Instructor: Welcome to our first bonus section
of the course.
In this module,
we will be covering how to crack a wireless password.
Now, this process can be complex because it requires a lot
of tools to complete,
but besides tools,
it also requires something that all
of you might not have
and that is a wireless card that supports monitor mode.
Now, this is pretty much the reason
why this is a bonus section.
You need this in order to complete this attack
and not many wireless cards support monitor mode.
And what monitor mode allows us to do,
is to sniff data from access points around us
which then we will use to sniff the hashed password
once someone tries to connect to a Wi-Fi.
Most of the wireless cards are being ran in managed mode
and managed mode is something you would normally
use when you want to use Wi-Fi and surf the internet.
However, some wireless cards have this monitor mode option
and I will show you in the next video
how you can check whether your wireless card can be put
into monitor mode and how to do that.
Anyway, let's explain how the attack will work
in greater details.
So, let's say we have a wireless access point,
and this wireless access point has two devices
connected to it.
We also have our Cal Linux machine.
However, Cal Linux machine isn't connected
to the wireless access point.
It only has to be close to it to perform this attack.
Once we get close to our wireless AP,
we turn our wireless card into monitor mode.
Once we have it in monitor mode,
we will be able to see all
of the Wi-Fis around us,
as well, as our target Wi-Fi.
Once we choose out of all of those access points
which one we want to attack,
we need to identify two things about that access point.
Those two things are: the channel on which it runs
and its MAC address.
Both of these we will be able to see
with our tools that we will use.
Now, channel is just a digit
and we already know what MAC address is.
Right now that we got our information that we need,
the next step is to capture the password.
But how can we do it?
For this, a device must try to connect
to that wireless access point, right?
Correct and once it tries to connect,
it will initiate four different steps,
also known as a four-way handshake
between the device and the access point.
In those four steps,
it sends the hashed password value to the access point,
and that is what we want to sniff.
However, it could be a long, long time until someone tries
to connect to that Wi-Fi.
So, are we going to just sit there
and wait for someone to connect?
Well, of course not.
We are going to perform a different type
of the attack to kick everyone off of the Wi-Fi
and that is called Deauthentication Attack.
Once we send deauthentication packets,
this will disconnect every device
that was previously connected to that access point.
The goal of this happens once we stop deauthenticating.
Then, those devices
that got kicked off Wi-Fi few seconds ago will try
to reconnect back to that access point.
And all that time we will be sniffing
for that four-way handshake with our password key.
And as soon as they connect,
we will get that password value that we want.
After this point, we no longer need to be close
to that Wi-Fi access point.
We can go on the other side
of the world in order to crack that password.
Now, you might be asking, "How?"
Well, we've wrote the hashed password inside of a file,
therefore, it is on our PC, right?
After this, all we need is a little bit
of luck that the password is easy and not complex,
and then we use that hashed password
that we sniffed and we throw it
into different tools that can help us crack this password.
Most known tools used for this are Aircrack and Hashcat.
Aircrack uses CPU power or processor power
to crack the password,
while Hashcat can use both CPU or processor power
and your graphics card power
and it can sometimes crack a lot faster than Aircrack.
Now, the average speed of cracking passwords
with these programs,
depending on what CPU and GPU you have,
would be around 300 to 100,000.
And yes, of course,
we're talking about 300 to 100,000 passwords per second.
So, this is a completely different story than,
for example, brute forcing weblogging page
or as a sage or something similar.
This is a lot faster.
Now, of course, since we are running a virtual machine,
the speed will be significantly lower
but compared to previous brute force attacks that we did,
it will still be really fast.
If the password is not complex and we manage to crack it,
then you guessed it,
we can connect to that wireless access point,
and if we want,
we can attack the devices inside that network
with all the previous attacks that we learned.
But that is completely up to you what you do
after you gain access to the Wi-Fi.
So, now that we know how all of this works,
let's see the practical side of it
and let's crack a wireless access point.
See you in the next video.