Recieved Offensive Security Certified Professional (OSCP) certification 2/2014

2003-2005:

• Founder of Star Virtual Machines / creator of VOS (Virtual Operating System): A Linux based distribution aimed to run multiple Operation Systems, including Windows / Linux and Mac OS on the same computer.

2001-2003:

• Creator of Project-X-IRC: An IRC warscript for mIRC
• Creator of P2P Terminal: An IRC P2P file sharing application written in TCL/TK

1999-2001:

• Founder of Xion Audio / inventor of T1 Impulse Adapter

prism-ap's Issues

A WPA 2 karma attack (saved network handshaker )

as karma attacks works on saved open networks only and not secured ones so we will need to have the password first to get it work although this seems a bit hard... the number of saved networks Guarantee that there is a one with a weak password... so will need to make the karma attack start two networks of the targeted prob one open and the second secured and the victim will auto connect to the one with the correct configuration with the saved obviously correct password and we save that handshake with the other handshakes captured form the same device to brute force and break the ones with the weak passwords.

Prism-Ap start error

Hi getting some errors like below:

rc = -1
pcap_read_ex(): The interface went down
Current MAC: 0e:e0:4f:8e:b8:7c (unknown)
Permanent MAC: 8c:c7:0d:32:22:4c (Liteon Technology Corporation)
New MAC: 4e:11:17:74:4f:6c (unknown)
tar: Removing leading `/' from member names
tar: /logs: Cannot stat: No such file or directory
tar (child): /bak/logs-1557393822.bak.tar.gz: Cannot open: No such file or directory
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
Do you want to start Evil AP?