narrator: Welcome back.
So, we saw how we can put our wireless card in monitor mode,
but right now let's get to the real attack.
So, the steps go like this:
We want to put our card in monitor mode,
We then want to sniff all of the information around us,
then, out of all of the wireless access points,
we must pick the one that we want to attack.
And, in this video I will be attacking my own
wireless access point,
because attacking anyone else's would be illegal.
So, we'll be attacking my access point.
You can attack yours if you're still following this section.
And, once we choose our target, we need to check
out the channel on which the target is running on,
and the MAC address, which the target access point has.
Then we must run our sniffing program, and simultaneously
while running that sniffing program,
we must run our de authentication attack.
Then, we can de authenticate the devices
on that access point for a few seconds.
And, once we stop de authenticating
we should be able to sniff the four-way handshake
with the hashed value of the password.
Then we can move on to the Cal Linux MAChine,
and there we're going to try to crack that password.
Okay, there are a lot of steps in front of us
so let's get straight into it.
So, what I'm going to do
is I'm going to put my wireless card
in monitor mode, as I did in the previous video,
nothing really to explain too much here.
And, the next command that I want to run right after it
is airmon dash N G
check W L O one,
which is my wireless interface.
Now this program is something that you have
inside of your Cal Linux MAChine so
You shouldn't have problem running this.
The wireless interface is something that you want to change
to the name of your wireless interface,
and once you set the entire command, you can click enter.
It will tell you that it found
five processes that could cause some trouble.
Now, this means that if we run
into any problems during our process
of gathering the four-way handshake with the password
it could be due to these processes still running.
So, we're just not going to risk that
and we're going to kill all
of those processes straight away.
How can we do that?
Well, we can type airmon
dash N G,
and then check, and then kill.
Once you type this, press enter,
it will also tell you that it found five processes
but down here it'll also tell you
that it is killing all those processes.
So, now we shouldn't have any problem running
our other tools.
Once you do that, what you want to check is
whether your wireless card is still in monitor mode,
and since it sometimes turns back to manage mode,
you must put it once again into the monitor mode
after performing the airmon dash N G command.
(keys clacking)
After you put it back to monitor mode
the next command that we want to run is aero dump dash N G,
and then the interface that is currently
in the monitor mode.
Since W L O one is inside of the monitor mode for me
I will press enter right here,
and this will start sniffing all
of the information around me.
Let me enlarge this terminal,
and we are going to be able to see all
of the wireless access points that are around me.
These are the names of the wireless access points
under the column E S I D.
The authentication and decipher and the encryption is type
of the protection that the wireless access point has.
So you can see most of them will have W P A two,
which is currently the highest protection
they can possibly get.
CH right here is something that we want to remember,
because the CH column is actually the channel,
and you remember, channel is one
of the two things that we must need
in order to perform this attack.
The data can tell us if the access point is active currently
or if it has some devices connected
to it that are browsing the internet.
While the beacons would usually tell us the same thing.
However, the P W R right here can tell us how
far away is the access point.
So, the lower the number,
the closer the access point is to you.
And sometimes if you choose an access point that is far
far away, this attack might not work.
You have to be really close to the target
in order for this to work.
However, you do not have to be connected to the target.
As you can see right now, I have no access to the internet,
I am not connected to any access point,
and I will be targeting this access point right here
called Takmicar.
This is my wireless access point,
therefore, I will be targeting that one.
Now, remember that we need to remember two things.
So, the channel for my access point is two.
And by the way, once you choose your target,
feel free to control C this,
because sometimes this screen knows to move
and you cannot really copy and paste different
things that you need.
So, I have chosen this target right here and I need
to remember the channel, which is two, and the MAC address.
Now, the channel is easy to remember, so therefore,
I'm just going to copy the MAC address right here.
And then, we need to start the sniffing process again,
however, we're going to write information inside of a file.
For this, We're only going to sniff
one access point information,
and to do that we must specify the channel,
and the MAC address.
