Capturing Handshakes
To begin, we’ll use the hostapd-mana command,
providing the Mostar-mana.conf file as an argument.
Devices will connect to the device with the strongest signal.
If the signal of our rogue AP is stronger than the signal of the target,
the device will attempt to connect to our rogue AP.
Since the connection will fail (due the PSK mismatch),
clients may attempt to connect multiple times.
However, we should be able to capture the handshake.
Exellent! We captured a handshake.
We might not always be this lucky.
Some devices might hang on to a weak connection to the target AP.
In these situations,
we can “nudge” the stubborn clients in the right direction
by deauthenticating all clients from the target AP.
To accomplish this, we would use another wireless interface
and use aireplay-ng to send deauth messages.
To deauthenticate clients, we’ll connect a new wireless card
and start monitor mode on channel 1 with airmon-ng.
The channel should be set to “1” to match our target AP.
Next, we can use aireplay-ng to run a deauthentication attack.
We will run this continuously with “0”,
and use “-0” to deauthenticate all clients,
that connect to our target AP.
At this point, clients connected to the target AP should begin disconnecting
and begin searching for a new AP.
If the clients discover that our rogue AP
has a stronger signal, they'll attempt to connect
and we'll capture the WPA handshake.
The captured handshakes are written to an HCC APX file.
This format is primarily meant to be used with Hashcat,
but we can also use aircrack-ng to crack the handshake.
To do this, we’ll use -e to specify our ESSID.
We’ll use the default John the Ripper wordlist.
Very Nice!
We cracked the handshake
and discovered the PSK,
which is “teddybear”.