Elvis Wiki - User contributions [en]

Wi-Fi Pineapple Mark VII: Initial Setup

2023-01-17T19:34:40Z

APipinic:

== Summary ==

The Hak5 WiFi Pineapple is a highly advanced WiFi auditing and MITM platform. The original "RougeAP" device - the WiFi Pineapple provides an end-to-end workflow to bring WiFi clients from their trusted network to your rouge network.

The Wi-Fi Pineapple is a wireless auditing platform from Hak5 that allows network security administrators to conduct penetration tests. Pen tests are a type of ethical hacking in which white hat hackers seek out security vulnerabilities that a black hat attacker could exploit. The labels white hat and black hat are derived from old-time Western movies in which the good guys wore white hats and the bad guys wore black hats.

The Wi-Fi Pineapple can also be used as a rogue access point (AP) to conduct man in the middle (MitM) attacks. A MiTM attack is one in which the attacker secretly intercepts and relays messages between two parties that believe they are communicating directly with each other. The inexpensive price and friendly user interface (UI) enable attackers with little technical knowledge to eavesdrop on computing devices using public Wi-Fi networks in order to collect sensitive personal information, including passwords.

When a Pineapple is used for pen testing, it is referred to as a honeypot. When a Pineapple is used as a rogue AP to conduct MitM security exploits, it is referred to as an evil twin or pineapple sandwich.

== Requirements ==

[[WiFI Pineapple Mark VII: Cracking Wifi Password]]

[[WiFI Pineapple Mark VII: Man in The Middle]]

== Description ==
[[File:mark7.png]]

== Setup Basics ==

To begin setting up the WiFi Pineapple Mark VII, you will first need to assemble the unit by attaching the included antennas. The antennas screw onto the RP-SMA ports around the device. Then, decide if you will be setting up the device by WiFi, by USB Ethernet, or by USB Flash Disk.

=== Setup by WiFI ===

1. Power the WiFi Pineapple Mark VII using the included cable and a 2-Amp USB power source. The light will begin blinking blue. When the light shows solid blue, the device is ready to setup.

2. Using a computer or smartphone, connect to the WiFi Pineapple's open wireless network, named "Pineapple_XXXX" (where XXXX are the last 4 characters of the device's MAC address).

3. Once connected to the wireless network, open a web browser to http://172.16.42.1:1471 and follow the on-screen instructions. The setup wizard will prompt you to connect the WiFi Pineapple to a wireless network, from which it will download and install the latest version of the WiFi Pineapple software. This process typically takes about 10 minutes—during which time it is important to keep the device plugged in and powered on.

=== Setup by USB Ethernet ===

The WiFi Pineapple Mark VII contains a built-in USB Ethernet adapter from the USB-C port. With this port, you can access the WiFi Pineapple LAN without needing a Cat6 Ethernet cable and RJ45 port.

1. Connect the WiFi Pineapple Mark VII to a computer using the included USB cable. For Windows and Linux computers, the ASIX AX88772C USB Ethernet adapter drivers should install automatically. Mac OS Catalina and above may not install the driver automatically. If necessary, install the driver from the ASIX driver download page for the AX88772C.

2.Once the WiFi Pineapple is connected to the computer, it will enumerate as a USB Ethernet adapter and that interface should receive an IP address from the WiFi Pineapple via DHCP in the 172.16.42.0/24 range.

3.Open a web browser to http://172.16.42.1:1471 and follow the on-screen instructions. The setup wizard will prompt you to connect the WiFi Pineapple to a wireless network, from which it will download and install the latest version of the WiFi Pineapple software. This process typically takes about 10 minutes during which time it is important to keep the device plugged in and powered on.
== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== References ==

* https://docs.hak5.org/hc/en-us/categories/360004116253-WiFi-Pineapple-Mark-VII
* https://elvis.science/?w=WiFi_Pineapple_Mark_VII

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:29:52Z

APipinic: /* Alternative Way - Dictionary Attack via Hashcat */

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

A dictionary attack using Hashcat is a type of brute-force attack that attempts to guess a password by trying a pre-defined list of words (a "dictionary") as the password. Hashcat is a password cracking tool that uses the power of the GPU to perform the calculations needed for the attack. It can be used to crack many types of hashes, including those used in popular password storage systems such as Windows and Linux. The success of a dictionary attack using Hashcat depends on the quality of the dictionary used and the strength of the password being cracked.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 2 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 3 (Dictionary Attack) with aircrack-ng ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) via aircrack-ng ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

=== Alternative Way - Dictionary Attack via Hashcat ===

For this scenario a kali machine and a password list is beeing used as well as the converted WPA Handshake genereated in the previous chapters.

