As a device, so like that, it does not take too much space because we don't create one
Docker 5, one special Docker 5 for each topic.
And so that picture looks as follows.
And I will show you that in the demo because like that in this slide, it's not super interesting.
But still, if you want to know how it works, is that we have a narrow shift binary.
I'll see it binary with we'll be able to manage image files and also a lot of things with the hosts.
And you will be able to create a container based on an image.
So like that, you can also create a mission.
What is cool with Docker?
And I was using Docker for a while.
Is that also you can at some point isolate each mission from each other.
For example, let's say that in pen tests, sometimes we have to change like we have to change a lot of missions.
So we have a client one, we have client two, right?
I mean, and the premise that if you are messy, I mean, I'm super messy.
And sometimes I will do traces and I will do like a lot of stuff in the container.
What is cool is that this container is dedicated to one mission for the client one, for example.
Client two, I create another Docker container, could be as there are four, could be Wi-Fi, could be Bluetooth.
I mean, anything, but it will be dedicated to this mission.
So if you are messy also, it also allows you to organize all these things.
Let's do like some demo times, right?
Because it is a little bit like, no.
Let's bring all these things.
It's probably not good, better to do like some demos.
And I have like some fun demos.
Up.
So I don't know if you see those characters, perfect.
So yeah, I was actually messing with the X-Rounder, but we have this computer.
I mean, this computer is actually making fun of me with the display.
So how it is working?
I have in studio, I have a little binary, which is installed.
It's pretty easy also to install, called aeroswift aeroswift.
Whereas the poor needs also studio in order to work.
So you basically, I mean, normally there's like a little ask here, but I would probably remove it in the time.
I mean, it takes like a lot of space in the screen.
But yeah.
You're for the poor, a little help that allows you to see all the commands that exist.
By the poor, you can do like some bindings.
So that means that for the poor, let's say that you have something cool in Linux that is working is that if you are created container,
you don't need to create another container by committing the last one.
You can directly re-bind for the poor, the USB devices on your container.
That is actually running, which is kind of cool.
That does not exist in Docker, for example.
So that's why we are also using the dedicated binary and not Docker compose or anything like that.
We can also commit the containers.
That means as far as the poor, if we have a container that is also interesting to reuse.
We can actually commit it.
We can extract, we can install also some some streets, some scripts for a container.
I mean, there's like many, many tools.
I mean, many features.
For example, the first feature you want, for example, to use is images remotes.
Because you want also to get the list of all existing images.
So here you can see a lot of images that exist.
For example, some are dedicated for NFID, some are for Bluetooth, some are useful for meon.
As the years, for example, so you have, as they are like, as they are for, as they are for that allows you to have like a lot of tools,
including also a lot of out of three modules for a binary view and so on.
So there's like many things.
And yeah.
If you want, if I want to install any tool, I'll just move from the remotes.
You can wait a second.
I'll just lose the mouse.
Yeah, perfect.
Up.
I'll just like up in that.
And I can use, for example, image pool.
Let's say I want to, to install.
Yeah.
I'll try to.
I'll fix.
I'll try to.
Like that.
Normally it's already installed.
Normally I took care of that.
Because I didn't know if I will have like any internet connection here.
Which yeah.
Normally it is actually looking at the the repository.
Yeah.
And actually it face because I mean the internet connectivity is not right.
So it actually face.
So this is like also some some I mean some trace that I need also to end on a little bit.
But yeah.
As you can see, this project also was created in June 2024.
So it's pretty young also.
But yeah.
Normally on, you have an image.
So first of all, here look, well, it looks like that.
So you have some images that I have already downloaded.
What is cool is that by the point, you have the tag reversing.
I want to reverse binaries.
And so if I want to use, for example, the I mean, I have images for only devices for
SDR and also essay.
Bluetooth, etc.
So let's say that I want to use possible SDR light.
The one that allows you to put to do some assessment with with some SDR and also essays.
I can first put on it like that.
I can just like do.
Air Swift ran here.
SDR lights like that.
Right.
And then I have to precise the name of the container.
So super SDR one like that because it is super right.
So I'm doing that.
And then for example, I can plug any devices like that.
Okay, I don't know which one.
I will actually plug this one after.
But do you have like one that's here?
Here.
I can plug here directly.
And then I will show you with the essay that I have here.
Up.
So it's a Rick's one.
Yep.
I'm just taking the better off.
