OK now that we know what the bleep piece is and how it can be used to recover the password for a WPA
and WPA to networks.
Let's see how to do that in practice so right here I have my Kelly machine.
I have already enabled monitor mode on my wireless adapter on 1 0.
Now usually we use Arrow Energy to see all the networks around us but right now we want to see the networks
that have WP enabled but because like I said it's just a feature and people can turn this feature off.
So first of all I'm going to use a tool called wash to display all the networks around me that have
WPA enabled.
So we're gonna do a wash dash dash interface and give it my interface in monitor mode which is more
mode zero.
So all we're doing is wash is the name of the tool interface to give it the interface and more zero
is my wireless adapter in monitor mode.
If I hit enter now you'll see it'll list my network straight away.
Now I press control city council this similar to aero dump engine because it'll keep running unless
you cancel it and you can see this is my target network.
It's called Test AP.
It's given us the vendor of the hardware used in this network in this access point the LC case.
Tell us whether WP is locked or not.
Because sometimes WP slogs after a number of failed attempts.
So right now this is no which means that we can actually go ahead and try to guess the pin.
It's given us the version of WP as it's used in version 1.
The signal strength is in here the channel and the society.
Now I explain the meaning of all of these things before and why I wrote them.
And Judy lecture.
So I'm not going to talk about them now if you forgot the meaning of any of these terms please go back
to the aero dump and G lecture now this network actually uses WPA too.
So just to confirm this to you if I go here to my host machine and just try to connect to it you'll
see that it's telling me that this uses a WPA to password but like I said we don't care if it's WPA
or WPA 2 because we're going to be exploiting a feature in these encryption which is the WPA feature.
So now that we know our target network uses WP as there is a good chance that this attack will work
against it.
The only reason it might fail is if the target uses PPC or push button authentication.
Like I said if the target uses PPC then it will refuse all the pins unless the button is pressed on
the router.
And therefore this attack will fail.
The only way to know is to literally tried this attack and see if it works.
So I'm going to copy the MAC address of this network or the B.S. society on the first thing that I'm
going to do similar to what we did with the blue E.P..
I'm going to associate with the target network using a fake authentication attack.
So basically I'll be saying I want to communicate with you.
Please don't ignore me.
So that when I run the attack the network will start accepting the pins and not ignore me.
So to associate we're going to use the exact same command that we used when we did it with the blue
chip.
So we're going to use a replay energy.
We're going to tell it.
I want to run a fake authentication attack.
We're going to give it a delay.
So this is the time to wait between association attempts previously reset it to zero and we had to do
this manually every now and then.
Right now I'm going to set it to 30 so that we associate with the target network every 30 seconds then
I'm going to do a dash 8 to give it the MAC address of my target and dash Hage to give it the MAC address
of my wireless adapter in monitor mode and we see that we can get this by doing if config and copy it
from here we said it's the first 12 digits and I'll just replace the miners with the coal on.
And finally I'm going to give it the name of my wireless adapter in monitor mode which is Monza 0 so
I explained this in details before.
That's why I did it quickly.
If you don't remember how I did this.
Please go back to the fake authentication attack lecture so the command is ready now but I'm not going
to execute it.
I'm gonna go down to the bottom terminal and run River which is the program that will brute force the
pin for me and only then I will associate with the target because otherwise a replay energy will fail
to associate with my network.
So I'm going to move to this terminal right here.
I'm going to clear the screen and we're going to run River which is the program that's going to brute
force the pin.
So it's going to try every possible pin until I get the right pin.
Once it has the right pin it will use it to compute the actual WPA key.
So using river is very very simple it's very similar to everything we've been doing so far.
So first of all we have to type the program name which is River then I'm going to do a dash dash B SSI
D to give it the MAC address of my target network.
So I'm just gonna paste it then I'm going to do a dash dash channel and give it the channel of the target
network which is one then we're gonna do dash dash interface and give it my wireless adapter in monitor
mode which is more in zero so very very simple command.
We're using reverse.
This is the name of the program that will do the brute forcing for us and give us the key.
We're giving it the OBSS idea the MAC address of my target.
We're doing dash dash channel to give it the channel.
That's my target is running on and we're doing dash dash interface to give it the name of my wireless
adapter in monitor mode.
I'm also going to add two more options.
I'm going to add dash v v v to show us as much information as possible.
This is really helpful.
If it fails or things go wrong we'll be able to know what's happening why things are going wrong.
And I'm also going to do a dash dash no associate to tell river not to associate with the target network
because we're already manually doing that in here.
So River can automatically do this tap right here for you.
But I've seen that it fills a lot.
Therefore it's actually better to do it ourselves manually here and then tell the river not to associate.
So now I'm going to hit enter to get the river to work and I'm going to go up to the top terminal and
I'm going to hit enter to associate with the target network tell on it please don't ignore us.
So that river at the bottom here can brute force the pin and try every possible pin until we get the
correct PIN which will use to get the password.
Now as you can see right now I'm getting an error and this is actually a bug with the latest versions
of river.
So if you get this bug this means they still haven't fixed it in the latest version so it's better to
go back and use an older version.
I'm going to include an older version that works perfectly in the resources of this lecture so you can
access it from the top left of the lecture if you tried the river and got this error right here then
go ahead and download this older version right now.
I already have it in my downloads right here so you can see I mean home downloads and I have a right
here called River.
So what I'm gonna do is I'm going to clear this again and I'm going to navigate to my downloads so C.D.
downloads.
I'm going to list and you can see we have it right here now.
It's already in green for me but for you you'd want to change the permissions of this file to an executable.
So you'll have to do.
Mod plus X river.
This will make it an executable once it is an executable.
You can run it by doing dot forward slash followed by its name.
So river then you can do the exact same command.
Exactly.
Like I just did it with the one that comes pre installed in Cali.
So I'm actually just gonna go back to what I had and I'm just gonna go to the start of the command and
put dot forward slash.
So when we put the DOT forward slash we're basically running the file that is in the current working
directory.
We're running this.
We're not running the normal river file that is pre installed in Cali.
Then we're using all of the options exactly the same way that we were using it with the built in one.
I'm gonna hit enter and as you can see right now river is trying the pin.
One two three four five six seven aren't perfect.
You can see the pin was actually one two three four five six seven zero.
So it's a simple pin.
It actually came with this pin.
So I did it manually set this pin my Rafter came from the factory with WPA enabled with this pin.
So like I said this still works but again not against all the rafters from that it was able to discover
the WPA key which is you a you are w as X R and the name of the router is test AP so I can literally
go ahead and connect with this password and I'll be able to connect to the network and see and decrypt
all of the packets sent in the air.