[MUSIC PLAYING]
This lab might seem a little advanced
compared to what we've been doing, and it is.
We're going to cover some things in here that
haven't been taught.
And what I want you to take away from this lab
is what you can do with Wireshark,
what you can do by capturing network traffic, what you can
do by sniffing on a network.
So we have some commands there in the description.
I'm going to walk you through how
we can answer some of these questions
by plugging in these filters and looking at the data.
Follow along on your own.
You have the instructions, as well.
Practice it once.
But we are going to have a whole pathway dedicated to Wi-Fi, pen
testing, and Wi-Fi security.
So we will get into the nitty-gritty there.
Here, I'm going to cover some things
so we can get through this lab so you
can get a feeling for what it is we can do.
OK?
With that, let's jump into the environment.
And we have a pcap of Wi-Fi traffic in Wireshark.
And it looks very similar to what we had before.
I didn't set up my columns or my time.
We'll leave that as-is.
That's not the focus today.
But we have a whole bunch of information here.
And you can see, for the protocol, it's 802.11.
So it's all Wi-Fi.
And if you go into your Protocol Hierarchy,
you're going to see it's all 802.11.
That's what we captured here.
There's some data and we'll get into that.
But let's start answering some questions.
So what is the name of the open--
so no security-- SSID present in packet dump?
So this is the packet dump, and I've already done this.
So I'm going to pull this up and then show you what it is.
So we're going to look for a beacon.
It's a wireless LAN subtype of 0008.
It's a beacon.
See how this says Beacon frame?
We could dive in and 0008--
boom.
So we're going to get our Beacon frames.
And we don't want WPA and we don't want--
and this is a tag of 48, which represents
RSN, which is the Robust Security Network interface
element.
And that would be identified with WPA2.
So we'll filter for all of this.
And we see SecurityTube_Open.
Let's ensure we get the right one.
It does say it's the Beacon frame.
And I want to get into these tags.
There's so many tags.
We don't have a WPA.
We don't have an RSN.
This would be the one.
I see nothing showing any sort of security.
Let's compare.
Let's go with one that might have some security in there.
So here we have WPA showing on this guy.
So Nirmall does have some.
Patel has WPA.
So, yeah, we're seeing some of the differences.
But SecurityTube_Open had none of them.
It has no security, which is why it's called SecurityTube_Open.
OK.
Which of the SSID home network is operating on which channel?
This one's easy.
Well, it's fairly easy.
We're going to do wlan contains Home_Network.
I love contains.
Contains is a great word to use for finding things
in Wireshark.
It says Home_Network over here.
Yay.
It's got a Beacon frame.
And we want to know what channel it's on.
So it should be right in the DS Parameters.
Channel 6.
No.
Current channel is channel 6.
Let's compare.
Let's find another one.
And you could see this guy is on Current Channel 1.
So Home_Network, Current Channel 6.
That one's neat.
Which security mechanism is configured
for SSID lazy artists?
It could either be open, WPA, PSK, or WPA2.
Those are the ones.
So wlan contains LazyArtists.
Boom.
Brings this guy up.
And minimize these tags.
We see RSN.
And, in here, it's got AES and AES and PSK.
These are signs--
RSN.48.
You might remember that from a previous filter.
We made sure to do not wlan.tag.number 48.
Boom.
Let's tag 48.
For RSN, this is WPA2 PSK.
That answered that question for LazyArtists.
Is Wi-Fi Protected Setup WPS?
That's when you press the button on your modem
or your router, your wireless access point,
and then you can do WPS on your machine.
So which access point, which SSID has that turned on?
Well, there is a filter for that.
Well, it says, is it enabled on Amazon Wood?
So let's look at a beacon from Amazon Wood,
because that's where it would show it.
We want to know if it has WPS.
And, bam, it does.
It has WPS.
So Amazon Wood does have WPS.
That is a yes.
And then what is the total count of packets which were either
transmitted or received by the device with a MAC address
of E8:DE:27--
all the way to 18?
Well, we're going to look at this guy.
WLAN transmitted to that e8:de:27:16:87:18 or received--
so transmitted or received by that guy.
And change our display and we are displaying 5,701.
That is how many packets were either transmitted or received
by that MAC address.
All right.
What is the MAC address of the station which exchange data
with SSID SecurityTube_Open?
Well, I want to find a beacon.
What is SecurityTube_Open called?
Contains SecurityTube_Open.
Ooh, all sorts of packets.
It is case-sensitive.
There we go.
So what is the actual physical address of this guy?
There we go, E8:DE:27:16:87:18.
Oh, hey, that's the one we were just looking at.
OK, so that's SecurityTube_Open.
So now let's do a filter.
Let's look for that BSSID.
And we'll also look for data types--
or subtypes of data, which is a 20.
So it looks like this.
E8:D3:27:16:87:18 and our subtype of 0x0020.
It's [INAUDIBLE] 20.
There's a hex.
So yeah.
But, in here, we want to see who was talking to this guy.
Well, we have our E8.
The other one talking is 5C.
And if you go through all these packets,
it's going to be the same.
Here's one of the neat things.
If you highlight a parameter, then you
go to a different packet, it will find that parameter.
See how it's obviously different packets
because the rest of the data is changing?
But this destination address is not changing.
That's how we know.
So from the last question, we know
that a station was connected to SSID SecurityTube_Open.
Yes.
Provide the TSF timestamp of the association response
sent from the access point to the station.
So we're looking for traffic from 5C to 38,
and we're looking for a subtype of 0x0001.
That is a association response.
There should only be one.
See how it says Association Response in the Frame Control
Field?
I'm sorry.
The Subtype is 0001.
They're known things.
They mean something.
We'll get into it-- the course--
in another pathway, explaining all of that.
But if you follow on this, you should get the same answer.
And you can see just how you can pull things out
of Wireshark, which is what I want you to be able to do.
I hope you got something out of this lab
and learned a little bit, at least had a little fun.
We're going to dive even--
we're going to dive even deeper in the next lesson,
the next lab, and try some other things.
For Wi-Fi pen testing, you would want
to identify all these pieces that we're pulling out now.
And then you can use those again later, especially
the open network, maybe the ones using just WPA.
If it's got WPA2, it's going to be a little harder.
But there's things that we can do there, too.
So I hope this was fun.