Here.
You can also plug in order.
Any SDR?
I mean, if you want to know also the list of SDR that I've supported.
I can show you.
Here.
There's Swift.
Up.
Because there's also documentation here.
So for example, I know that at first you will probably get lost.
But this lack of documentation that allows you to see for example.
Included tools.
And like that, you can see for example for each image.
Which tool actually are also.
Included for example.
UHD.
There's RTLSDR.
BIOS.
New old.
A caref.
Earthspite.
That means there.
So even a line measure, which is painful to set up.
I mean, it's pretty fast to get it running in here.
SDR lights.
You have for the book.
New radio.
Libre.
Vainage.
So for example, if you want to measure for the post.
I mean, I can also show you that working directly.
For SDR, we have many out of three modules that are actually installed.
Even some.
Some other programs.
I mean, you can probably find your.
I mean, some interesting programs there.
So yeah.
Let's maybe use one program that someone will also present lately.
But just to show you that it works.
Like that.
And then I will go to a nice demo process with Bluetooth.
And other things.
Up.
So.
I just plug the.
The plutonist here there.
So the antenna is also falling here.
Um, so I can directly just like do as they are plus plus here.
I can also call it directly from air proof like that I can do like.
I mean, as they have, I mean, pseudo errors with blah, blah, blah, blah, blah.
And then, uh, they are also because this computer.
I didn't use the computer in performance mode.
So it will actually go very slow.
Are we going to performance?
It will be better.
Wait.
Perfect.
And so where is.
Bedaref.
Which is second.
Bedaref.
One two.
Okay.
Here.
Right.
Up.
So let's see.
We can directly play it like that.
Yeah.
This is also.
Did I just press play or not?
Up.
Come on.
Put this low.
Slow or not.
Come on.
It does detect the rates.
But I don't know if it's playing or not.
If I.
Ah, I just double click.
Yeah.
Okay.
Nice. Now it's perfect.
So I can.
I can go to gain.
I can now go to gain.
Yeah.
I'm sorry for the display guys because we are good in RF but not with wires right.
So.
So maybe let that.
And here.
Yeah.
Here we can see something.
I mean probably.
I can go to one specific frequency.
Like yeah.
From what 60.
Eight.
Like that.
Find the microphone.
The microphone will be like.
Eight.
I mean 80.
Right.
Yeah.
We will probably do that with the rest.
I would be better.
But I'm just looking at.
Let's say like a remote like that.
What.
Or if someone wants to.
We have like that in this frequency.
Maybe not.
So as we don't know exactly the frequency in use for this one.
Actually, I can maybe just like step in a bit.
No.
We don't know exactly the frequency in use for this one.
So what we can do is that.
We can up.
We can just.
Rebind things because also.
I will.
Rebind the calibration.
Data here.
So it is again.
Cal files.
Demo.
Perfect.
Up.
Demo.
Right.
So we use this path.
And.
I can.
Where's the mouse.
The mouse.
We use with the cat's right.
So up.
I will just.
Because I already also what is cool is that I can see for the last.
Contenders that I've been.
Use was bought that I've been.
Executed.
So what is cool is that.
I will be able for the port to use the binding feature.
Against.
This container name.
And what is cool is that you can use this container name.
Yeah.
If you want.
But to re invoke it.
You can use.
I have swift exact.
And the container name.
So for the.
The binding is the same.
We do.
Like.
Studio.
Air swift.
Like that.
Bindings.
Like that.
And I don't remember the option.
So like that.
Okay.
So we have to.
Add.
Then.
What we can do.
Add.
We have to precise the container name.
We've asked the source and the targets with.
Dashi.
So we can use now.
Container name.
Super SDR one white.
Here.
With S.
We precise.
The source.
Ah.
This one.
I'm that.
The source.
Like that.
Up.
And then the target.
A directory.
So that means.
Let's say root.
Up.
Share.
Like that.
And so then.
Successfully.
Right.
So seems like.
Everything is right.
So what is called is that.
Then I can.
Go back to the container.
Just doing exact.
It will execute the like test.
Container.
And normally I should see new.
A new binding.
In the description.
Here.
As you can see.
So that means that.
The binding.
Now.
Is able to see.
The directory.
I bind it.
From the host.
So first point.
If I'm doing that.
I'm doing that.
Share.
I will see.
For example.
The.
I mean the.
This is a needs.
Also.