* The downloaded *.pcap file needs to be converted to a *.hc22000
* The online tool on the official hashcat website command is used: https://hashcat.net/cap2hccapx/
* The result of the convert needs to be cracked via hashcat, for cracking the the following command is used: <code> hashcat.exe -m 22000 <converted_file>.hc22000 <password_list>.txt </code>
* Hashcat will crack the password using a provided list. After a while the attempt will be finished
* The status should display: Cracked! We can see the WiFi (Melony’s-Castle) as well as the password.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:28:46Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

A dictionary attack using Hashcat is a type of brute-force attack that attempts to guess a password by trying a pre-defined list of words (a "dictionary") as the password. Hashcat is a password cracking tool that uses the power of the GPU to perform the calculations needed for the attack. It can be used to crack many types of hashes, including those used in popular password storage systems such as Windows and Linux. The success of a dictionary attack using Hashcat depends on the quality of the dictionary used and the strength of the password being cracked.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 2 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 3 (Dictionary Attack) with aircrack-ng ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) via aircrack-ng ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

=== Alternative Way - Dictionary Attack via Hashcat ===

For this scenario a kali machine and a password list isbeeing used as the so called "dictionary".

* The downloaded *.pcap file needs to be converted to a *.hc22000
* The online tool on the official hashcat website command is used: https://hashcat.net/cap2hccapx/
* The result of the convert needs to be cracked via hashcat, for cracking the the following command is used: <code> hashcat.exe -m 22000 <converted_file>.hc22000 <password_list>.txt </code>
* Hashcat will crack the password using a provided list. After a while the attempt will be finished
* The status should display: Cracked! We can see the WiFi (Melony’s-Castle) as well as the password.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:25:16Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 2 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 3 (Dictionary Attack) with aircrack-ng ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) via aircrack-ng ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

=== Alternative Way - Dictionary Attack via Hashcat ===

For this scenario a kali machine was used. Using a password list us beeing used as the so called "dictionary".

* The downloaded *.pcap file needs to be converted to a *.hc22000
* The online tool on the official hashcat website command is used: https://hashcat.net/cap2hccapx/
* The result of the convert needs to be cracked via hashcat, for cracking the the following command is used: <code> hashcat.exe -m 22000 <converted_file>.hc22000 <password_list>.txt </code>
* Hashcat will crack the password using a provided list. After a while the attempt will be finished
* The status should display: Cracked! We can see the WiFi (Melony’s-Castle) as well as the password.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:22:32Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 2 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 3 (Dictionary Attack) with aircrack-ng ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) via aircrack-ng ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

=== Alternative Way - Brute Force Attack via Hashcat ===

* The downloaded *.pcap file needs to be converted to a *.hc22000
* The online tool on the official hashcat website command is used: https://hashcat.net/cap2hccapx/
* The result of the convert needs to be cracked via hashcat, for cracking the the following command is used: <code> hashcat.exe -m 22000 5418_1669215647.hc22000 list.txt2 </code>
* Hashcat will crack the password using a provided list, in our case ”list.txt”. After a while the attempt will be finished
* The status should display: Cracked! We can see the WiFi (Melony’s-Castle) as well as the password.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:11:57Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 2 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 3 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:11:46Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 2 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:11:07Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 3 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:10:39Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 3 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 4 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T19:09:21Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==
=== Step 1 Setup WiFi Pineapple Mark VII ===
This step will describe you how to setup the WiFi Pineapple Mark VII
* Connect the WiFi Pineapple Mark VII to a stable USB power supply capable of delivering 9w for initial setup. When connecting to a PC, use the included USB-C cable.
* Download the latest WiFi Pineapple Mark VII firmware from the Hak5 Download Center.

=== Step 1 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point.
A recon scan is required to see which WiFi networks are in the area.

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded.
* Deauthenication is needed to create a "Full Capture"

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 3 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T18:45:53Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng.

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==

=== Step 1 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 3 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]

WiFi Pineapple Mark VII: Cracking WPA/WPA2-PSK with a dictionary/brut-force attack

2023-01-17T18:45:46Z

APipinic:

== Summary ==

This Documentation will give you a guide how to retrieve a WPA2-PSK password with the Wi-Fi Pineapple Mark VII combined with the Linux Tool aircrack-ng. The Wi-Fi Pineapple Mark VII will be used to deauthenticate the clients of the victim's Wi-Fi. Simultaneously, the Wi-Fi Pineapple Mark VII will capture the 4-way handshake between client and access point and saves it as a PCAP or Hashcat file. This guide will use Linux to demonstrate how to use aircrack-ng

== Requirements ==

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. It is the end user's responsibility to obey all applicable local, state and federal laws. We assume no liability and are not responsible for any misuse or damage caused by this site

=== Mandatory ===
==== GNU/Linux ====

* Install aircrack-ng suite: <code>sudo apt install aircrack-ng</code>

To complete these steps, you must have followed [[WiFI Pineapple Mark VII: Initial Setup]] before.

