When it comes to pen testing wireless networks especially WPA to personal.
It might surprise you initially how fast you can actually attack and have access to a network.
If there is a poor password in place so this whole handshake capture process that we're going to do
relies on this poor password.
If there's poor passwords we're gonna get in all day.
So let's go ahead and just start with this.
First things first.
We've plugged in our wireless card and when you need to actually set it up here.
So just go ahead and go to player and you should have removable devices just come down here and we're
going to go ahead and just say connect.
So here's my my device.
I'm going to say connect to host say OK.
And that should get you connected.
So the way to check that is willing to go into a terminal and we're just going to type in Iaw config
just like I f config for the W stands for wireless.
Now we see here that w land zero exists and we're going to go ahead and start with our attack.
So the first thing we need to do to do this is we need to place our card into what's called monitor
mode.
So what monitor mode does is allows our wireless card to perform monitoring of all the incoming traffic.
And that's going to allow us to eavesdrop you know listen in and hopefully gather that handshake that
we're after.
So what we're going to do here is first we're going to use a tool called airman N G and we're going
to type in check kill check kill is going to allow us to check for any processes that are running and
you see one was running and it's gonna kill those processes that interfere with what we're about to
try to do.
Now that that process is out of the way or possible multiple processes we're going to go ahead and run
this again and we're gonna say start and we're going to say w land zero like that and you should see
it start up your monitor mode on your interface.
So takes just a second and you can see it says monitor mode enabled station mode disable so now and
from W land zero to w land zero Mohn meaning monitor and we can confirm that with I w config and you
can see now that w land zero mine is now active so we need to find the wireless network we want to attack
and this is typically given to us by a client we'll give you the SS I.D. so that you know what's in
scope and what you want to attack.
So we're just going to search the area around us and see what's there and where the network that we
want to specifically attack is and we use a tool called Arrow jump it's all in the same suite here and
we're just gonna say w land zero mine so we come in here and you can see all of the devices around us
start to populate let me make this bigger here so we can see everything and you can see that if we look
through here we have the following.
We have our we have our access point B SSI D which is just the MAC address of the access point we have
the power level here which the lower the number here the lower the negative number the closer we are
to that device.
So negative 11 is really close to us.
My my wireless card is actually sitting on top of the router that we're attacking on the access point
we're attacking and we also see if we're getting any beacons or data back from this which this is not
connected to the Internet there's not a lot of traffic going on right now so I'm not expecting to see
anything happening just a little bit of data if anything coming through.
There is one user attached to this as we talked about in the last video so we're going to generate a
little bit of traffic on our own since nothing's happening at the moment.
So we've got the we've got the T.P. link here.
This is the one we want to attack.
And we also see the channel which we're on channel 6.
If you don't know anything about wireless channels you should definitely read up on them.
Wireless channels being I think 1 through 14.
But the big ones are 1 6 and 11 as they don't have any overlap.
And I think two point four gigahertz at least for five gigahertz it might be a little bit different.
So here we have that we have the type here we have wpa 2 and they're all pretty shared keys which is
pretty expected for a residential area and then you might even see I saw an open network come through
as well.
And then it even tries to pull in some some guest networks or some networks that are.
So here's like a guest network.
It also tries to pull in networks that are hidden so you might see like this length of twenty one and
it may actually be a hidden network that people don't know about.
But just because you have a hidden network out there doesn't mean that it's actually hidden.
It just takes a little bit of patients like this just to wait around and to find it someone who controls
see and stop this process.
And now we've identified the T.P. link and we've identified some information that we need.
So what we're after here is we need to narrow this down.
Now we found the channel we're going to narrow it down just a little bit.
So we're gonna run arrow dump again and this time we're gonna say dash see for the access point channel
which we are on Channel 6 and we're going to say dashed Ashby SS I.D. And we're going to capture the
MAC address here of the access point.
Go ahead and paste that in.
And lastly we need to specify a file name for where we're gonna be capturing this.
I'm going to call this captured.
And we need to specify our interface which is w land zero mine.
And this is going to take this trigger this specific or capture information on this specific device
and it's going to store it in this capture file someone hit enter.
You should see items coming through and you should see the workstation that I have attached here.
I have one workstation and what we can see if you were testing an actual network you would see a bunch
of different workstations here.
And what we're waiting on now is we're capturing data.
You see a little bit of data coming through and we're waiting to capture enough data or capture this
handshake that comes through and you'll see it come up and we'll be right here.
I'll say handshake captured we're trying to get that four way handshake.
Well we can speed this process along with what is called a d off attack or a D authorization attack.
What that means is we're going to temporarily disassociate a client with a wireless network.
We're going to kick somebody off the wireless is what it boils down to.
