fiked

Fiked is designed as a Cisco VPN attack tool targeting commonly insecure PSK+XAUTH based IPsec authentication setups. It acts as a fake IKE responder, impersonating the VPN gateway to trick clients into revealing their XAUTH credentials. This enables credential capture without performing a full MitM attack, as it does not currently handle the client side.

Use cases include penetration testing of Cisco VPN deployments vulnerable to IKE responder impersonation. It is particularly effective against setups using pre-shared keys (PSK) combined with XAUTH, which are widespread but often insecure when not properly configured. The tool requires specifying the target gateway address and PSK details to successfully spoof the responder.

Based on the vpnc codebase, fiked provides a lightweight daemon for these attacks, with options for logging credentials and running detached. It is installed via standard Kali package management and depends on common libraries like libgcrypt20 and libnet9.

Fiked operates as a fake IKE daemon using raw sockets to forge IP source addresses matching the impersonated VPN gateway. It implements minimal IKE protocol support, including Cisco extensions, sufficient to respond to client initiations in PSK+XAUTH authentication flows. Upon receiving IKE requests, it impersonates the gateway, completes the handshake to solicit XAUTH username/password credentials, and logs them without forwarding traffic to the real gateway, achieving a semi-MitM credential theft.