Preferred Network List Sniffer - PNLS

Preferred Network List Sniffer (PNLS) is a Red Team Wi-Fi auditing tool with a simple web interface that is capable of intercepting SSIDs[^1] from the device's preferred network list (PNL)[^2]. This is achieved by sniffing out Probe Requests in the nearby vicinity, which are then parsed for SSID and other information and finally propagated to the web UI. The primary motivation for this project was to look into 802.11 Probe Requests and the privacy risks associated with the data they transmit.

Fig. 1: PNLS system overview

[!WARNING] All content in this project is intended for security research purposes only.

[!NOTE]

• This project is part of my ongoing research into Privacy Protection in Wi-Fi Networks.

• Scope of work presentation

• To monitor the ongoing work on the PNLS, see the project's board.

Table of contents

• Preferred Network List Sniffer - PNLS
  • Table of contents
  • How to build the PNLS
    • Requirements
    • Prerequisites
  • Setup
    • Using Docker
    • Using Prebuild Docker Image
    • Without Docker
  • Probe Requests
  • SSID Filtering
  • Architecture
    • Why Asynchronous Server Gateway Interface?
    • Why WebSockets?
    • Pub-Sub Model
  • Screenshots
  • Acronyms
  • References

How to build the PNLS

Here is what you will need in order to duplicate and deploy this project, including both the hardware and software components. Once you have your working environment ready, head over to the setup sections.

Requirements

• Raspberry Pi (RPi)
• Suitable RPi power supply (see the power supply documentation for details)
• Micro SD card (see the SD card documentation for details)
• USB Wi-Fi adapter (optional)
  • Used to achieve a bigger range when capturing packets.
• HDMI cable (optional)
  • Used to display the web UI from the RPi instead of connecting to it remotely using your computer.

Prerequisites

• Kali Linux OS
  • Needed in order to use monitoring mode and aircrack-ng tool. You can download the Kali Linux ARM image from here.
    • Alternatively, you could use another OS, but you will need to patch[^3] the kernel using the nexmon[^4] or use a wireless adapter that supports monitoring mode. Here is a link for supported USB adapters by Raspberry Pi.
    • You will also have to install the aircrack-ng tool, as it only comes preinstalled on Kali Linux.
• Start your network interface in monitoring mode with: sudo airmon-ng start wlan0 [2].

[!NOTE]

The Kali image uses Re4son's kernel, which includes the drivers for external Wi-Fi cards and the Nexmon firmware for the built-in wireless card on the RPi 3 and 4 [3].

Fig. 2: PNLS running on a RPi 4 with an external antena and a battery bank

Fig. 3: PNLS running on a RPi 4 with a case with an AWUS036ACS antena

Fig. 4: PNLS running on a RPi 4 with an AWUS036ACM antena

Setup

If you don't want to use Docker, head over to setup without Docker.

Using Docker

Quickly setup a development instance:

# First clone this repo.
git clone https://github.com/AleksaMCode/Preferred-Network-List-Sniffer.git
# Move to the project root folder.
cd Preferred-Network-List-Sniffer
# Build backend and frontend image.
docker compose build
# Bring up both the backend and the frontend server.
docker compose up
# Move into the sniffer folder.
cd sniffer
# Run the Sniffer service.
sudo python3 sniffer.py

Using Prebuild Docker Image

Currently, multi-platform images are not available, and the project only supports the ARM64v8 architecture. Download the latest prebuild images from the GitHub Container Registry and run them locally.

# First clone this repo.
git clone https://github.com/AleksaMCode/Preferred-Network-List-Sniffer.git
# Move to the project root folder.
cd Preferred-Network-List-Sniffer
# Download the prebuild images.
docker pull ghcr.io/aleksamcode/pnls-backend-ghcr:latest
docker pull ghcr.io/aleksamcode/pnls-frontend-ghcr:latest
# Bring up both the backend and the frontend server.
docker compose up
# Move into the sniffer folder.
cd sniffer
# Run the Sniffer service.
sudo python3 sniffer.py

Without Docker

• Backend: to start the ASGI and Redis servers and to run needed services, see these instructions.

• Frontend: to run the React server, see these instructions.

Here is a screenshot when everything was ran "manually":

• Top Left: Redis server
• Top Right: ASGI server
• Bottom Left: Sniffer service
• Bottom Right: React server

Fig. 5: PNLS screenshot

Probe Requests