I just received my PQI Aircard and I can confirm that its discovery method is horrible. The client launches ARP request for all /24 of your network (regardless of your netmask) then asks
GET /cgi-bin/get_config.pl HTTP/1.1
Which answers with the full configuration stored in wsd.conf (and passwords in plaintext).
The default firmware on the WifiSD is far from perfect, but it's better by any metric.
I did further research and was just going to post this. My research setup was to drag out an old unmanaged switch hub and a dlink dwl-g730ap hotspot to attach to a port and a PC with wireshark on another. After that I realised the client was establishing with the following:
GET /cgi-bin/get_config.pl HTTP/1.1
User-Agent: My Phone Info
Host: X.X.X.X
Connection: Keep-Alive
Accept-Encoding: gzip
I was curious to see if they somehow figured out how to get around root for ARP on Android, so I did a little bit of work there too. They are not doing an AR request, they're just iterating over the full /24 with a 5 second timeout. From the logcat:
java.net.ConnectException: failed to connect to /X.X.X.X (port 80) after 5000ms: isConnected failed: ECONNREFUSED (Connection refused)
Anyone who has port 80 open will get the string above. If you give your wsd.conf info it will then ask for a list of the files as such:
GET /cgi-bin/wifi_filelist?fn=/mnt/sd/ HTTP/1.1
Host: X.X.X.X
Connection: Keep-Alive
User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)
In response, it's a simple XML listing of files and directories with attributes to differentiate each. Actually, you don't need to give the full wsd.conf, you can simply do the HTTP header response.
Basically this is the app's routine:
String str = ClientIpCheckService.b(this.a).substring(0, 1 + ClientIpCheckService.b(this.a).lastIndexOf(".")) + j;
if (!str.equals(ClientIpCheckService.b(this.a).toString()))
new Thread(new b(this, str)).start();
Wrapped inside an iterative while true loop that breaks off before 255.
So I guess if you want to add to your tool, you'll just open port 80 for listening when the PQI radio button is clicked and check who the inetaddr is that asks for the get_config.pl.
Other interesting tidbit is that kcard_cmd -w is the command to re-associate with the wifi network. It's kind of a pain in the a?? when you must issue the command to get it on the hotspot mode instead of AP mode.
(Last edited by smbgaiden on 24 Aug 2013, 20:10)