802.11 Monitoring with PCAP2XML and SQLite
SecurityTube founder Vivek Ramachandran introduces PCAP2XML, parsing complex 802.11 Wi-Fi frames into structured SQLite databases for rapid SQL querying.
Summary
The Complexity of 802.11 Frame Analysis
Analyzing gigabytes of raw wireless capture files using traditional packet analyzers is cumbersome due to intricate 802.11 management, control, and data frame structures.
Introducing PCAP2XML and SQLite Integration
Vivek Ramachandran presents PCAP2XML, an open-source utility that parses radiotap headers and 802.11 frame fields into structured XML and SQLite databases.
Executing SQL Queries for Wireless Threat Hunting
Ramachandran demonstrates crafting SQL queries to instantly identify rogue access points, deauthentication floods, evil twin beacons, and unencrypted probe requests.
Automating Wireless Attack Detection
The presentation provides automated Python scripts for real-time intrusion detection and wireless digital forensics.
Related talks
Briefings·40 min
Neil (Grifter) Wyler · Bart Stump
The Black Hat NOC leadership reviews network traffic statistics, malware infections, and active threat containment data from the conference floor.
Black Hat·31 min
Hongjian Cao
Presenters detail vulnerability discovery and exploitation in Owfuzz: WiFi Nightmare.
Black Hat·32 min
Haikuo Xie
Presenters detail vulnerability discovery and exploitation in Qualcomm WiFi: Infinity War.