A pineapple can have any subnet it wants. Also I have multiple subnets that start 172.16.xx.xx
this post was submitted on 06 Jul 2024
851 points (99.9% liked)
196
15765 readers
2936 users here now
Be sure to follow the rule before you head out.
Rule: You must post before you leave.
founded 1 year ago
MODERATORS
you must be leet haxor
172.16.0.0/12 is a valid prefix for private networks. In fact, you get more hosts than 192.168.0.0/16, but less than 10.0.0.0/8.
Yeah, it’s not that it’s not valid for private networks, it’s that 172.16.42.x is common for WiFi Pineapples
Every "well ackqually" person in this thread is insufferable
IDK, I find them quite sufferable and in fact I'm learning something from this thread.
load more comments
(1 replies)
Saying 172.16.0.0/12 is usually for pentesting scummy thing is very misleading...
It's not that it's on the 172.16.0.0/12 range. That's totally normal and used for all kinds of stuff.
It's that it's in 172.16.42.0/24 which is the default dhcp settings for a wifi pineapple. It's the /24 mask given on the .42 that's a little suspicious because that's not a common range for anything else.
Being assigned one of those specific 253 hosts with that subnet mask would definitely make me think twice.
It's the /24 mask given on the .42 that's a little suspicious because that's not a common range for anything else.
Well now I know. I operate a ton of /24 subnets in the 172.16.0.0/12 scope. Technically I could fit them in the 192.168.0.0/16 scope, but I have lots of students connecting SoHo wifi-routers to the subnets, and this way it's pretty easy to tell, if someone put the WAN cable in a LAN port when people are getting 192.168.1.0/24 DHCP offers.
load more comments
(2 replies)
load more comments
(1 replies)
Wtf is with the "..." Explain why pls.
It's just one of many private ranges. Saying it's dangerous is like saying every websites using .xyz domain is dangerous(which makes little more sense than this, btw)
load more comments
(2 replies)
There's nothing at all suspicious about the 172.16.0.0/12 address block. It's a standard block of IP addresses that's reserved for use on local networks, just like 10.0.0.0/8 and 192.168.0.0/16. It's not a scheme exclusively or primarily used for illicit purposes.
load more comments
(1 replies)
load more comments
(1 replies)
Please use a VPN anyway, as if hotel WiFi is secure lmao
HTTPS solved much of the security issues of untrusted networks. As long as you're not doing banking or whatever, you should be fine without a VPN.
Why would banking be an issue? I get that its a target, but I really would expect a bank to take care of their TLS.
Also i would expect banks to use some sort of 2FA where you have to manually confirm any transaction on your mobile device, or enter a code generated from there into your computer.
load more comments
(1 replies)
It should be fine as long you don't click through any SSL errors. And something like a bank should have HSTS enabled, meaning your browser will refuse to load the site if there's an SSL error.
load more comments
(1 replies)
load more comments
(1 replies)
Public WiFi is just PvP enabled
[x] Client isolation on
This is now a safe zone
The only part of this I didn't immediately realize is the wifi pineapples default IP range.
From now on, I'm going to set that as my clients default public IP range to troll anyone who knows.
really start to worry when it’s 169.254.0.x …
That just means the ~~DNS~~DHCP is disabled.
Edit: words
That is not what that means, it means there's no dhcp on that network segment.
In my defense, whenever there's a networking issue, it's always DNS related.
The three stages of grief:
- It can’t be DNS
- There’s no way it could be DNS
- It was DNS
load more comments
(2 replies)
load more comments
(2 replies)
-
“The hotel’s free WiFi is really fast”
-
“the DNS is disabled”
*connects to pineapple
*sets subnet to 10.0.0.0/16 so I don't have to type a yee yee ass class B/C address everytime I wanna do something with an address
Or
*connects to pineapple
*Sets subnet to same as target network so paranoid user doesn't realize he connected to evil twin
load more comments
(2 replies)
thank you lain
also omw to set up my dhcpv4 server to use that network whenever I create a hotspot
So I guess I must be a leet haxor because of all the businesses I configured for the 172.x space because 192.168.x space was too small and 10.x space was way the hell too big.
load more comments
(4 replies)
Thank you, Lain.
Does this matter if the traffic is encrypted, such as an https website instead of http? Like, really how often is internet traffic unencrypted?
Yes, back when I was playing around with my WiFi pineapple there were a wide variety of tricks to break SSL authentication without it being obvious to users. Easiest was to terminate the SSL connection on the pineapple and re-encrypt it with a new SSL cert from there to the users browser, so to the user it looked like everything was secure but in reality their traffic was only encrypted from them to the pineapple, then decrypted, sniffed and re-encrypted to pass along to the target websites with normal SSL.
Man in the middle attacks really do give the attacker tons of options
That kind of ssl interception would normally be quite visible without your client device having the pineapples cert in your devices trust store, or am I wrong?
load more comments
(1 replies)
Not often. For web browsing - and the majority of apps - your session is encrypted and certified. Breaking SSL is possible but you'll know about it due to the lack of certs.
Thank you lain.
Thank you Lain.
Thank you, Lain
Thanks Lain.
A lot of the comments here are saying that a pineapple can configure their subnet to use 10.x.x.x or 192.168.x.x. Is there any other way to determine if an access point is compromised?
Do some online banking. If your balance goes down more than expected, it's probably compromised.
load more comments
(4 replies)
While I've never seen a router default to the 172.16... range, to me it just means that someoe bothered to modify the settings. No wonder the network is faster.
Fear-mongering much?
load more comments
(2 replies)
Thank you lain
Thank you Lain.
Thank you lain.
Thank you Lain.
Thank you Lain!
view more: next ›