Hello everybody and welcome back to the next story all of the wireless penetration testing.
Now we is you can see right now I am back on my Kelly Linux machine.
That is because I finished everything I needed to finish with the capturing handshake and now I want
to get back to our main environment.
Since you don't get confused by me using the other Linux distributions now as I said only needed to
use it because I only had supported monitor mode on my laptop.
But now that we finished with capturing the handshake now we can continue with the process of attacking
basically from any other machine or basically from anywhere else.
You do not need to be anywhere close to the by this access point anymore since we got everything we
needed.
And now for example if you wanted to you could go to the other side of the world and crack this hash
that we received in our packet in our basically file that we were capturing packets in now you might
notice here I plugged in you as beat in order to transfer the the files that we received from our scanning.
Basically on my killing machine let me just connected leave it is this one in stone.
And now I will paste the files onto my Kelvin machine as we can see open with files
that does just let this load right here and basically you will notice that we actually received four
files from this scan.
One is not kept.
One is that CCTV one is not the case method CCTV and one is not Keith Smith does not.
Net net net x amount.
Now let me just open the terminal right here and let me enlarge this.
So you see it a little bit better now out of all these four files let me just first transfer them to
the to the root section.
So we will do that with more comments or more can you not cap scan CCD can CCTV and scan.
And we want to move it to the directory and as you can see you can also move all four files with one
command as I did right here and now I will inject not inject I will inject this use it right inject.
Anyway we don't need it anymore.
So let me just enlarge this terminal it now in the screen and go to the directory.
And as we can see right here there are the four files that we received from our scan.
Maybe it would be good if we put them in another directory so let's make directory called handshake
and then let's move all of these.
Once again I should have done this first but never mind.
We can do it right now.
And the last one which is kismet.
Net X amount and we want to move it into the handshake directory just
to name it like that which can shape.
OK.
And now if we change our directory to the handshake directory we should have these four files right
here.
Now you might ask yourself now what do we need for files for we only specified in the command to write
it to one file.
Well basically the only file we actually need from all of this is the scan that cap file this one if
you want to and we will actually we will delete all the other three since we don't really need them
at the moment.
So you can delete all of these other files.
We will not be needing them.
So let's just delete them.
And now we are left with the scan minus or wondered kept file now basically in this.
This is a file that we can open in March shark and we will open it in a few seconds.
And in this file we can see all the package that.
So basically while we will running did you indication attack and while the target was connecting to
our wireless access point we are for a handshake.
So in order for your interest to understand it how that all was done you can basically just leave.
You can just wash police file like this and it will open this file in the by a shark.
So let us see if this will actually work.
I believe it will OK.
And here it is.
We can see the file that we got from our scanning now basically.
Let us first find something that we can easily find right here.
So let me do scrolls in there.
A lot of packets.
And that is the the authentication package right here as we can see.
It says even here you can dictation and it will be probably the most common packet in this file right
here you can see it right here.
If we go down there you can also see some of the other options that has in it.
Some of these packets it will say that it is malformed let me just scroll down.
Let me just find a packet that could possibly be malformed.
Here it is the though the direct indication packet that is now thought malformed.
Pardon me and you can also inspect some of the other package that there are here but currently we are
only interested E for a handshake.
Now we know that it is somewhere towards the lower part since we basically quit the youth indication
and then right away the target has reconnected to the Internet.
So let us scroll past the deep indication and we should see just put put this a little bit down so we
see veteran and we will see the four way handshake as soon as this finishes as we can see it is right
here.
Now you can also do this.
You can also find the four way handshake.
We are equal.
I believe you type it or it is not kept the letters.
You can just type here.
Smaller letters equal.
And then press on this arrow right here and it will filter out only the packets that are epoch packets.
And as we can see right here here is day four with a handshake.
It even says message one out of four two out of four three out of four four out to four.
Now you can basically check out what are these contents of all of these four messages as we can see
they are different of course you can if you want to basically check out all of these right here which
is EPA key nonce which is this one.
Now there are a bunch of these other other stuff to actually together create the password that we use.
And also we can see from Hoyt percent and to whom it was sent to.
Now this right here the WHO away is basically my daughter and this right here is my mobile phone so
just want to show you that you can inspect the packets in var shark and you can also find a four way
handshake and look at it a little bit better if you wanted to but that is not really the case that we
need to do right here.
This is not necessary so I just closed the bar sharp.
The next thing that we want to do is basically run our attack on this file brute force attack.
Now how we do that.
Well there is another command that we need to use which is basically called the air crack.
Now the air crack is a problem.
This is basically just a program that uses our sleep you power our processor power in order to perform
the brute force attack on the hashed password.
Now how does it do that.
Well basically in clinics we have a pre installed principle.
We get the some of the board lists the most common and most used one.
And one of the biggest one is Rock You.
That is the name of the police.
It comes with around I believe 14 million passwords or something like that.
Not really sure the exact number but the thought behind this attack is basically that it hashes all
of that.
All of those 14 million passwords and it compares the hash to the hash of the password that we received
from our dot kept file and if the hatches match the aircraft will prompt us with these key phone message
and it will give us the password in plain text if it is found in that border list.
Now I will show you how to run that attack.
Basically you will need two things.
One of them is this file that we received which is scan y dot cap file or whatever you name it.
Dot cap file and you will also need any word list you want to use.
Now I will use the proc you want this since it is one of the biggest ones.
Let me just find it.
I'm not really sure where it is.
It is in the user share lists.
OK.
So we go to the user share support lists for lists is a directory.
So C D Oh yeah I didn't specify DCP.
So users share word lists.
And if I Alice right here you can see the rock you to the extent that GZ now this dodges means that
this file is basically zip.
So we need to unzip it.
Now let me just remember how do we do that.
It's not if we try on gossip rock you have to keep a G C ruptured and the fans cannot find a zip file.
Just see how we can unzip this.
Something I set for a GC appointment for the sure but to the actual command
GDP is to zip it.
We want to unzip it so I can just search right here since I forgot the command but it's okay.
Basically you will forget some of the command slots and all.
All you need to do is basically just search it in Google.
So sorry we're having trouble getting a page start.
New session.
And let me just turn on in case I have my burp suit from the previous to from the previous section which
was be that penetration testing section turned on as a proxy.
We want to turn it off so we can access the Internet.
And now we want to try how to unzip that zip file
and hopefully we will get the solution for this.
Now I'll probably remember the command as soon as I see it.
I can't seem to remember it right now
fathers you see the chip option give concept to keep option.
We want to unzip a file in the next
so it can see the keep option.
So it is called guns.
Let me just see.
Yeah it is.
So we just type here guns zip and then rock you dot the GC and we can see now if we type your l s we
will have the unzipped version of rock that the extreme.
Now if you cap this file right here you will see it will print out a bunch of these passwords.
It will print out basically 14 million passwords contained in these in this folder and we will use these.
This file basically or this part list in order to perform our brute force attack which we will continue
in the next lecture.
Now I know by default that my password is not in this list.
So I will run it once to show you how this works.
And I will run it a second time and put my password somewhere around someone near the beginning and
you will see how it finds the password.
So our city control see cities.
So we don't list all of the words.
It will take some time and I will continue showing you how to perform this attack in the next lecture.
Hope I see you there.
And bye bye.