Now if WPX is disabled on your target network or if it's enable but configure to use push button or
P B C then the method that I showed you in the previous lecture will not work.
Therefore you will have to go and crack the actual WPA or WPA to encryption.
And like I said when these encryption's were designed the developers knew about the weaknesses in their
new epee and they made sure that they properly fix these weaknesses.
They actually did a pretty good job at this.
Therefore we can not use the same method used in the epee to crack their beaupré and WPA too.
So in WPA through the key is are unique.
They're temporary.
They're much longer than what they wear in the epee.
Therefore the packets sent in the air contained no information that is useful for us so it doesn't matter
even if we capture one million packets.
We can't use them to crack the key.
The money packets that contain useful information are the handshake packets.
These are four packets transferred between a client and the rafter.
When the client connects to the network.
So in this lecture I'm going to show you how to capture this packets.
And in the next lectures we'll see how to use them to crowd the WPA or a WPA to keep.
First of all as usual you had one Iran Iraq Dungey against all the networks around you.
I've already done that.
And as you can see this is my target right here.
It's use in WPA too.
And this is the MAC address.
I'm going to copy it.
And the first thing we'll do is just run air or dump energy on this network and study the data in a
file exactly the same way that we used to do it with their blue epee.
So we're just going to do error dump energy dash dash B s s idea and give it the BSA idea of my target
dash dash Channel.
And give it the channel of my target which is one.
That that's right to specify a file name to store all the data that were going to capture em.
And let's call this WP a handshake.
Because we're going to capture the handshake.
And finally we're going to give it my wife said that after in monitoring mode which is morning zero.
So very simple command.
We've done this multiple times now.
We use an error on energy were it given the MAC address of my tarrega it after the B.S. aside the UM
given it dash dash channel to specify the channel of my target and use in dash dash right to store all
the data.
File this file contains everything that we capture so we captured how Chegg it'll be in this file.
And finally I'm giving it the name of my wireless adapter in waiter mode.
So now I'm going to hit enter.
And as you can see error Energy is working against my Target's network.
Right now all we have to do is literally sit down and wait for the handshake to be captured.
Like I said the handshake is sent when a client connects to the network.
So we literally have to sit down and wait until a new client connected the network wants a new client
connects we will capture the handshake and you will see in here is a them telling us that the handshake
has been captured.
Tentatively we can use something that we learned before which is the authentication attack we know we
use in that attack we can disconnect the client from the network so we can do this for a very short
period of time.
We can disconnect this client from the network.
He will automatically Kinect.
Once we stop the attack.
Therefore when he automatically connects the handshake will be sent in the air and we will be able to
capture it.
This way we will not have to sit down and wait for someone to voluntarily connect to the network.
So we see now to do this before is this going to be exactly the same command as we did it before.
Were you in a play and you.
We did that.
They actually are.
Then we specified a really low number of packets to keep the client disconnected for a long period of
time.
This time I'm going to send this to for two of you send Florida authentication packets.
This way my client will be disconnected for a very short period of time.
They won't even feel that they got this connected.
But this is enough for the handshake to be sent because they will be disconnected.
They will automatically connect and when they do that we will capture the handshake.
Now the next argument we want to set is the MAC address of my target.
So we're going to do a dash a followed by the MAC address of my target.
Then were going to do dashi followed by the MAC address of the client that we want to disconnect.
So as this client right here I'm going to copy.
Pasted here.
And finally we are going to give it the name of my wireless adapter in I you to.
Mode which is more than zero.
And we are done again.
I've spent a full lecture on this command.
Explain what a authentication attack is.
So it's a bit confusing.
Please go back.
Why's that lecture.
Basically all we're doing is where are you as an aeroplane and you two are on the authentication at
work to disconnect this device for a very short period of time.
That's why I'm setting this too ONDI number four then I'm using dash 8 to specify the MAC address of
my target.
I see specified the MAC address of the client connected to this network and then given it my wireless
adapter in monitor mode.
Now I'm going to hit enter and keep an eye on this side right here.
You'll see the high check will be captured in here.
So go ahead and tell the authentication packets being scanned and perfect as you can see you wants the
client connected.
Again we receive the handshake.
So now we can quit.
Ere are done and you.
So controller see you because we have the handshake now.
It is in the file that we set after the right option which is called WPA a handshake and the next lecture.
I'll show you how this had she can be used to get the key for the network.