I mean the software needs.
The collaboration data.
To be.
Also in a particular directory.
So that's why I.
I.
I'm not doing that.
But like that.
And so like that.
You can always keep the files on the host.
For example.
Let's say the traces and success.
So it shows you also this.
This thing in the same time.
So.
I'm going to go into.
Harajik.
Cal file.
Like that.
I will just like copy.
Everything.
Up.
Like a messy guy.
And go to.
Up generator analyzers.
Ban.
B
I should do like something more automatic.
Stand that right up.
And then I can use.
Studio.
Search with.
Besides.
And then we will be bought to discover.
Baby which frequencies and years.
What.
All right.
Joel it's using I assembly.
So three three for.
Four three,
Ming are ras or eight six eat.
Yeah.
We'd never know.
So we don't want to also waste time.
I'm looking for the şuras.
USB top here, so that's the USB, so it is like a little glass box here, I will just
like 13 here, top, top, do you have any, I mean, poor plug here, someone, no, okay,
that's why we have also to use the Write, input write because it also has
of my electrical, and so we can now just plug the other one for data up. We'll use this
UWB antenna here up, and we'll see. So, Jenny, I mean, this is the first thing we are
doing when we're doing a assessment, so when we don't know exactly which frequencies
you use, is that we use a spectrum analyzer, could be like this one, which is a pretty
chip, I mean for what it does up, and so we call it, we can call the software like that,
and look at it, shit, it's not showing in the right, wait a second, ah, perfect. Up, so you
can see, for example, a nice, I mean, it's a nice eye, there's like a lot of things happening
here, so we probably just like, put some traces in here, up, up, next all, for example, at least,
and let's see, let's see if we can see what is happening,
it seems like, we're not be as easy, right? It's like a lot of stuff, Jenny, you will
prefer to use also farer decades in order to just be very, in a clean room, but yeah, I mean,
let's probably just, I will probably wait a second, use maybe a big search marker here,
which one do you see? Yeah, we need, we need, we need, probably just like to
to use this smaller, you're right, instead of you using nine carrots through our,
at nine gears, we probably just like, lower it down a bit, like a hundred megahertz, like that,
or even three hundred megahertz, we'll be better, right, and we'll go maybe through nine hundred
megahertz, it's with you, probably better, oh, wait, oh, okay, up, hurts, like that's,
perfect, and here, four hundred would be enough, right, because we don't need all the other
bands, it's so, yeah, so now maybe just like, let's try to just disable when I'm on the
trace, like that, and see, you'll see this like, okay, there's a lot of corrects,
but we probably see something, I mean, there's like a respect that I spotted that is in here,
so it's probably this one, so let's maybe take a look, I will just like, let's pick in here,
I already see, so this package, that's 870 megahertz, so let's maybe just like, not use the sweep mode,
because the sweep mode also messed, I mean, there's a lot of stuff in here, we can use, by the
power at times spectrum, as upon mode, and look at sky, up, megahertz, like that, and let's see,
if I can just like grab something interesting, okay, yeah, so you see, here, there's something in here,
so it should be that, so we can probably zoom a bit on it, like, just reduce the span up,
and what do we see, we see like, this is like an overjuck in here, let's we see something,
in this frequency, particularly, perfect, so 868.9, 92, so let's maybe focus on that, we just like capture
that, and then I will show you that, I mean, we have many tools in there, so we can just like do
I can stream in mode 86, 68, 68, 0.69, okay, good, up, let's see, so we have that, perfect,
you can also demodulate, I mean, this is like now some digital demodulator, I mean, numeric demodulators,
so here, I will just like decrease a bit the span, so like that, I will be able to capture
this little clicking there, I'll probably just like also do like a peak search, so like that,
okay, perfect, so let's probably just like capture this one,
so I will just like capture this one, like that, where is my mouse again, it is here, so up,
record, record now, I will just like record time, I will just like put like two seconds,
could be cool, like that, then oh, nice, perfect, thank you very much, so we can now record,
so we just like record it, okay, so two seconds is enough, you just like take your trace and here,
as you can see, we don't have like, you know, any demodulator in here, it exists, for example,
if you pay some extra bucks, but we want maybe to use another tool, just like to show you that
there's not only this tool, so for example, if I want to use another tool, let's say,
a new radio, I can actually use it, and if you use the as their fool, you will have all the out of
three-model of a new radio, Janey, all of them, or probably some of them will be missing, so don't
hesitate to to also propose, but here you have the common one, so by the way, we can use a file
