Book Image

Penetration Testing with Raspberry Pi - Second Edition

By : Michael McPhee, Jason Beltrame
Book Image

Penetration Testing with Raspberry Pi - Second Edition

By: Michael McPhee, Jason Beltrame

Overview of this book

This book will show you how to utilize the latest credit card sized Raspberry Pi 3 and create a portable, low-cost hacking tool using Kali Linux 2. You’ll begin by installing and tuning Kali Linux 2 on Raspberry Pi 3 and then get started with penetration testing. You will be exposed to various network security scenarios such as wireless security, scanning network packets in order to detect any issues in the network, and capturing sensitive data. You will also learn how to plan and perform various attacks such as man-in-the-middle, password cracking, bypassing SSL encryption, compromising systems using various toolkits, and many more. Finally, you’ll see how to bypass security defenses and avoid detection, turn your Pi 3 into a honeypot, and develop a command and control system to manage a remotely-placed Raspberry Pi 3. By the end of this book you will be able to turn Raspberry Pi 3 into a hacking arsenal to leverage the most popular open source toolkit, Kali Linux 2.0.
Table of Contents (13 chapters)
Penetration Testing with Raspberry Pi - Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface

Avoiding common problems


Here is a list of some of the common problems that we either ran into or have heard others having:

  • Power issues: We (again, as in the first edition) attempted to use small USB keychain power adapters that had 5V micro-USB power to make our system very portable. Sometimes, these worked, and sometimes, they just showed that Raspberry Pi was powered, but the system didn't boot. It can be difficult to determine without first testing this because sometimes certain power adapters won't work with a particular configuration. Most Raspberry Pi boards have lights on the side, showing red for power and yellow for when it is operating properly. We can check the manufacturer's website of each model for more details. USB power can be a very important feature if using these for stealth, so we'll need to make sure that they are tested before implementation in a penetration test.

  • MicroSD card reading issues: We've heard that some people's microSD card readers didn't identify the SD card once it was inserted into their systems. Some Mac users claimed that they had to blow into the SD reader hole, whereas others found that they had to use an external reader to get the microSD card to be recognized by the system. We recommend trying another system. If we are purchasing a microSD converter, we should ensure that the seller has listed it as being Raspberry Pi microSD compatible. An external microSD reader shouldn't cost more than $10. If we find that your Raspberry Pi isn't working once we install an image to the microSD card, we can check that the microSD card is inserted properly. We need to make sure that the card is fully inserted since there is no spring-loaded mechanism on Pi 3. If it doesn't seem like it's sliding in properly, the microSD card is probably upside down or it is the wrong type of card. If we insert the microSD card properly and nothing happens once the system is powered up, we can verify that we are using the correct power. Another problem could be that the image wasn't installed properly. We found that some people had their computers go to sleep mode during the dd process, causing only part of the Kali Linux image to copy over. Before installing, we should always verify that the image is copied over properly. We should also check whether the image that we downloaded is authentic. Offensive Security includes SHA1SUM, which we can use to verify whether our image has been tampered with. Another issue we encountered was in the way we uncompressed the tar file. We need to ensure that we use a valid method or the image file could become corrupted. If we notice that the image is booting, we can watch the boot sequence for error messages before the command prompt becomes available.

  • Permission denied: Many Mac users found that they didn't have the proper permissions to run the dd command. This permission issue could be caused by a few different things. First, let's make sure that our microSD card or SD adapter doesn't have a protection mode that is physically set. Next, we should verify that the reader and the adapter are working properly. There have been reports that MAC users have had to blow into the SD reader to clear the dust and get it to function properly. We should also use the sudo command for the entire statement as stated in the previous warnings. If the error continues, we can try an external microSD reader as our current one may permit formatting but have problems with the dd command.

  • Kali Linux programs not found in GUI: We found that some versions of the Kali Linux ARM image for Raspberry Pi would boot up properly, launch GUI once booted, but would not display the Kali Linux tools in the applications drop-down menu once GUI was done loading. This is a similar problem to the display issue explained earlier, which means that it can be fixed by performing the apt-get update and apt-get upgrade steps explained in this book that tell us what to do once we log into GUI for the first time. The update and upgrade process should install and upgrade any missing file or older drivers that are causing this problem. We once found that after going through the update and upgrade process and rebooting the system, the Kali Linux software appeared under the applications menu.

  • Unable to extract the .xz file: To extract this type of file, we need to have an extract or unzip program that understands .xy files. OS X is supposed to be able to do this natively, but we were unsuccessful, and had to download a program to do that.

  • Unable to boot to Kali: When we use dd or Win32DiskImager, we should select the image that we extracted from the file we downloaded and NOT the .xy file.

  • Using dd to copy the image over takes a long time: We should specify a block size using the bs=XX command, where XX is the size, to avoid these longer waits. Finding the right block size can be tricky, but we used bs=1m initially, and had no issue. The time difference of using that specified block size was 10 minutes, compared to 193 minutes without not specifying the block size.