Hello everybody and welcome back to the wireless penetration testing section.
Now in the previous video we saw how we can actually put our wireless networking card into monitor mode.
Now that we know how to do that we will continue with the usage of the crack program that is being installed
in cabinets and it is used in order to capture the four way handshake.
And in order to crack the format handshake so open up your terminal and let's before we begin.
As I said we need to put our card into my remote now that we know how to do it.
I will just go over it briefly so I have config I have config.
And then my Mac one of this network interface then I put it down then I w config my wireless interface
and then mode monitor in order to put it into the monitor mode since as I already said it is by default
set in the managed mode and in the monitor mode we can inspect all of the packets around us.
So we need a monitor mode.
So let me just put my interface back up now and we are good to go.
Now the first thing that I want to use.
Let me just make this a little bit bigger so you can see it.
The first thing that I want to use or that I want to show you is simple command.
It looks something like this airman.
So just type in your account in its terminal.
If you're using these clinics airmen and G and then check and then the name of your wireless network
interface.
Now what this will do is basically it will list all the processes that could potentially cause some
trouble in the process of capturing the four way handshake.
Now these are all processes connected to your networking map network manager.
So as it says right here we can read it.
It says found for process that could cause trouble if aero dump and G airplane G or AirTran and G stops
working after a short period of time.
You may want to kill some of them.
Now this basically means that it can cause trouble in this process of capturing the former handshake.
Now in if you probably have a now you will probably have all this process as well.
And since my own experience you can only actually put down the network manager and the VBA supplicant
the dame on a process basically come back they respond after you kill them.
Now in order to kill you now you can use two methods to kill this process.
You can just type here kill and then the process idea which would be which would be a six one and then
you run this again.
That is one way to kill the process and the other way is to kill them all at once.
So just type here airmen and G check kill and then your network interface and it will kill all the process
that could cause you trouble.
So now if we run once again the probe to see if there are any processes there are not any at the moment
but you the some of them might respawn later on but you shouldn't really worry that much about it.
They probably won't cause you trouble then.
So now that we did it we want to basically set our network card once again into monitor mode since after
you can after you finish this process of killing all this process as you can see your card will be put
back into managed mode.
So after you kill all of this process you want to set your card once again into monitor mode.
So the same three commands that we used before and I have config as w 0 1 now up pardon me up and now
if we check with I w config our card is currently as you can see in monitor mode which is good.
So the next thing you want to do is basically now you want to inspect all of the countless networks
around you.
Now you do that that you do that with the commercial aero dump minus energy and all you need to do right
now is basically specify your networking wireless interface.
So in my case that is w 0 1 and in your case it will be basically anything that you output with this
command.
So as we can see it's right here don't use the same as I use.
I need to repeat once again or this won't work.
So let us just run aero dump and G and then w l 0 1 and as you can see it will start listing all of
the wireless networks around me now as we can see right here it prints out bunch of other options as
well.
Now the first thing you might notice and that is familiar to you are these right here.
Which stands under the column of SS I.D. which is basically just the names of the wireless.
So for example if you were to take your mobile phone and turn on a list you would be seeing all of these
names right here.
Now the violence that we will be testing will be this one right here.
Since it is my own Marlies and I have permission to test on it you should not be testing this method
or any other method of attack on anyone else.
You do not own or do not have permission to attack.
So that's why I will use my own wireless.
Now let's start off with the next column next to the name of the outlets which is which is basically
off and stands for authentication and we can see the there are a bunch of these escapees K which is
private Shirky which is just the method of authentication and the cipher is which cipher it uses.
Now my mother's use uses the key IP and most of the others use CCN IP that is not really that relevant
to our attack right now.
And encryption is as we can see we pay too.
Or in some cases it is we pay which also doesn't really matter in our case since we will be attacking
with the same method both of these and also we can see that there really isn't a tree yet.
So there is really no point in trying to exploit that for now on we will stick to the BP to the channel
is also something important the channel is something that you will specify in the next command.
It is the channel or basically on which your wireless access point is running on this data is basically
as it says data that is flowing beacons now beacons is basically our network frame for the as part pardon
me for the wireless access point which basically shows others that it is present.
