Hi and welcome back to Section nine wireless attacks.
In this video, you'll learn how to attack W P A and W P A two networks.
I hope you're excited. So let's to get started,
simply ensure you have booted and log into your Carly Links switch or machine.
In addition, ensure your wireless network adapter is connected.
Let's verify by typing IW config like zoom.
Currently you can see my adapter is WLAN zero and it
is in managed mode.
So let's change this To monitor mode I type pseudo airon
dash NG start WLAN zero and it
enter.
It'll find any sort of processes that may prevent
adapter from changing into monitor mode. Once it is successful,
you'll see the new name for the adapter,
which is WLAN zero one. Great.
I can type W config once more to verify the operating status.
We can see the adapter name has changed and it is now in monitory mode.
Excellent.
Let's check for our target network within the vicinity and also determine
whether it is using W P A or w P a two.
I'll type pseudo adom like so n g
followed by the name of our adapter, an enter. Great.
After a few seconds, we have found our target network,
which is target on the score network. The authentication type is appreciate key.
The encryption type is WPA two that uses the CCM P cipher.
Excellent. I'm gonna copy the B S S I D information like,
so I'm gonna place this in a text document.
I'm going to record the channel name, which is for
the E S S I D name,
which is target on the score network. Great.
I also need one more thing.
I also need to see whether there is a client connected to this network.
If we look at it last portion of the market address of the access point,
it is 0 1 28 E one.
Here we have 0 1 28 E one,
and there's one station associated. So let's copy the station information.
I'm going to copy the station information like so and keep this in my
clipboard.
I'm gonna head back to my terminal and now I'm going to capture pockets for
this particular channel, which is channel four.
So I'm going to modify my command by typing pseudo error dump
NG dash c4,
followed by my adapter name,
then dash W and specify
the output file name.
I'm gonna call this target underscore network
underscore W P A two like Sue and hit enter.
So currently it is listening on channel four.
Now it is capturing everything within channel four,
including the SSIDs. As soon
while it is capturing all of this information,
I need to de authenticate the client that's connected only to the target
OnCore network,
simply because I need to capture something called the w p handshake,
which I can use to actually perform a password brute force attack.
On that file, I'm going to open a new terminal like so,
and I'm going to use a pseudo command airplay like so dash
zero space zero dash e,
followed by the market address of the connected
station followed by WLAN zero one.
This will force a client to be disconnected and to attempt a
re-association therefore providing or performing the W P A
two or the w p handshake.
I'm gonna hit enter and enter the password for my Carly Lenox machine.
Currently it is awaiting for some beacons
and actually I made a mistake. I entered
the market address of the client.
It is supposed to be the market address of the VS I
of the target,
which is 68 7 8,
actually seven F
7 4 0 1 2 8
E one.
Once you verify the market address or the BS society of the target
is accurate simply to enter,
I'll notice it is sending de authentication attacks specifically to all
the clients that are associated on that particular access point
and no other access point will be affected.
Take a look that it has seen under the notes.
It's used in the PM K I D.
It has captured approved and notice the PM K I D
is also found. We,
we will leave this attack to run just a little longer
and great. It has captured the W P A handshake.
Excellent.
I'm gonna stop the de authentication attack and I'm also gonna stop ado
from writing the information like so gonna type Claire
and type LS L to view the captured files.
As we can see,
we have the WPA two capture file for the target on the score network.
To perform the, I'm simply gonna copy the name of the dot c p file,
like, so I'm gonna type Claire, I'm gonna type pseudo
aircraft NG,
followed by the name of the cap file followed by dash w.
To specify a password list,
we'll use a RO password list.
So I'll type slash user share woodless
and roq the T X D.
I'm going to enter to start the password cracking brute force attack.
It's asking which network because it captured for multiple networks.
If you look closely under the encryption column,
we can see it has one handshake,
but ensure that you select your target network on no other networks.
I'm going to press option two to specify target on the score network.
And currently this performing a brute force password attack against a captured
file. And here we have found the key to access the wireless network.
This key might be simple,
but it is definitely a proof of concept showing how a brute force password
attack could be used on a WPA and a WPA two network.
We can use this password to access the wireless network and even
compromised clients that associated on that same wireless infrastructure.
During this video,
you have learned how to compromise a W P E two wireless network.
In the next video, we'll be starting with section 10. I hope you're excited.
So I'll see you there.