Hi, and welcome back to Section nine Wireless Attacks.
During the course of this video,
you'll learn how to perform wireless reconnaissance using Carly Lenox and
a wifi adapter. I hope you're excited. So let's iPhone in.
To get started, before you pull on your Carly Lux virtual machine,
ensure your wireless adapter is connected to the US E port of your computer.
To attach your wireless adapter directly to the virtual machine,
simply select the Carly Lenox virtual machine like so. Then click on settings.
Next, click on ussb.
Depending on the type of US ports or the versions on your computer,
simply select the appropriate version. For instance,
my computer is using ussb 3.2 ports,
therefore I selected a U USB 3.2 controller. Next,
simply click on this icon here.
Put a plus sign to add a new SV device. When you click it,
you'll see your U SB wifi adapter.
The name and convention might be a bit different,
so please pay attention that you select the right device.
My device is called arterius AB nine one C.
I'm gonna simply select it like zoom, and now it is selected,
un entered within this field. Once it's there, simply click on. Okay,
next, simply power on your Carly Links. Switch your machine log in.
Great, so now that we're logged in,
let's verify the network adapter is connected to Carly Lenox.
Simply open a terminal like so,
and let's type W config and hit enter.
As soon we have an adapter called WLAN zero. Great.
So this is a wireless adapter that is connected directly to our virtual
machine.
If you notice the mood of this wireless adapter,
it is set to manage with managed mode.
It'll allow us to connect as a client to a wireless router or
anac access point. To perform reconnaissance,
we need to change a mode to monitor mode so that we can capture
beacons that are sent from access points and also capture the probes that are
sent from clients looking for access points. To do this,
we can simply use the pseudo command like so.
Next, we will type erman like so,
followed by cze kill.
This will look for any sort of background processes that
may prevent us from changing the network adapter mode,
from manage to monitor mode,
and currently it has found this process and it has killed this process.
Great.
The next thing is we need to use the airman command once more
dash ng and this time will type start WLAN zero
and it enter.
This will identify the current network adapter and it'll change it
to monitor mode and give it in your name,
which is WLAN zero mon. Excellent.
To monitor any sort of beacon that are sent from access points,
and to even monitor the probes that are sent from clients,
we can simply use pseudo aero dump like sue
dash ng, followed by the name of the monitor adapter,
which is WLAN zero mon. Simply enter,
and you'll notice that there is a lot of data appearing on the screen.
I'm gonna quickly stop this, so the data remains static.
Let's take a look at each of these columns.
The B S S I D column, it is a basic service set identifier.
These are the market dresses of the wireless access points
or the wireless routers.
The P W R simply indicates a power level.
If the value's closer to zero,
it simply means that you are closer to this particular device.
We have the beacons.
Beacons are simply advertisements that are sent from the access points to
announce their presence within the vicinity.
These are usually captured by wireless clients and analyze
to determine theirs I and any sort of security
details about the network itself. Keep in mind,
if the security professional has disabled the SS I D broadcast,
it'll not appear in the beacon,
but the beacon will still be sent out and we could identify a hidden network
very easily. We can see the amount of data sent.
We can even see the number of pockets per every 10 seconds.
We can see the operating channel of the wireless network. Keep in mind,
at 2.4 gigaherz frequency wireless networks operate between channel one
to 11, and we can see this network is operating on channel four.
The MB identifies a maximum speed that is supported with this wireless network.
The e n column indicates the wireless security standard.
If you notice,
some of these networks are using W P and some are using
WP two. We can see the cipher. Additionally, we can see whether there is,
there's any authentication and authentication type. And lastly,
we have the E S S I D, which is the extended suicide identifier.
This simply indicates the actual S Society. In other words, the network name.
Let's take a look at a lower portion.
The B S S I D simply indicates the wireless router
that a client is connected to the stations simply indicates
a market address of the clients.
So therefore we have the market address of a client that is connected to this
particular network.
The power value simply tells you your average distance away from the wireless
clients. We can see the transmission rate loss frames,
we can see if there's any notes written approves,
and we can see what they're approving for. For example,
if a wireless client is now powered on,
it'll send probes seeking wireless networks and we can capture the probe
information within this column and use that information to create
peak networks to trick the client into connecting to us.
The information found within the screen is very valuable for us.
Our target network is actually this highlighted one that says Target network,
and it is using wp.
We have the BS society and we have the operating channel.
So let's take note of this. I'm simply gonna copy this information.
I'm going to open up a text editor like so
I'm simply going to piece the necessary details.
Great.
We'll use this collected data to attack our target vulnerable network
and try to access this network. During the course of this video,
you have learned how to perform wireless reconnaissance to discover nearby
access points and stations. In the next video,
you'll learn how to attack W E P networks.
I hope this video has been informative for you,
and I will see you in the next one.