In this lecture we'll talk about the Deauthentication Attack which is an attack of type DoS
that targets the communication between a wifi client and the wireless AP or router.
The IEEE 802.11 protocol defines a spatial management frame called deauthentication
frame.
This frame is sent by an access point to a station as a sanction technique to inform the station that
it has to disconnect from the network immediately. The deauthentication attack works on wpa 2 despite
encryption. To perform the attack
the hacker does not have to know the WiFi network password and there is no need to be authenticated
or connected to the network.
These frames are not authenticated or protected in any way and anyone can inject them into the network.
Note that wpa2 does not encrypt the headers of the packets only the payload; also note that
deauthentication attack isn't some special exploit or bug; it's built in the WiFi protocol to be used
in real world applications like client disassociated due to inactivity. Many times
this attack is the starting point for other attacks yet to come.
One of the main purposes of the deauthentication used in the hacking community is to deauthenticate the
client to capture the WPA2 4-Way Handshake
by forcing the user to reconnect to the network.
The WPA handshake is used to crack the wireless password and is exchanged only at the beginning
in the authentication phase. We'll have a dedicated to lecture on this topic later in the course.
Other purposes of this attack is to force the user to connect to the hackers rogue access point
or to a captive portal.
This is also called the Evil Twin Attack.
Of course it can only be a denial of service attack and the there were cases when the user were continuously
disconnected from the network at conferences.
It was also the case when hotels and other companies have lunched deauthentication attacks on their
own guests;
the purpose being to drive them off their own personal hotspots and force them to pay for onsite
WiFi services.
OK, let's get started!
I'll show you this
attack live. I set up a wireless network called " hack me " special for this lab; both my mobile phone and
the Windows recording machine are now connected to that WiFi network.
The attack will be performed on Kali Linux. Before continuing
note that you need a card that supports monitor mode and packet injection.
Remember that you cannot use a monitor mode on Windows.
I'd recommend you to watch the previous lectures where I've explained how to check if the WiFi card
supports monitor mode and packet injection. So the first step is to put the card into monitor mode.
This is the WiFi interface and I'll use airmon -ng to put the card into monitor mode.
First I want to see the process that could interfere with putting the interface into a monitor mode:
so airmon-ng check and I'm killing these processes airmon-ng check check.
kill
okay.
The next step is to put the interface into monitor mode: airmon-ng start and the name of the
interface wlan0.
Now the WiFi card is working in monitor mode.
I'm checking it with iwconfig.
Perfect! In the next step
I'll sniff the WiFi traffic to identify the network and the targets: airdump-ng -i
and the name of the interface
now the name of the interface is wlan0mon.
I'm sniffing WiFi traffic.
Okay; it's not looking very well
so I'm changing the theme; I'll use Kali dark; okay!
It's better!
This column called BSSID lists
the MAC addresses of all access points in the range; there are so many WiFi networks in the range.
I want to narrow down the results and I'll sniff
only the traffic for that that network on the channel the network operates, so only for "heck me" on
channel 1.
This is the channel column so I'm adding --bssid and the MAC address of the access point
and the -c from channel 1
and is sniffing traffic
only of this WiFi network on Channel 1. In this section you see the clients that are connected to the
network.
By the way if you don't see the clients check that you sniff on the same frequency band 2.4
or 5 gigahertz. You could temporarily disable the 5 gigahertz frequency, like I did for this lab.
In this section we are seeing which wireless devices are connected; we have to pick an access point that
has at least one device associated to it ,for this attack to work. In this example I'll attack the Windows
client that is connected to this WiFi network, the Windows machine I am using for recording. You see
that it's connected to "hack me" network. Let's check its MAC address ipconfig / all so the MAC address
of the WiFi card is this one: 30-24-32-E2-OF-59, this one, the second
client in the list. I'm opening a new terminal and becoming root there as well and I'm starting
the attack. I'm going to use airplay-ng which is part of aircrack package: so airplay-ng -
- deauth the type of the attack, it can inject also other types of frames, how many frames
I want to send and I want to send a lot of do deauthentication frames, something like this, now -a and
the MAC address of the access point
-c and the MAC address of the client; let's check it again!
Okay the second one! And the name of the WiFi card wlan0mon; if you want to send continuously you
can use 0 instead of this value. Before starting the attack I want to check that the Internet is working.
I'll continuously ping this address and of course it's working and I'm starting the attack.
The ping has stopped and the client was deauthenticated. See how it's trying to reconnect; the Windows
machine was forced to deauthenticate. The deauthentication frames are sent continuously so the device
has no chance to authenticate and to connect back to the network. When I want to stop the attack
I simply press on Ctr +C. I've stopped it. As soon as the deauthentication stops the device t
reconnects to the access point and we will capture the WPA 2 4 Way Handshake used to connect the WiFi
password.
OK it has reconnected; and ping is working again. OK, that's all about the deauthentication attack. In the
next lecture I'll show you how to use this attack to capture the WPA 2-4 Way Handshake and crack
the WiFi key.