DEF CON 31 and Building A Wi-Fi Deauthentication Detector

Ryan Zagrodnik

Blog, Password Cracking, Penetration Testing, shellntel

September 5, 2023

Going to DEF CON was a dream I never thought would come to fruition. I remember 2009 being in 8th grade. Reading a physical copy of the magazine Wired. Sitting in the back of parent's minivan on the way to visit family in Milwaukee, WI, and seeing pictures and reading about the largest hacking conference in the world. There were hackers getting arrested, voting machine hacking, lock picking, and hacker jeopardy. That dream came true in 2016 at DEF CON 24.

At DEF CON 31 I returned to speak at the Hardware Hacking Village. My first time speaking at DEF CON was full of anxiety, as the Sunday before flying out I was testing the hardware and I found out I ordered the ESP-01 and not the ESP-01S. I was up until 1 AM trying to get it to work anyway, but ended up putting in a last minute Amazon order (at twice the price of AliExpress) to get the ESP-01S's I needed. Thankfully the Amazon delivery arrived that Tuesday and we flew out Wednesday evening.

My talk (Introduction To Esp8266/Esp32 Microcontrollers And Building A Wi-Fi Deauthentication Detector):

TL;DR of my talk:

Buy CH340 USB to ESP8266 Serial ESP-01 ESP-01S Wireless Wi-Fi Development Board Module for Arduino Programmer Adapter. https://www.aliexpress.us/item/2251832785022470.html or (https://www.amazon.com/ESP-01S-Programmer-Adapter-Wireless-4-5-5-5V/dp/B07V556Q82 and https://www.amazon.com/ESP8266-ESP-01S-Wireless-Transceiver-DC3-0-3-6V/dp/B08B3VZS4N)
Download, install, and run ArduinoIDE https://www.arduino.cc/en/software
Install Additional Board Managers
Copy and paste this into File->Preferences->Settings->Additional board manager URL's
- https://arduino.esp8266.com/stable/package_esp8266com_index.json
Get the code https://github.com/SpacehuhnTech/DeauthDetector
Copy and paste the code into ArduinoIDE
Comment out lines 14 and 15 LED_BUILTIN and LED_INVERT lines and change line 22 to match your region.
Set dip switch to the right and flash
Set dip switch the left and test by deauthing a device on the 2.4GHz band

Slides are available here: https://twitter.com/TheL0singEdge/status/1690142545605791752

Lesson's Learned:

Test your hardware earlier than the Sunday before DEF CON.
Get more free hardware. The 30 devices I brought were gone instantly.
Bring a cooling towel, it's hot in Vegas.
Follow the 321 rule: Three hours of sleep, two meals, one shower.

DEF CON 31 Tool Highlights:

gssapi-abuse - Impersonating AD users on *nix based hosts
CloudRecon - A suite of tools for red teamers and bug hunters to find ephemeral and development assets in their campaigns and hunts.
DllNotificationInjection - New "threadless" process injection technique.
ContainYourself - Use the Windows containers framework to bypass EDRs.
NoFilter - Privilege escalation by abusing Windows Filtering Platform