- In the previous lesson we covered some of the wireless
standards, in this lesson we will go over a few examples
on how to crack WEP and WPA, but before we go into
the demonstrations let me first define
what are these actually protocols.
So the first one is WEP or W-E-P, and WEP stands for
wired equivalency protocol, and this
is a protocol you should definitely avoid.
It is full of vulnerabilities,
and it is extremely easy to crack nowadays, right.
We will actually go over a demonstration on how
easy it is to crack this protocol in just a few minutes.
Now, WEP uses a weak and reusable initialization vector,
or an IV, that's what we use to crack the wireless
infrastructure password in our example
in a few minutes, right.
I'm including here every presentation of
the initialization vector of WEP for your reference, right.
Now how this actually helps us, right so, the thing about
WEP is like, what if we actually know the contents of a
packet right, and you can actually predict what the contents
of the packet is by using things like ARP.
Using ARP packets you can definitely predict what the
contents of a packet is because ARP packets
are always 68 bytes long, right.
And WiFi ARP packets have a 40 byte RC4 encrypted part,
so the first 15 bytes are always at this representation,
so AAAA03 and you know you can read the rest.
And it also extort these bytes with the extort cyber
text to recover, and then the first 15 bytes of plain
text right, so definitely if you can collect enough
AR packets with different initialization vectors,
or different IVs, then you can actually find the key
through statistical analysis and statistical attacks, right.
Now WPA is a little bit more secure than WEP,
but you can also crack its password.
For WPA and especially for WPA1,
using TKIP it is actually fairly easy to crack the password
and we will see that in a few minutes as well because I'm
actually going to do a demonstration of that, right.
Now another protocol that is also fairly insecure is WPS,
right, it is also easy to brute force and also it has
actually a short pin that only takes a few hours to
actually of course brute force or crack.
And it all depends on your CPU or GPUs of course if you
use GPUs you will obtain much better results than if you
just use CPUs, so dependent on how the capacity that you
actually have and the environment that you have,
whether you're using CPUs or GPUs or in some cases
A6 to actually do the password cracking, that's how
long it's actually going to take you to do this.
But again, even with the modern standard base computers
nowadays, it will actually only takes a few hours.
And the difference between WEP, and WPS, and WPA,
is the way they actually do the steps to actually crack
the password right, and we will
go over this in a few minutes.
Now, again if you actually use preshared keys, that means
that basically dictionary attacks will be possible.
Right, so you can actually brute force your way in by
using dictionary attacks, and again you're going to
see this in a few minutes.
Now in WPA, each user receives a unique session key,
and this is actually done to prevent decryption from
a packet capture, right so if you actually recover,
and then you know the PPSK or the preshared key,
then of course this makes it a little bit difficult.
However, if you capture all four handshakes of the initial
WPA in negotiation then you can actually obtain the WPA
preshared key and that's how you're actually going to see it
in our demo, using the air crack NG toolset, right.
So now that I have actually given you an introduction of
this protocols, let's actually go over how to crack them.
Right, so for these example, this is the topology that
I'm using, do you have a wireless router in the corporate
network that is configured with the SSID that is called
corp-net, right so corp-net, and then the wireless network
for this example that is configured VIDHTP is in the
192.168.1.0 network with a 24 bit mask.
Now that writer is actually connected to a firewall,
and then that firewall is connected to an interior router,
and then of course to the internet right.
So this is a very simplistic topology in the real world
enterprise you may actually have numerous access points
controlled by wireless LAN controller or by cloud service
like Meraki for example, however, in essence the procedure
that I'm actually going to explain here, it doesn't matter.
The environment if you're actually using WEP or WPA,
this topology will be more than enough.
And also by the way in this topology, I'm also showing our
Kali attack laptop you know here.
So let's go over how to crack WEP.
The first thing is that I want to cover is a tool that is
fairly cool to monitor all the available SSIDs in the air,
right and that tool is KISMIT, right.
Now KISMIT as we went in previous lessons, this tool is
actually not only used for of course penetration testing,
but it's actually used by many people to
actually do troubleshooting as well, right.
Now as you can actually clearly see here, the corpnet SSID
is actually running WEP right.
You can also see a graph of packets going over the air,
and information about the actual router itself right there.
You can do similar things with a series of tools,
part of the NG aircrack framework.
Some people prefer this as a tool, but it's actually
a toolset right, you learn about these tools in previous
lessons right, but let's actually see it in action, right.
So let's see how you can use it to crack WEP.
