All right, so a rogue access point is a wireless access point that's been installed on a secure network,
but without explicit authorization from a local network administrator, whether added by a well-meaning
employee or perhaps even a malicious attacker.
So attackers can persuade clients to connect back to your attack system instead of attacking apps or
trying to recover weap or.
So this is where rogue access points come into play.
So if an attacker installs an access point, they are able to run various types of vulnerability scanners
and then rather than having to be physically inside the organization, they can just attack remotely.
So we'll see how rogue access point attacks work using different tools such as air base energy and Wi-Fi
pumpkin and.
Kamata sport is also a great function within Métis boy.
Allowing you to fake access points, but instead of that right now, I'm going to show you some newer
tools such as flexion and Wi-Fi pumpkin developed for Roeg access points.
Airbase energy, of course, is not new.
It was developed way back in 2008, but it's still a powerful tool that's been added to some of the
new tools.
Eric Horng is a multipurpose tool designed to attack clients as opposed to attacking the access point
itself.
It also acts as an ad hoc or full access point.
It has an ability to filter buyside or client Mac addresses.
You can manipulate and resend packet.
You can also capture the WPA, WPA to handshake.
It also has an ability to encrypt sent packets and then decrypt received packets.
But I'll tell you that the main purpose of the air base energy tool is to encourage wireless clients
to associate with a fake AP and then prevent them from accessing legitimate ones.
Airbase engie can easily spoil real nearby access points, so it's necessary to use filters so that
you can minimize its impact.
Sorry, go ahead and create a Web access point, Airbus Engie.
Go to Kalli.
Open in terminal screen and switch user to route with pseudo asou dash.
Check the mode of your wireless adapters interface.
OK, so it's in monitor mode.
And let's use the arrow dump energy to capture packet's and find access points.
Arrow dumping will display a list of detected access points and also a list of connected clients.
So we'll run the arrow dump in GW Land Zero man.
All right, so I connect to Hacker Academy.
Now we can learn important information about the access point in this list, such as channel encryption
type Mac address.
Now, there's also a list that shows connected clients to access points.
And now that we know the channel number, we can create a fake access point with air base and on the
same channel.
So we'll use the C parameter to give the channel number, the E parameter to give an SCD with the same
name as the access point.
Yes, parameter is used to force shared key authentication.
Uppercase W. is used to set the Web flag in Beacon's.
And then at the end of this command, we should add the wireless interface.
All right, so now fake access point was created with his Mac address.
So copy the blessed.
Open a new terminal and run aero dumping to see only the information about this access point.
I'll give the channel and the both sides of the access point.
And as you can see, the encryption type of the fake access point is weap, and it is on Channel 11
and of course, right now there are no data packets because there's no connected client to this access
point.
But it is propagating beacon signals, you can see it's associated with Web encryption on the other
devices.
So when a client attempts to connect to the fake access point, you can see the logs on the screen.
Now, we didn't set a Web key and we don't know the shared key right now, so we could not authenticate
to this particular access point.
Therefore, there are broken shared key authentication errors in a log.
Right.
Now, in a Web cracking section, I'll set the Web key with the lowercase W. parameter to show you how
to crack the Web key.
So right now, let's look at the arrow dump energy screen.
And although we could not authenticate with the fake access point, we can certainly see the Mac address
of the device in this list when it attempts to authenticate.