It is basically just there to show its presence.
And these BW Are column right here is basically showing you how far away your access access your wireless
access point is.
So basically the much smaller the number the closer to you the wireless access point is now in my personal
case.
Uh this method won't work on any exploit that is a larger than minus seventy five because that means
that that access point is too far from us and we will not be able to capture the four way handshake
or the authentically anyone at that distance.
So if you wanted to for example test any of these lower uh wireless access points you would need to
get closer to them in order to perform the attack and the last column right here is the B SSA D which
is basically the MAC addresses the physical addresses of d of the other access points which is also
really important and which you will use in our attack so in order to stop this since as we can see this
is in live mode which means it updates every second the state of these five six points you just procedural
C and you can also expected in static mode as we can see right here which is good when you want to call
it something if it's running in light mode you really can't copy anything.
Now the next command we want to do now that we decided which wireless access point are we attacking
and now that we saw the options for it which this one are we attacking which is dark matter the channel
is three for that fathers access point and the MAC address is this one for our wireless access point
now that we know all of that we want to type next command which is aero dump minus and G then minus
C and D minus C stands basically for channel.
So after that you just type your space and see on which channel is your access point funding in my case
that is channel number three.
And once you do that you type after that space and then minus minus B as society.
Now as we can see from the table right here d b as I say d is basically this column right here so after
this we need to specify the MAC address of our wireless access point which in my case is this one so
I copy it i paste it right here and now.
Now basically that we did it we can actually run this command and it will only focus on our own wireless
access point and it will also see which uh which our devices are connected to it or basically the MAC
addresses of the devices that are connected to it now it gave me the error because I didn't specify
the w l 0 1 which is my borderless network interface so you need to specify it in every command as I
said.
So basically just enter now and you can see that right now we only see our wireless access point that
we are penetrated that we are testing and soon we should see some of the MAC addresses popping up right
here which basically shows the devices that are connected to the access point as we can see there is
one which is basically my I believe the phone mobile phone now not traditionally there is any other
connected at the moment I mean I am not connected on my laptop and I am not connected on my P.C. so
it's probably it which is enough.
Basically one user on the virus is enough for us to authenticate it and make him reconnect and capture
the four way handshake.
But how do we do that.
Now that we know how to specify a single wireless access point in order to scan it now we will use the
same command here and we will write the output to a file.
So just please proceed here.
See and you can basically just throw up.
So the same command right here.
And before we specify the wireless network interface we want to type here minus V.
Command and which stands for basically right to a file and then the name of the file we can name the
file.
Basically anything we want.
What.
Let me just now to the desktop first.
So it saves it there and let us just run the same command once again or not the same.
We want to specify minus W and then name of the file which is named my file scan.
So now that we named our file now we need to specify the network interface.
So w 1 and we run the same comment and as we can see right here it is now writing the stuff that it
captures in the file.
So the next thing we want to do now that is writing it in the file is basically the authenticate let
me just zoom this in the authenticate everyone on the wireless access point as we can see we can actually
perform that without being able to actually
be connected without being connected to the palace access point.
So how do we run the authentication attack.
We run it with the airplay minus and G and then we specify minus zero and then zero which basically
stands to authenticate said the authentication packets forever basically until we close the program.
The next thing we want to do is type here minus a and after minus say we paste the MAC address of our
wireless access point which you can also copy from right here now that we specify that only thing that
we need to specify right now is the wireless network interface.
So in my case w LR one now that we did that just press here enter and you will see that it is running
the the authentication attack.
Now this will run until we stop it and all the devices are now disconnected from the violence access
point.
My mobile phone you can't see it but it currently got disconnected and as soon as I stop this right
here with serial C it will connect back to the wireless access point and it right here we should see
the replay handshake as we can see it right here.
So we successfully successfully got the BP a four way handshake and we can now control see this program
as well so it Britain written the four way handshake into the file now that we got the file.
We will basically continue in the next two Corio and I will cut the tutorial short right here and I
will explain all the four files that we got and what we can do with it and what we should do with it
now.
That's about it for this editorial.
I hope you enjoyed it and I hope I see you in the next one.
By.