=== Optional ===
==== Hashcat ====
* Clone GIT repository: <code>git clone https://github.com/hashcat/hashcat.git</code>
* Build: <code>cd ./hashcat && make && make install</code>
* Link: <code>sudo ln -s ./hashcat /usr/local/bin/hashcat</code>

== Description ==

=== Step 1 (Deauthenticate Client & Capture Handshake)===

This step will describe you how to capture the handshake by deauthenticating the clients from its access point

* Log in to Wi-Fi Pineapple Web GUI and open the tab '''Reacon'''
* As seen in figure "WiFI Pineapple GUI", scan your environment for the victim's Wi-Fi (1).
* Choose the victim's Wi-Fi and select "Capture WPA Handshake"(4)
* Start deauthentication attack (3)
* When a handshake has been captured, it can be then downloaded

[[File:Deauth.png||400px|thumb|middle| WiFI Pineapple Web GUI]]

=== Step 2 (Dictionary Attack) ===

The purpose of this step is to actually crack the WPA/WPA2 pre-shared key. To accomplish this, you need a dictionary of words as input. Basically, aircrack-ng takes each word and tests to see if this is, in fact, the pre-shared key.

Open a console session in Linux and enter:

<code>aircrack-ng -w rockyou.txt -b 00:14:6C:7E:40:80 *.cap</code>

Where:

-w rockyou.txt<ref>https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt </ref> is the name of the dictionary file. Remember to specify the full path if the file is not located in the same directory. Notice: any word list can be use for this attack. If the password you are looking for does not appear in the list, then the attack has failed.

.cap is the file containing the captured packets of the handshake.

Here is typical output when there are no handshakes found:

<code>
Opening psk-04.cap
Read 1827 packets.

No valid WPA handshakes found.
</code>

When this happens, you either have to redo step 3 (deauthenticating the wireless client) or wait longer if you are using the passive approach. When using the passive approach, you have to wait until a wireless client authenticates to the AP.

Here is typical output when handshakes are found:
<code>

Opening psk-04.cap
Read 1827 packets.

# BSSID ESSID Encryption

1 00:14:6C:7E:40:80 teddy WPA (1 handshake)

Choosing first network as target.
</code>

Now, at this point, aircrack-ng will start attempting to crack the pre-shared key. Depending on the speed of your CPU and the size of the dictionary, this could take a long time, even days.

Here is what successfully cracking the pre-shared key looks like:
<code>
Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

EAPOL HMAC : 4E 27 D9 5B 00 91 53 57 88 9C 66 C8 B1 29 D1 CB

</code>

=== Step 3 (Brut Force Attack) ===
In this method, we will be using both crunch and aircrack-ng inside Kali Linux to brute-force WPA2 passwords. But before we proceed, let me briefly introduce you to our tools:

crunch - is a wordlist generator from a character set.

aircrack-ng - a 802.11 WEP / WPA-PSK key cracker.

I assume you already have aircrack-ng installed on your system, and you already have a captured handshake ready for offline cracking. If not, I will post another article soon on how to use aircrack-ng to capture WPA2 handshakes.

For now let's get started and open a terminal!

If you don't have crunch, yet you can install it by typing:

<code>sudo apt-get install crunch</code>

It usually takes crunch a long time to create a wordlist and consumes a lot of disk space too if you choose to save the ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠wordlist to your hard drive. Therefore, this technique can only be useful if somehow you already have an idea of what the password pattern is. The default Wi-Fi passwords of modem/routers provided by ISP's for example can be a target.

Let's say that after your research, you figured out that the default Wi-Fi password is an 8-digit number that always starts ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠with the number 7. From that information, we can now create a wordlist using crunch and deliver the output directly to aircrack-ng without writing the file to the hard drive.

This can be done using pipes:

<code>crunch 8 8 0123456789 -s 70000000 | aircrack-ng -w - -b AA:BB:CC:DD:00:11 /path/to/handshake.cap</code>

The first command above (the one before the pipe) means that we'll create a wordlist using crunch with a minimum of 8 characters and a maximum of 8 characters (since we know that the password always use 8 digits) using only numbers 0 to 9. The "-s" also tells crunch to start the list from 70000000.

We can then use pipes to make the standard output (stdout) of the first command to be the standard input (stdin) of the second command. Thus, whatever output crunch generates will be used by aircrack-ng as the wordlist.

In the second command, the "-w -" tells aircrack-ng to use the wordlist from stdin (that's what the dash means). The "-b" is used to specify ‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌⁠‌‌‌‌⁠‌‌‌‌‌‌⁠‌‌‌⁠‌‌‌‌⁠‌‌‌‌⁠‌‌‌‌‌⁠‌‌‌‌⁠‌‌‌⁠‌‌‌⁠the bssid of the targer router (AA:BB:CC:DD:00:11) and the last parameter (/path/to/handshake.cap) is the absolute path to the captured WPA2 handshake. You can also use a relative path depending on your current working directory.

Now, the cracking process may take a while depending on your processor speed, but I believe it is possible to crack that password pattern within a few seconds to a couple of hours.

In my next articles I will show you how you can create rules with crunch even with complicated patterns such as passwords with common words inside.

== Used Hardware ==

[[WiFi Pineapple Mark VII]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 28.01.2022

== References ==

* https://docs.hak5.org/hc/en-us/articles/360053346334-Setup-Basics
* https://www.youtube.com/watch?v=evsCXb7XHbM&t=274s&ab_channel=TigTec
* https://www.aircrack-ng.org/
* https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
* https://coders.ph/post/how-to-use-aircrack-ng-to-bruteforce-wpa2-passwords

[[Category:Documentation]]