Discovery
While some clients will connect to our rogue AP
based solely on the matching SSID,
our attack is more likely to succeed if we match the encryption details as well.
To accomplish this, we need to conduct reconnaissance
against the target to gather information.
We’ll use airodump-ng to gather information about our target.
To begin, let’s put our wlan0 interface into monitor mode with airmon-ng.
This creates a wlan0mon interface.
Next, we'll configure airodump-ng to write the captured information to a file
with -w to set the dump file prefix,
and output-format to set the output format to Pcap.
The output file will be saved as discovery-01.cap.
We'll target the AP with the “Mostar” SSID.
The airodump-ng output shows us Mostar is a WPA2-PSK network with CCMP.
The output also reveals that Mostar is running at 130 Mbit.
Finally, we notice that Mostar is running on channel 1.
Note that we are using a 2.4 GHz card to discover this information.
Based on this information,
we can deduce that the Mostar network is most likely 802.11n.
When we create our rogue AP,
we should match these settings as closely as possible
to ensure that clients automatically connect to our rogue AP
based on their Preferred Network List.
We shouldn’t solely trust the output of airodump-ng
since it only shows the strongest possible encryption level.
For example, if the Mostar target network also supports WPA1,
that information will not be displayed.
To get more information, let’s open the Pcap output in Wireshark.
To find the beacon for the target AP,
we can use a filter to limit the types of packets displayed.
First, let’s set a filter to display beacon packets.
Management frames use type “0”, and beacon frames use a subtype of “8”.
Let’s also append the Mostar SSID to our filter.
When we select the frame,
we notice the detailed information about the beacon
in the Vendor Specific tag below the list of frames.
The Vendor Specific tag tells us that this AP supports WPA1,
and the existence of RSN Information tells us that it also supports WPA2.
Expanding these trees also shows that Mostar is configured with
TKIP for Multicast,
and both TKIP and CCMP for Unicast/Pairwise.
In addition, we can confirm that the Mostar network
does indeed authenticate with a PSK
based on the Auth Key Management configuration.
At this point we have gathered the following information about our target AP:
We have discovered the ESSID, BSSID, authentication type and channel.
Based on this, let’s create the rogue AP and begin capturing WPA2 handshakes.