Hello everybody and welcome back to the next section of our ethical hacking course.
Now in the previous section we cover the weapon contagion testing attacks and some of the basic and
some of the more advanced attacks.
But in this section we will cover the some of the attacks used to gather the access to the wireless
access point network.
Now we will cover two types of the attacks for this part which is the brute force dictionary attack
on the advance access point and the uh evil twin attack.
We will use the VBA and we P to a type of wireless access points we play 3 is the new with one but it
is still not widely used.
It came out last year I believe in June 2018 and it is still not used in in regular places.
BPA 3 basically will be the most secured one and it will prevent some of the attacks that were able
that we were able to perform on the BP two and the BP type of wireless access points.
So what I have right here is the a little bit bad drawing of a dictionary based attack on a dictionary
based basically the type of attack where we actually sniff the four way handshake of a wireless access
point.
Now the four way handshake is basically a process that the client performs in order to connect to the
wireless access point.
It is called a four way handshake because it is consisted from four parts
now in order for us together the four way handshake we would need to uh basically the entire process
can be summed up in one sentence.
So basically we need to disconnect the client from the from the wireless access point and sniff the
four way handshake as soon as he tries to connect back.
That will be the entire process that we will be doing so to process in detailed would be that we need
to send something called the D authentication frames.
Now the authentication frame is a frame sent from a station uh wishing to terminate connection from
another station.
So basically the authentication frame is something that the client sends to the violence access point
when he wants to disconnect from it.
And the thing is that we can spoof the MAC address of all of the clients that are connected to the pilot's
access point and make them connected.
It's of us.
So basically if you wanted to on any wireless access point you can send the authentication frames and
disconnect all of the other clients from the wireless access point without you even having the access
to it.
Now we will do that in detail and impractical in the next lectures but for now on you should just know
that that we will basically put the MAC address and send the authentication frames in order to disconnect
a client from a wireless access point.
The thing is we can do that for as long as we want.
If we wanted to we could authenticate them for 24 hours but most likely we will only be wanting to do
that for a few seconds.
So as soon as we talk stop there the authentication attack the client will automatically connect back
to the wireless access point and when he does that when the client automatically connects back we basically
gather something called a four way handshake which is the handshake where the client will send the passwords
to the party's access point.
Now the problem is that the password that we will gather from the four way handshake will be encrypted
and that's what comes the dictionary based attack which is basically after this we only want to uh brute
force the hash that we received with a dictionary but we will talk about that in detail later on the
we would basically just need to find out the word that is corresponded to that has that we received
from the four way handshake.
But that process doesn't really have anything to do with the far less hacking and the far less hacking
is basically on consisted from the authenticating the client and then gathering the form a handshake
basically that is the first attack that we will do.
Now the second attack that we will do is basically we will create a de.
We will recreate the same access point that we want to hack.
That's called the evil twin access point.
Uh that is main purposes of that is also one of the main purposes why we use the authentication.
Uh basically we want to force clients to connect to our evil twin access point which then can be used
to capture net packets transfer Bitcoin between the client and our access point.
Now how we do that.
Well we basically try to make the identical access point as the one that we are attacking and then once
we do that we basically send in the authentication packets to the clients connected to device access
point and then we hope that they will connect back to our access point instead of the uh real uh and
legit exploit that they will connect it to before.
Now in order for us to perform both of these attacks you will need two things.
And the first one is the monitor mode and enabled on the your wireless network card.
Now if you don't have the monitor mode uh option on your network already you will basically need to
buy a cheap natural color that has the monitor mode enabled on it basically anywhere you like.
You can go to your local store and try to find it.
Just ask you see this card it has the monitor mode the option on it.
Uh that is also the reason why I will be recording all of these attacks on my laptop instead of the
clinic's machine or basically only the first part of the attack.
Will record on the laptop and then after that we will go on to our clinic's machine.
Since I have monitored mode enabled on my laptop and I don't have a wireless card for my Kelvin it's
machine and the second thing that you might need is the antenna for a stronger signal an evil twin attack.
Now that is not uh a must.
You do not need it if you don't want it but it can make your attack perform better.
Since if you have a stronger signal after you do authenticate these two clients they will most likely
connect back to you instead of the real access point but you do not need it.
We will we can perform the evil twin attack even without the antenna for a stronger signal.
So but the first thing that I said You will need uh.
You cannot perform any of these attacks without the monitor remote on your network card.
So make sure you get that to work before you continue with this action.
That would basically be some of the theory behind all these attacks.
We will of course cover them in greater detail and impractical in the next lectures.
Now some of you might ask why aren't we also attacking we pay three.
Well as I said basically BP 3 is newer version and it is not widely used yet in the world uh.
And there is no point to attack something that basically doesn't have a vulnerability yet.
Uh.
And basically isn't used yet.
Now they did discover.
Do you want ability I believe last year when it came out which is also more ability for BP to uh basically
I believe some hacker developer found a way to crack the network without involving the four way handshake.
So basically we did lead to this attack I believe the attacker sends a single April frame to the access
point.
They didn't get back the airways master key and use hash get to generate the PRICHEP Turkey now hash
get is a program that we will use in order to crack the hash of the password that we received from the
following handshake.
I will show you that program later on and how to use it.
And we tell reasonably cheap you cracking infrastructure many systems could you could crack many systems
in just a few days or even less.
Some of some of the systems you could basically crack in just a few seconds.
Now the dictionary based attack for some of you that are wondering is not possible on the PPA three
which is the new wireless access point security measures.
Basically the replay to for handshake uh was suitable to offline dictionary based text which we will
cover especially when short passwords under 16 characters were employed but we pay three handshake protocol
forces of real time attacks essentially eliminating the dictionary attack techniques which basically
means in DPP to attack which we will cover.
Basically once you get ready for a handshake you do not even need to be near the pilot's access point.
You can just go on the other side of the world and still perform the dictionary brute force since you
have a four way handshake captured in the packet that you have saved on your calendar machine for example
and then later on you do not need to be any we need the pilots at this point in order to try to brute
force that hash but that type of attack won't be able to we won't be able to do on the BP three and
also the BP three uses these simultaneous authentication of equals or as a e to replace the BP 2s appreciate
key which is key exchange protocol which is also the four way handshake the as a is a more secure protocol
for handling the initial key exchange.
Uh.
And SAIC also known as the dragon's key exchange uses former secrecy and is resistant to offline decryption
attacks
so that's about it for the theoretical part.
Uh we will of course cover it in greater detail later on but for now on this is just some of the basics
that you should know in order to more easily understand the attackers will perform.
And also you need to gather as you said the money network card with monitor mode option uh on it and
then you will be set to go.
So that is put it for the fury part in the next lecture.
I will start with putting our network called in monitor mode and starting our dictionary based attack.
So I hope I see you in the next lecture and taker by.