So we start the command the same with airodump dash N G.
Then we use dash C command for the channel and
we specify the channel number.
In my case, that is two.
And, airodump is also a program that you have pre-installed
in Cal Linux.
So, all of these programs that we use, you will already have
in your Cal Linux MAChine.
If you don't,
or if you're using some other MAChine to perform this,
I will link in the resources
how you can download all of these tools.
It is pretty simple so you shouldn't have
any problem downloading them.
Nonetheless, Let's get back to our command.
So we got airodump dash N G,
then dash C for the channel, we specify channel number two,
for you it might be different channel.
And, after that we use dash dash B S S I D.
And, what B S I D is, is simply the MAC address,
since we can see that the column where MAC addresses are
is called B S S I D.
So, after this we must
paste our MAC address
to our target wireless access point.
And, the last parameter to this command
is going to be dash W option.
And, this dash W option simply stands
for the file name that we're going to write all of this in.
So, let's call this the wireless access point name,
in capital, underscore test.
This is going to be our file name.
And, by the way, also once running this command
remember in which destination are you running the command,
because that is where it's going to save your files.
I'm saving this is as Takmicar underscore test.
And, the last thing that we must specify is
the wireless interface, which is currently in monitor mode.
For me that is W L O one.
You specify your wireless interface in monitor mode,
and, once you craft this entire command,
you can press enter.
And, you will notice right here it will only sniff
for this specific wireless access point.
We can see the name right here,
under the E S I D, and we can see its MAC address.
What also we can see, are the devices that are
currently connected to this access point.
And, at the moment it only has two of them.
Now what I'm going to do, is I'm going to connect
to the wireless access point over my mobile phone,
and you can see that we already managed to capture
the WPA handshake, which is all that we need
in order to be able to crack the password.
However, we're going to try to do that again just
by performing the de authentication attack,
because we can't really wait
for someone to randomly connect our access point.
We must disconnect everyone from that access point.
And to do that, I'm going to enter the route terminal.
And, I will enlarge this of course,
so you can see everything better.
And, the command that we must use to actually
de authenticate someone is using the aireplay dash N G tool.
So it is spelled like this,
and the options that it takes is dash zero,
and then space and zero Once again,
this means it'll send de authentication
packets indefinitely until we control C the program
and then it'll stop de authenticating.
So what I advise you to do,
if you're following this attack,
is connect your mobile phone to the access point.
And you will notice as soon as we start running this command
your mobile phone will get disconnected
from the wireless access point.
So once you type dash zero and then zero,
the next parameter is dash A,
and after dash A comes the MAC address
of the wireless access point.
At the end, we only specify the wireless interface
in the monitor mode, and we can start de authenticating.
And if I take a look at my phone, I am instantly
being disconnected from this wireless access point.
And, if I go to settings,
and try to connect back, it'll not work.
Nobody will be able to connect to this wireless access point
as long as I am running this attack.
But you only want to run this for a few seconds,
and once you run it for a few seconds
everyone will be disconnected, then you control C.
And, here in just a few seconds,
we will be catching W P A two handshakes
with the hashed value of the password.
From my phone I already established connection
to the wireless access point.
And, once you do that in the upper right corner
you should see this WPA handshake.
And, as soon as you see that you can control C this program,
you got everything that you need.
You got the four-way handshake, and inside
of that four-way handshake, is the password that you need.
Once you finish all of this, you will notice
that you got four different files on your desktop.
As you can see one, two, three,
and four.
And, you actually only need one out of these four files,
and this is the dot cap file.
All of the other three, you don't need for this attack,
so you can just save the dot cap file,
and you can delete the others.
Once you have the dot cap file,
inside of this file is our four-way handshake.
And then, in the next video,
we're going to use different tools
to extract the hash password from this dot cap file,
And then we are going to use massive word lists to
try to crack this password from this file.
But for this, I'm going to switch to my Cal Linux MAChine
so we can go back to our normal environment
since I no longer need to run any program on my laptop.
See you in the next video.