And what that does is when the client re associates this handshake is passed out and that's the handshake
that we're looking to capture.
So we're gonna go ahead and open up a new terminal and I'm going to show you how to kind of speed this
process along.
Now you might need to do off a different user so you might have to pick your users and I've I've had
times where I've been dropping and nothing's happening.
And you just kind of have to wait for the right person or somebody to be close to you.
I was in a parking lot once and I ended up cap capturing a handshake waiting on somebody getting out
their car.
I found somebody pop up as they got to the car they associated with the network and I was able to drop
them and get what I needed.
So this little d off attack is nice but you have to kind of be patient with it sometimes.
Although this one should work for us.
So we're gonna do is we're gonna run this d off attack with a tool called Air replay and we're gonna
say a dash zero and that just means d off we're gonna specify one which means we're just gonna run this
one time and we're gonna say a dash a we're gonna paste in this mac address of the AP so you should
already have that copied and just pasted in there we also need to specify the client we're attacking
so we're attacking the station right here so go ahead and capture the station.
Might you grab it the other way.
Might even need to type it in.
It should be capital area.
So here we go.
Paste it here and then we see the type in the interface one more time which is w land zero Mond.
And I want you to kind of just watch this.
So let's see if it pops up.
We're going around this attack just hit enter.
That should send a bunch of dots.
You can see all the beacons coming through here in the data and then the handshake.
There it is.
We got it.
OK.
So I'm going to admit a little bit of video magic editing.
This was not the first time that I had to run this deep attack.
And so the screen might look a little bit different because I had around this a couple times but the
process is here.
You might have to run this off as as I've mentioned not just against a one time one person but you might
have to find another client or another one.
But if you're patient enough you can get this now.
Another thing to mention too is you don't want to keep doffing the same client over and over and over
because you are kicking them off the internet just for a short second of time.
So they just have to disconnect and reconnect and it's it's really quick but you don't want to keep
denying service to a specific user because that could cause issues in the environment right.
So you want to make sure that you kind of just pick and choose your battles and your patient with this.
And if you sit around enough and you capture enough data eventually you will get the WPA handshake without
having to D.R..
But you're in a timed assessment most of the time and you have to actually you know speed this along
a little bit.
So we've got the we've got the handshake.
Let's go ahead and take control see and I have a couple probably a few different captcha files because
I had to run this a couple of times.
So let's just look at what's what's here.
I've got capture one and captured two.
So let's go ahead and take a look at this capture file here this dot cap.
Now we're going to use that dot cap file to actually attempt to crack this handshake.
And I've gone ahead and I just went out.
Let me show you here.
I just made a word list and I just called it wordless and what I did was I took just one hundred bad
passwords and just threw the password in here as part of it.
So you could do the same thing.
You can just go ahead and you know if you know your a password then go ahead just throw it in the word
This is just proof of concept in a real world situation you would you would take this and you would
try to crack this with either what I'm about to show you or you can use hash to practice as well.
There's a lot of different methods you can use and you'll just try to see if you can't pull down this
this password with a nice worthless.
So from here we're going to run a tool called Air crack and we're going to specify the word list which
I just called Mind wordless and then a dash B for the AP Mac address which we have right here all right.
And then we also have the capture file which for me is capture 0 2.
Cab let's go ahead and hit enter on that and you could see it found the passphrase really fast.
I had one hundred one words in there but it took just it took less than the second.
Right.
So this is my default password for my router if I would have left this on my router.
Hands down.
This one is pretty easy to pop.
We run all sequences of numbers because phone numbers are very very common for businesses to use and
people to use.
We also if you're attacking company it's always good to try to use their name in some way or another
and try to you know substitute for example an eye for a one or one for an eye 0 4 and 0 kind of deal
and you'll be surprised how easy you get in street address.
Same thing.
A lot of companies just use what's familiar to them.
You could go on their Web site and pull down word list and kind of attack that way too.
Those are a bunch of different strategies that you have available to you.
But this is the process.
So one more time just mentally talking through it.
We have a wireless card.
We've placed it into monitor mode.
We went ahead and discovered the wireless network that we wanted to attack and then we specified it
specifically choosing the channel the SS I.D. or the mac address.
Right.
And we set a capture file on this interface.
We were looking at it here and this is what that looked like.
Right.
We came through here and we said OK well here's the associated user and we're going go ahead just kick
that user off so we can grab this handshake grab the handshake took it cracked it.
We're in the network.
It's it's just as easy as that.
WPA 2 is a very insecure protocol.
If you are unsecured protocol if you are using weak passwords it's easy money.
So that is it for this video that is it for this subsection.
So we're gonna move on to the next subsection which is going to be talking about legal documentation
and report writing.
So I'll catch you over there.