tools like that, I mean, the way for resources because it is also recording the wave with
a logic, like that, it has two tracks, it has two tracks, so it is like one eye, another cube
track, so it separates all the tracks like that, and we will then use to do floats to complex
like that, and so like that, we can just change a little bit of format in order to play with
all of the tools, so like that, you can see that we can switch to from the radio to another tool,
like that also, file up sync, like that, we will not use a throttle because we will just like
record it directly in IQ, I can maybe show you that something is happening or so, that's with
a QTB sync here, like that, so up, up, so where is the, so if this is the calibration file,
I don't bother about that, so I want the recordings, so the recordings are in
SGA tool, air tools, air tools, analyzers, says studio, data, and here there is the recording,
so the recording looks like that, up, up, so yeah, if I just repeat like that, I will just
let's see, if this is this signal or not, so let's do a test, oh like that, up, we can just like
see if we have the recording here, we have something in there, right, so we can maybe just like
also use, I mean, or if we look at the constellation, it will not be something in phase shift
king, but if we look at the shape, looks like we have something that probably like is
okay signal, something is such right, so we can maybe just to file sync, enable, file,
kmp, ah, kmp, oh ho ho, c-fight, like that, just to precise that it will be a complex file,
and then we can record it and we can work with all the tool, we can continue with the radio,
but so, I mean, the things that just to show you that we can go forward, like that,
with that the capture, the capture, we can use the new red flag, for example, if we don't want to
just mess with the radio, we can directly open it in computer, up, it's a test, I mean, tmp,
up, and then you can see something that comes as follows, let's see, for example,
also it is interesting, with the spectrum, we see something like that, so it's pretty clean
compared to what like an Azure already, with a better antenna gen X, it will be still a better than this one,
but I mean, as a boy it's already detecting like an okay signal, and we have also our symbols
that are here, so then we can go forward, we can, as a boy just like you say, hey, what is the number
of sample per symbol here, so we can maybe look at this and see that it has actually also
guessed that it is a hundred directly, but sometimes we have to also play a little bit of the
things in here, but yeah, we can then continue a, we can reverse the signal that way, right?
Or we can also do that with the radio or any of the tools, I mean anything like that.
Let's say that now you are in a mission where you want to do some, let's say, Bluetooth stuff,
right, your own purple approach, you just like open this lock, so if I suppose this lock is your
mission, it's a, you know, gen is lock, it's lock, I mean, can anyone confirm that it's locked,
it's locked, right? So it's a, it's really locked, and so if I want to open it,
I can use for, as a whole directly, other, there's like a little image that is already here,
that is the Bluetooth image that I have loaded, and so the Bluetooth image, I can directly use it,
and you probably guess, I mean, I don't know if you have, you don't like a lot of assessment in Bluetooth,
but it is a mess, I mean, all the tools sometimes are obsolete, it does not work, it's a mess,
completely mess, and you have to, I mean, spend a lot of time doing so, so here with this image,
I have blueing, you're working, I have mirage, I'm, am I right, sorry, I have many tools,
that's, you know, probably we will waste a lot of time for you. So here, we go, so we just like, run,
Bluetooth, like that, so run, Bluetooth, also, just to save time, because I know that there's like,
not a lot of time, I will also directly load the script file, I will show you what the script
does, the script, what the script does is that just like, it does replay the same packet to
open the lock, because the lock is using the, I mean, does not use any ID or any encryption,
I mean, to, structurally, get open, I mean, this is not running code, for example, for this one,
so it is vulnerable to replay attack directly. So we'll use this replay attack, but we can also use
mirage for example, to me, to mind the middle of the communication between the lock and the application,
I mean, the legitimate application, but what we'll do is just, let's say that we have captured
already some packets, we want to replay it, and you will see that we will play the same packets all over
and over, it will be unlocked. So, for example, if we want to do so, yeah, I forgot also to,
I wanted to do like bind, yeah, I will also bind some stuff in here, so we'll use bind and I will
also bind that, because here I have the script file, so like that, also I can save time in here,
so I will bind it in roots, share, let's say, and I will use a name, what name I can use,
super Bluetooth, super Bluetooth, Bluetooth 1, right? Oh, yeah, it tries also to look at the,
I mean, sometimes it tries to look at, I mean, I'm the, at the version of a error search,