First, just like KISMIT, you can use aerodump, which is
one of the tools included in this toolset to monitor,
and then view all SSIDs available near you, right.
So, in this case, I'm actually using the aerodump NG
command, and it's specifying WLAN zero which is actually
my interface, and in this example I'm actually using a
laptop with a NALFA external adaptor, and you learn
about these adapters in previous lessons as well, right.
So now as you can see here, you can view all the available
wireless SSIDs near you, and there you go.
You can see that actually corp-net is of course, present,
and is actually using WEP right.
So you want to remember a few things, the SSID of course
right, corp-net, also the BSSID hex number that I'm
highlighting right here, and the channel number,
and in this case the channel is channel 11, right.
Now that you have that information, let's actually launch
the aerodump again, but only to collect packets for that
BSSID and for that channel specifically.
So, for channel 11 specifically.
So, we're actually capturing all packets for channel 11,
and then we're also entering the hex number for the BSSID,
and specifying our wireless interface,
which in this case is W LAN zero.
Then, we use aircracking G to actually crack the WEP
preshared key, and now this is a command you actually need,
you know aircrack-ng-a, and then minus a specifies,
actually minus a one, rather specifies that we're actually
cracking WEP right, and you specify the target,
BSSID, and the capture file that we actually associate
it before, so the one we actually create before.
And in this case I capture, you know these few times,
so you actually, that's why you see the zero
four at the end of the file name.
Then you need anywhere between 20,000 to 60,000
initialization vectors to actually crack the web password
for any router right, now you can also use air replay
to actually spoof an associated station and then replay
the ARP frames and do you do this to actually increase
the data rate, right so if you want to be faster,
and collect more initialization vectors then you can use
the air replay to spoof an associated station,
and then of course replay the r-frames,
and increase the data rate.
So, this is actually what I'm doing here,
specifying the of course target BSSID,
the spoof station address, and also
the interface that we are actually using.
So, once you launch air crack and depending on how many
initialization vectors you actually have, you will then see
the WEP key, and there you go, that's the WEP
key for that wireless router and the corp- net SSID, right.
So this is actually how you crack in a few steps a WEP key.
So you can see it's actually a fairly insecure protocol
that you should avoid, and very easy to crack.
Now let's go over how to crack WPA, right.
So in this case you see that now I'm actually running the
corp-net using WPA preshared key or PSK, right.
Now, we use the aerodump NG just like we did before
to capture the WPA handshake, corresponding to a target
network, so again we wait until the WPA handshake appears
in the top line here, and then of course this is the
command that I'm actually using, the aerodump NG,
and then we write that to a file.
Very similar to what we did for a WEP.
Right, so we specified a channel,
we specified the BSSID and the interface.
Now if you do not see a handshake, you can also use
air replay to de-authenticate, so basically to kick out
an associated client or station, and this will force
a handshake to occur, and then of course you can actually
get that handshake to use aircrack NG to find the WPA
preshared key using a dictionary, right.
Now in my example here, the dictionary name that I'm
actually using is called words, right.
So that's the actually file name.
And then depending on your compute power again,
whether you use GPUs or you can use CPUs, right.
You can make it either faster or slower of course
depending on your environment, right.
So it can take either minutes or hours,
right depending on your environment.
Now in this example, I actually cheated a little bit,
right because I don't want to wait hours for it to
actually associate all of the different words,
and different phrases and everything.
So I actually put the preshared key within the first 1000
lines, but as you can see here, that you can see the WPA
key here for the corp-net, and it only took
you know not even a second right.
Now there's another tool that automates this process,
definitely in seconds, right.
So instead of actually you remembering all of these
commands, and doing all the capture files and everything,
it actually automates everything for you.
The tool is actually called Fern.
And you can see here it actually uses the aircrack
underlying framework as well, and it completely automates
you know all of the steps that we followed a moment ago.
So once we launch the attack, you can see that it actually
uses a dictionary, and in this case of course we're
using the same dictionary that we used before,
and then that it finds the key of the WPAs SSID corp-net,
and again you can actually automate these and brute force
more than one SSID, right so here I'm just concentrating,
and only scoping that SSID, and you can actually automate
every single SSID that actually exists, right.
Now there's actually a commercial version of this tool,
that has additional features, so you know there you go.
I mean, that's actually how you crack WEP and WPA keys,
in just a few steps right, again, some of these tools
can be fairly simple and fast, dependent on your processing
power, depending on your compute power, but you know
any type of computer, so in your laptop
you can actually launch these tools
and have fun cracking WPA and WEP passwords.