The handshake supertech attempts to retrieve two authentication hashes, which is otherwise known as
a four way handshake, and then we can use that later by the captive portal attack for key verification.
So the captive portal attack will require the handshake cap file from the target access point, we do
not have the cap file, so we must first complete the handshake snooper attack.
All right.
So let's go.
Go to Calli, open the terminal screen.
And we can see the status of the adapter with the A.W. config command, so its mode is managed for now
so we can enable monitor mode.
I hope you've already done it right.
Just enable with Chairman Engie, OK, and monitor mode.
And we'll change a direct reflection, so execute the Basche file to run fluxing.
And select a handshake snooper attack.
Now select the channel of the access point that we want to create a fake access point for, so if you
don't know the channel, then select three.
It will list all the access points for channels between two and a half gigahertz and a five gigahertz
bandwidth.
My access point is on Channel 11.
So if your target access point appears on this screen, just close the scanner with key command control,
see?
And are the number of the target access point.
OK, so now we can select a wireless interface w land zero.
And again, we'll select the same interface for our fake access point.
Now, to force the client to reconnect to the access point flexion while perform a deep authentication
attack, it's a passive method of attack and it forces the radiator to go completely silent, making
the attack undetectable and then allows for better listening.
So this method should work best in situations where the target is pretty far away.
So an aggressive method of attack uses a de authenticator, either Airplay Engie or MDK and sends the
authentication package to the target access points clients.
So this method is cutting the connection between the client and the access point.
Then once the connection has been broken, some devices will automatically attempt to reconnect, sending
a four way handshake which elections radio could catch.
Now, this method really.
Legal disclaimer, this method really could be considered illegal, so I want you to make sure that
you're following whatever governing laws apply to you.
You need to be aware of all of that.
We are not liable for your irresponsibility.
So that being said, I am attacking my own access point for educational purposes.
So I'll just select airplay and G as a D authenticator.
So now we need to select a hash verifier and it'll be used when a valid hash is captured.
So I select the recommended tool, which is Kalbarri.
And I'll just select 60 seconds for this, you can always select the recommended option.
So it sets how verification occurs in relation to capturing data either simultaneously asynchronously
or back to back synchronously.
And I will select synchronously.
All right, so finally, the attack has started, so there are three screens.
In the upper left strain, the handshake will be captured.
In the lower left corner, there are a lot of messages about the activities performed by flexion in
the background.
And in lower right corner, Interplaying performs a deal authentication attacks to force her clients
to reconnect to the access point.
Now, yeah, at this stage, we have to be a little patient until the handshake gets quiet.
The client connected to the access point right now.
OK, great, so the handshake snooper attack is now complete.
Looks like fluxing the court invalid hash and saved it to fluxes database.