- When it comes to footprinting wireless networks, you know
just listening to the air and, and seeing what's out there,
what we could connect to.
We have two different ways to do this.
We have passive methods
and active methods. With passive methods
we're simply going to listen to the air.
So we put our wireless network interface card
into monitor mode
and we start listening for those wireless beacons.
And we can gather a lot of information from just beacons.
And then we have active methods where we're going to
actually probe with an empty SSID
to try to see what's out there.
Several tools we can use for this.
Most often, you're going to see it done
with software on a laptop
with hopefully an external antenna that has some gain
so that we can capture wireless networks that are
a little bit further away.
Some common tools used for finding these wireless networks.
We have airodump-ng as part of the aircrack-ng suite.
We have this URL here to get more information
about the aircrack-ng suite. This is built into Kali Linux.
So you just, provided you have a wireless adapter
that will work with Kali Linux.
Then you can run the aircrack-ng suite.
Most of them will. The reason I mention that specific point,
so let me go off on a little tangent here.
So a lot of times you'll see someone
on a laptop running Kali in a virtual machine,
like virtual box, VMware or whatever the case may be.
And then they will use a purpose built USB-connected
wifi adapter that is connected to the virtual machine
that allows them to maintain wireless internet access
from the laptop.
And then the virtual machine is using this USB-connected
wifi adapter in order to run the aircrack suite of tools.
That's what I commonly do in order to run these tools.
We also have MetaGeek Complete.
This is a commercial offering that will analyze channels,
display SSIDs, et cetera.
We also have Vistumbler, V-I-stumbler.
It will provide you with SSIDs,
as well it can take GPS latitude, longitude input.
So you run the software,
connect a GPS receiver to your laptop, as well as a--
the wireless interface grabbing this information
and we can tie SSIDs to physical locations.
Now, most of us are walking around
with some sort of wifi-enabled device in our pocket.
We have this application, NetSpot for both iOS and Android
that will listen to the air
and show you interesting piece of information
the signal strength, that's the height,
as well as the channel that the particular SSIDs are on.
Wigle is a service that's been around for a long time.
It's crowdsourced, war driving database.
So you run this app on your phone.
That information is passively listening in the background.
That information is then uploaded to wigle.net
and plotted out on a map. Here, we see San Francisco.
So it will gather those SSIDs along with location
gathered from your phone
and upload that information to Wigle.
When we are capturing this information,
what sort of information can we glean from this,
from this data? We get names of networks.
And most often you're going to see a name associated
with a business name.
If you have grocery store and you see grocery store SSID,
it's a, it's a safe bet that that SSID
belongs to that grocery store.
We can learn encryption protocols, authentication methods,
as well, we can know if they are doing multiple APs
on the same SSID and using that BSSID concept in order to
distribute a single SSID across a wired network.
The OmniPeek tool can be used to analyze wireless traffic.
And what we're talking about here is actually
capturing the wifi frames themselves,
not the data in the frame,
but the frame which contains the data.
So OmniPeek from live action is available to do that.
And then off the shelf non-commercial, we have Wireshark.
Wireshark can capture frames,
show you 802.11.
Here, we see a bunch of beacon frames
that are being captured by a wireless interface,
connected to Wireshark.