- One of the most often tools
for attacking wireless networks
is a suite of tools called aircrack-ng.
It comes with many, many applications
for interacting with wireless networks.
I've highlighted two here in red, aircrack and airodump.
Aircrack for cracking and airodump for capturing frames.
These are often used to capture the initial frames.
Like, if you're trying to crack WPA,
you wanna see that message integrity check,
the MIC message.
You're dumping the frames.
If you wanna do it entirely passively,
airodump pointed at the interface.
Capture, capture, capture until you see that MIC.
You can stop your capture, run aircrack,
try to get the pre-shared key.
I have an example of this coming up.
Finding SSIDs to attack airmon-ng start
and then the interface name in this case, wlan0.
You'll see a screen that looks similar to this.
This is an old screenshot from backtrack.
Still looks the same, just, you know
run it on Colleen's Desk.
A MAC spoofing attack,
we've talked about this in previous lessons.
Listen to the air, find a MAC address,
change your MAC address and try to have the same access.
A Deauthetication attack, this is attacking
that availability in the CIA triad.
With a deauth attack, we are going to start monitoring
or turn on monitor mode on our network interface card,
look for an SSID, wait for a client to connect
and then send our deauth message with aireplay.
So, we walked through this example on our previous lesson.
We're gonna send deauthentication attack.
Here's our access point, SSID
and the client we're going to deauthenticate.
We can also do the Evil Twin Attack.
Recall from our previous lesson,
with the evil twin attack
we are going to impersonate
an existing wireless network.
Maybe at a coffee shop.
This can be done with a wireless card on the laptop itself.
It can be done with this suite of tools as well.
Start monitor mode.
Look for the SSID that you want to mimic,
create a soft access point.
Soft access point is, you know, the opposite
of a hardware access point.
It is an access point that is running based
on software coming off a laptop.
So, here we're running airbase-ng.
Here's the SSID that we wanna broadcast,
the channel we wanna use.
Deauth the client and hope that they reconnect
to our evil twin.
If we're sitting closer to the person,
there's a good chance that their computer
is going to connect to you instead
of the actual valid access point.
And you can modify your transmit power
so that you can win over that valid access point.
Wait for the client to join your network
and then do your machine in the middle attacks
'cause you will see the data post Wi-Fi at that point.
Rogue Access Point.
We also discussed this method in the previous lesson.
If you can get into the environment
and have access to a physical port,
whether that's actually in an IDF
or under someone's desk that is connected
to the wired ethernet network, plug in your access point
and then connect to it from somewhere
outside the building provided the signal will make it.
For cracking WEP, as I mentioned,
you do still see WEP networks out there
and they are easily compromisable.
Simply start monitor mode.
Look for the SSID,
find something running WEP.
Capture the packets, capture about 10,000 of 'em
and then try to crack it with aircrack.
Here's a fast way to do it.
You're still gonna do the monitor mode,
pick target network, inject some frames into that network
to cause that initialization vector collision.
Once you see that IV collision,
here's our injection, capturing packets then crack it.
For WPA pre-shared key cracking, this is also possible
but you need to capture that message integrity check.
As a client associates, the MIC flows across.
You need to capture that.
Here we start monitor mode,
find our target BSSID, capture packets, send our deauth
and then we look for the captured handshake,
that MIC message and run it against a wordlist
in this example.
Here is a screenshot of actually doing that.
So, we see we're trying 10 million.
This is a dictionary file
with 10 million potential passphrases in it.
And it's doing it on one by one,
and it is comparing it to the MIC
to try to find the passphrase for this network.
And here is the successful compromisation.
Is that a word? (chuckles)
So, we know that the passphrase
for this particular network is, this is a secret key.
I also wanna point out some purpose-built hardware
for auditing Wi-Fi networks.
This particular device
from an organization called Hak5.
They sell this hardware device called Wi-Fi Pineapple.
You can see what it looks like here.
And it does have a nice interface
for interacting with the device,
and it is cloud configurable.
So, you could deploy these worldwide
provided they can get internet access.
Then you could configure them all from your web browser.
Also, Kismet. This is a tool that's been around
for a long time, runs on Linux.
You can get to it at kismetwireless.net.
Wardriving, sniffing, it does a lot of cool stuff.
Also has a framework
for wireless intrusion detection built in.
And CowPatty. CowPatty, similar to aircrack,
it will do offline dictionary attacks on pre-shared keys.
In this screenshot here,
it's the same capture file from the previous example.
And we see here, the pre-shared key.
This is a secret key and we're running it against
a plain text file of 10 million possible passwords.
Now, in all truth to be transparent,
I may or may not have modified
this password file to include, this is a secret key.
Right around 560,000 lines down.
So, I wanted to see how long it took.
So, this one, I put it at 1000.
In the previous one that took about five minutes to run,
I had it right in the middle of the file.