and if you don't have any network, it does shows you like something like that,
I should actually patch it also, but yeah, let's say that I want to now exploit the vulnerabilities,
so you can see for example the scripts, I just like, it's pretty small, I mean, that's just
a connect to the target, it's authentificate itself, and then it sends a command to unlock, so
I can now use for example this little command directly like that, I can now just press that,
I hope I will not have any demo effect, but yeah, I can just like press two times in order to go
to Bluetooth mode, and let's see, yeah, it failed, yeah, that's also the issue with Bluetooth,
because we have also to make sure that the Bluetooth is not locked at something else, so
disconnected, connected, connected, connected, connected, it didn't connect at it yet,
let's wait as, our connection is successful, so maybe it will actually work,
sometimes with Bluetooth you have to to push things a bit, so it is again that, that
exits that, gone, gone guy,
let's do that, that, that, up, yeah, I know, up, up,
no, it's crazy, I think I will have to do that manually, so with a second, I will just
try again with the script, and I tested the script yesterday, so normally it worked,
like that, come on, oh, finally, it's free, so we have to be also close to the right,
right, so yeah, so let's say, then you want to, I don't know, we have how many minutes we
have asked a little bit of time, so we want to go to another topic, let's say,
RFID, right, we can go to RFID, so we can go to RFID, I mean, we can go to Telco with 2G, 3G, 4G,
your 5G station, install pretty easily also with RFID, but if we want to go to the RFID topic,
yeah, I have some time, a lot of time, or maybe for the questions, right, could be better, yeah,
yeah, maybe could be better for the question, so yeah, because we have only like less than 5 minutes,
so if you have any questions, guys, don't hesitate to ask, also if you won't,
cause for the demo, I have plenty of, as you see, a lot of toys, so we can also show some
some stuff also here, and yeah, don't hesitate also if you have like any question there,
or any issue, or if you want to also contribute, because I mean, I'm the only guys contributed
on it, I'm using it at 200%, but yeah, if you have any ID, could be like also something
interesting for me to add also there, so yeah, thank you very much for attending this presentation,
just checking if everything is fine here, but normally, I have maybe the worst conclusion ever
for that, blah, blah, blah, conclusion here, conclude, yeah, I mean, you can travel, yeah, as I said,
you can travel safely with errors with, I mean, just also for your information, I was also doing
like an assessment, this, this computer, this precise computer, also was corrupted, and I was also
happy that in less than 10 minutes, I can also get all my setup back for my RFID assessment, so,
I mean, I'm using it like a lot, but if you're using it and you like it, please also just
like curap or maybe contributes, I mean, don't only just pull issue, because issue is also like
sometimes a mess to correct every time, so if you want to contribute, it is free, it's open source,
and also you can cook your own images, so that means that if you want to precise,
as you are device with a precise tool, just to take like a very few megabytes, I mean, you can also do that,
because you can do the Dockerfile yourself, so yeah, thank you very much for attending,
and I hope you enjoy it, and if you have any questions, please, I'm here to answer any questions.
Any questions?
No questions?
Don't be shy, you have any questions?
Yeah, so you were working with a Bluetooth device at the end, where would you have to start
if you were just handed at the brand of Bluetooth device?
Oh, I mean, for this one, it's known to be vulnerable, but Jenny, what I do is that,
for example, I will use an application on the phone and the device, and I will use my
phone some tools, like my range, but it is like also some of the tools that exist that are also
obsolete, sometimes some of us are, but Jenny, a lot of tools are obsolete in Bluetooth,
and they get obsolete pretty easily, but yeah, I'm doing like a main demand at attack in order to just
pretend to be the toy and pretending also to be the cell phone.
So that means that then I can show, I can see all the commands at our sense, and just in blind,
I can see, hey, I mean, it's repeating the same packets, so I can just replay even.
But if it does not do that, I will use one for the power image to reverse the application,
and see how the encryption or any mechanism that actually generate the packets is behaving,
and so like that then, I can implement the same algorithm and up, I can maybe just attack the device
a little. Yeah, yeah, I mean, the main demand of the device is that you can use for the
poor, sorry. Oh, I'm very CPI. I mean, you have images, there is also some image
that are in the GitHub repository, if you go there, and so you can also modify them, you can
read the app them, you cook your own, and then you can use it private, if you also.
Okay, thank you again. Thank you very much. Thank you.