Welcome back.
So we saw how we can put our wireless card in a monitor mode, but right now let's get to the real attack.
So the steps go like this.
We want to put our card in monitor mode.
We didn't want to sniff all of the information around us.
Then out of all of the wireless access points, we must pick the one that we want to attack.
And in this video, I will be attacking my own wireless access point because attacking anyone else's
would be illegal.
So we'll be attacking my access point.
You can attack yours if you're still following this section.
And once we choose our target, we need to check out the channel on which the target is running on and
the Mac address, which the target access point has.
Then we must run our sniffing program.
And simultaneously, while running that sniffing program, we must run our the authentication attack.
Then we can authenticate the devices on that access point for a few seconds.
And once we stop the authenticating, we should be able to sniff the four way handshake with the hash
value of the password.
Then we can move on to the clinic's machine and there we're going to try to crack that password.
OK, there are a lot of steps in front of us, so let's get straight into it.
So what I'm going to do is I'm going to put my wireless card in monitor mode, as I did in the previous
video.
Nothing really to explain too much here.
And the next commander to want to run right after it is Airman Dash and G check W one, which is my
wireless interface.
Now, this program is something that you have inside of your Linux machines.
You shouldn't have problem running this.
The wireless interface is something that you want to change to the name of your wireless interface.
And once you set the entire command, you can click enter.
It will tell you that it found five processes that could cause some trouble.
Now, this means that if we run into any problems during our process of gathering the four way handshake
with the password, it could be due to these processes still running.
So we're just not going to risk that and we're going to kill all of those processes straight away.
How can we do that?
Well, we can type airman.
Dash and G and then check and then kill munchy type this press enter, it will also tell you that it
found five processes, but down here it will also tell you that it is killing all those processes.
So now we shouldn't have any problem running our other tools.
Once you do that, what you want to check is whether your wireless card is still in monitor mode.
And since it sometimes turns back to management, you must put it once again into the monitor mode after
performing the Airmen Dash and G Command.
After you put it back to monitor mode, the next command that we want to run is error, dump, Dash
and G and then the interface that is currently in the monitor mode.
Since the yellow one is inside of the monitor mode for me, I will press enter right here and this will
start sniffing all of the information around me.
Let me enlarge this terminal and we're going to be able to see all of the various access points that
are around me.
These are the names of the wireless access points under the column E.
S side.
The authentication and deciphering the encryption is type of the protection the device XPoint has.
So you can see most of them will have WIPA two, which is currently the highest protection they can
possibly get c h rate.
Here is something that we want to remember because this column is actually the channel.
And you remember Channel is one of the two things that we must need in order to perform this attack.
The data can tell us if the access point is active currently or if it has some devices connected to
it that are browsing the Internet.
While the beacons would usually tell us the same thing.
However, the P w are right here can tell us how far away is the access point.
So the lower the number, the closer the access point is to you.
And sometimes if you choose an access point, it is far, far away.
This attack might not work.
You have to be really close to the target in order for this to work.
However, you do not have to be connected to the target.
As you can see right now, I have no access to the Internet.
I am not connected to any access point and I will be targeting this access point right here called Tachometer.
This is my wireless access point.
Therefore, I will be targeting that.
Now, remember that we need to remember two things.
So the channel for my XPoint is two.
And by the way, once you choose your target, feel free to control.
See this because sometimes the screen knows to move and you cannot really copy and paste different things
that you need.
So I have chosen this target right here and I need to remember the channel, which is two and the Mac
address.
Now, the channel is easy to remember.
So therefore I'm just going to copy the Mac address right here and then we need to start the sniffing
process again.
However, we're going to write information inside of a file for this.
We're only going to sniff one access point information.
And to do that, we must specify the channel and the Mac address so we start the command.
The same with Arrow Dump Dash, and then we use that C command for the channel and we specify the channel
number.
In my case, that is two.
And Aradigm is also a program that you have Princetonian Kalinich so all of these programs that we use,
you will already have in your colonics machine.
If you don't or if you're using some other machine to perform this, I will link in the resources how
you can download all of these tools.
It is pretty simple, so you shouldn't have any problem downloading them.
Nonetheless, let's get back to our command.
So we got error, dump, dash and then dash C for the channel.
We specify channel number two for you.
It might be different channel and after that we use Dash, Dash B society.
And what B side is is simply the Mac address.
Since we can see that the column where Mac addresses are is called B side.
So after this we must.
Based on our Mac address to our target for this access point and the last parameter to this command
is going to be Dasch w option, and this option simply stands for the filename that we're going to write
all of this in.
So let's call this Devadas XPoint name in capital underscore best, this is going to be our file name.
And by the way, also once running this comment, remember in which destination are you running the
comment because that is where it's going to save your files.
I'm saving this estimator underscore test and the last thing that we must specify is Devadas Interface,
which is currently in monitor mode for me.
That is the one you specify your wireless interface and monitor mode and once you craft this document
you can press enter.
And you will notice right here, it will only sniff for this specific access point.
We can see the name right here under the East Side and we can see its Mac address.
But also we can see are the devices that are currently connected to this access point.
And at the moment, it only has two of them.
Now, what I'm going to do is I'm going to connect to the wireless XPoint over my mobile phone.
And you can see that we already managed to capture the WPA handshake, which is all that we need in
order to be able to crack the password.
However, we're going to try to do that again just by performing the attack, because we can see the
wait for someone to randomly connect our access point.
We must disconnect everyone from the Texas point.
And to do that, I'm going to enter the root terminal and I will enlarge this, of course, you can
see everything better.
And the comment that we must use to actually authenticate someone is using the airplane dash and Geto,
so it is spelled like this and the options that it takes is dash zero and then space and zero.
Once again, this means it will send it out indication Becket's indefinitely until we control see the
program and then it will stop the authenticating.
So what I advise you to do if you're following this attack is connect your mobile phone to the access
point and you will notice as soon as we start running this command, your mobile phone will get disconnected
from that far less access point.
So once you type that zero and then zero, the next parameter is Dash eight.
And after that comes the Mac address of the far less access point.
At the end, we only specify the wireless interface in the monitor mode and we can start the authenticating
and if we take a look at my phone, I am instantly being disconnected from this far less access point.
And if I go to settings and try to connect back, it will not work.
Nobody will be able to connect to this far less access point as long as I'm running this attack.
But you only want to run this for a few seconds and once you run it for a few seconds, everyone will
be disconnected.
Then you control, see and hear.
In just a few seconds, we will be catching WPA to handshakes with the hash value of the password from
my phone.
I already established connection to the wireless access point and once you do that in the upper right
corner, you should see this WPA handshake.
And as soon as you see that you can control see this program, you got everything that you need.
You got the four way handshake.
And inside of that four handshake is the password that you need.
Once you finish all of this, you will notice that you got four different files on your desktop.
As you can see, one, two, three and four.
And you actually only need one out of these four files.
And this is the dot cap file.
All of the other three you don't need for this attack.
So you can just save the dot kept file and you can delete the others once you have the dot kept file.
Inside of this file is a four way handshake.
And then in the next video, we're going to use different tools to extract the hash password from this
that kept file.
And then we're going to use massive word lists to try to crack this password from this file.
But for this, I'm going to switch to my Linux machine so we can go back to our normal environment since
I no longer need to run any program on my laptop.
See you in the next video.