Welcome to our first bone section of the curse in this module, we will be covering how the crack of
Arless password.
Now this process can be complex because it requires a lot of tools to complete.
But besides tools, it also requires something that all of you might not have, and that is a wireless
card that supports monitor mode.
Now, this is pretty much the reason why this is a bonus section.
You need this in order to complete this attack.
And not many of our cards support monitor mode.
And what monitor mode allows us to do is to sniff data from access points around us, which then we
will use to sniff the hashed password once someone tries to connect to our Wi-Fi.
Most of the wireless cards are being ran in managed mode and managed mode is something you would normally
use when you want to use Wi-Fi and surf the Internet.
However, some wireless cards have this monitor mode option.
And I will show you in the next video how you can check whether your wireless card can be put into monitor
mode and how to do that anyway.
Anyway, let's explain how the attack will work in greater details.
So let's say we have a wireless access point and this wireless access point has two devices connected
to it.
We also have our Kleenex machine.
However, Linux machine isn't connected to the wireless XPoint, it only has to be close to it to perform
this attack.
Once we get close to our wireless app, we turn our wireless card into monitor about.
Once we have it in monitor mode, we will be able to see all of the wild fires around us as well as
our target wi fi, once we choose out of all of those access points, which one we want to attack,
we need to identify two things about that access point.
Those two things are the channel on which it runs and its Mac address.
Both of these we will be able to see with our tools that we will use now.
Channel is just a digit and we already know what the Mac address is right now that we got our information
that we need.
The next step is to capture the password.
But how can we do that for this?
Otherwise must try to connect to that wireless access point.
Right, correct.
And once it tries to connect, it will initiate four different steps, also known as a four way handshake
between the device and the access point.
In those four steps, it sends the password value to the access point, and that is what we want to
sniff.
However, it could be a long, long time until someone tries to connect to that wi fi.
So are we going to just sit there and wait for someone to connect?
Well, of course not.
If we are going to perform a different type of the attack to kick everyone off of the Wi-Fi, and that
is called the authentication attack.
Once we send the authentication packets, this will disconnect every device that was previously connected
to that access point.
The goal of this happens once we stop the authenticating.
Then those devices that got kicked off wi fi a few seconds ago will try to reconnect back to that access
point.
And all that time we will be sniffing for that four way handshake with our password key.
And as soon as they connect, we will get that password value that we want.
At this point, we no longer need to be close to that wi fi access point.
We can go on the other side of the world in order to crack that password.
Now, you might be asking how well we wrote the hashed password inside of a file.
Therefore, it is on our PC right after this.
All we need is a little bit of luck that the password is easy and not complex.
And then we use that hash password that we sniffed and we throw it into different tools that can help
us crack this password.
Most known tools used for this are air crack and Hashmat aircraft uses C.P.U power or processor power
to crack the password, while Hashmat can use both CPU or processor power and your graphics card power.
And it can sometimes crack a lot faster than aircraft.
Now, the average speed of cracking passwords with these programs, depending on what CPU and GPU you
have, would be around three hundred to one hundred thousand.
And yes, of course, we're talking about three hundred two hundred thousand passwords per second.
So this is a completely different story then, for example, brute forcing weblog and Page or SNH or
something similar.
This is a lot faster now.
Of course, since we are running a virtual machine, the speed will be significantly lower.
But compared to previous brute force attacks that we did, it will still be really fast.
If the password is not complex and we managed to crack it, then you guessed it.
We can connect to that far less access point.
And if we want, we can attack the devices inside that network with all the previous attacks that we
learned.
But that is completely up to you, what you do after you gain access to the Wi-Fi.
So now that we know how all of this works, let's see the practical side of it and let's crack up our
less access point.
See you in the next video.