Now in this video I'd like to cover a configuration that might be used on the target router that could
make a crack in it a little bit different.
Now as we know WEP is very rare to see now anyway and this configuration is actually really really rare.
And most routers don't even supported it is a bit different to crack it though.
And usually people get confused when they see it and won't even know what to do.
But it's actually kind of easier to crack this type of configuration than the normal web configuration.
What I want to talk about is if the target router does not use open authentication.
So we've seen in all the previous videos the first step was to do a fake authentication attack.
We changed the oath and arrow don't ngi to open in this case the router can be configured to use a shared
key authentication.
So I have my router settings page here and you can see that I changed the setting here required and
what this basically does is it prevents anybody from even associate with the router if they don't know
the key.
So usually routers use open authentication which basically means anybody can associate with the router.
And then the router will check if you have the right password if you have the right key.
If you do they let you connect.
If you don't they won't let you to connect.
So they actually allow you to associate and they'll communicate with you if a shared key is used then
the router will not even allow you to associate unless you encrypt a challenge for it and send it to
it.
You won't even be able to associate with the router if you don't have this shared key.
Let me show you an example here.
So I'm just going to do first of all Aradigm engineman Zero to see all the networks around us
and you can see that I have this network which I configured for this class and it's called S-K a test
AP.
So it's right on channel 1 and I'm going to copy its MAC address and we're going to run aero dump and
G against this network only We're going to give the SS ID the channel
and we're going to store the data to our file and we'll call the file as a test and then I'm going to
put my wireless card in monitor mode which is Monsey.
So it's the same command that we've always been do and don't Bengie the B side.
SS idea of the target the channel and we're right in a file.
We're going to hit enter and this is going to run against our target only.
And now I'm just going to come in and do a fake authentication just to show you what happens in S-K
networks.
So we're going to do a fake authentication exactly like we did it before.
So it's going to be airplay N.G. fake Auth. and we're going to put zero and then we're going to do minus
a put the mac address of the router and then I'm going to do minus each and put my own MAC address which
is now i'm doing all this real quick because you should know all of this by now because we covered it
in previous lectures my own MAC address is ZERO ZERO ZERO see a 2 8 2 9 8.
Then we're going to put our wireless card in monitor mode which is more than zero.
So again same commando we always use for the fake authentication we're going to do play N-G fake of
zero target MAC address my MAC address.
I'm going to hit enter
so I'm going to Control-C this so you can see that we have S-K here under the auth instead of open.
And that means we can't really do all the attacks that we did previously.
The three methods the three injection methods that we spoke about previously the way to fake authenticate
yourself with S-K networks is you'll have to be authenticate one of the connected clients in here.
So you actually need.
You have to have a client connect to the network you're going to have to deal authenticated once you
do that.
Ngi will capture and.
You can see that I have a broken S-K here.
But if you do that properly you will get a normal Eskay and then you'll use that file with the minus
y option to fake authenticate yourself to associate with the network.
And then you can do all the attacks that we spoke about in the previous lectures the three methods.
The thing is that's a bit too complicated and there is two better methods to do that because as I said
if you want to associate and the target network uses as K.A. the network has to have a connected client
has to have at least one connected client.
So based on that fact there's actually better ways to crack that network and I'm going to show you the
first method right now and that is use in an AARP replay attack.
So let me close this first.
And I'm going to clear this and I'm actually going to stop this and clear it and run the attack again
because I want to show you that you actually don't even need to run a fake authentication for this.
So we're just going to name something else we're going to call it as a test to and we're going to launch
or don't punji.
And as you can see right here you don't have authentication or anything on this network right now.
And what I'm going to do is I'm going to do an hour peer or play attack.
So we spoke about that and we actually did it in a previous lecture.
The only difference is when we did it we did a fake authentication and we associated with the network
and then we use the replay attack based on our mac address so we would play packets from our computer
and injected them in the router and this lecture because we actually have a client when we did it in
previous lectures there was no clients connected.
So we had to associate our client showed up in here and then we use our client Mac address to replay
one of the ERP packets and we managed to increase the number of data rapidly that way.
What we're going to do today is because we already have a connected client.
We're going to use this connect to the client in our replay attack and this method will work against
both normal networks and against the network the web networks that use as a.
So this attack is going to be exactly the same as the RPO play attack that we did.
The difference is we're going to use the MAC address of a connected client instead of my own MAC address.
So the command is going to be air and you AARP or play then we're going to do minus Beith and we're
going to give it the MAC address of the target network then we're going to do minor stage.
And instead of giving it my own MAC address like we did in previous videos I'm going to use the MAC
address of one of the connected clients which is this one
then I'm going to put my wireless card in monitor mode which is my 0 and we're ready to go.
So again we're using airplay and we were doing an hour pure play attack exactly like we did before we're
specifying the target network after the minus bit.
And then we were specifying the MAC address of a connected client this time instead of specify in my
own MAC address so I'm going to hit enter and all this is going to do is it's going to wait for appropriate
packet and once it captures one of them it's going to injected into traffic more and when it's going
to do that it's actually relying on disconnected the client and it's injecting it as if this packet
is coming from this connected client.
And as you can see the number of data is increasing very very fast right now and I can just run our
ngi on the side and I should be able to crack the password.
So again I'm going to run this like we did before and we named the file S.K. test.
And we named it to and we have to append the minus zero 1 because the arrow dump.
Does that automatically and that's going to be a dot com but we're going to hit enter
now I'm going to stop this.
As you can see we managed to get the key.
Now we can use this we just remove these dots from it and connect to the target network and we'll be
able to connect to it.
So again this method works on both normal web networks and the ones that use shared key authentication
or Eskay.
The only thing that it requires is an existing connected client to the network.
So it's not a client list cracking method.