WPA and WPA 2 are replacements for WEP, which has been proven flawed and easy to crack. Nowadays
WPA 2 with pre shared key or enterprise protects all WiFi communications.
WPA 2 uses advanced encryption standard, as the encryption protocol, which is very secure and impossible
to crack.
The weakness in the WPA2 pre shared key protocol is that the encrypted bpassword is shared in what
is known as the 4-way handshake.
This handshake is exchanged when a client wants to join a protected WiFi network and is used to confirm
that both the client and the access point possess the correct credential which is the pre shared key of
the network.
At the same time the 4-way handshake also negotiates a fresh encryption key that will be used to
encrypt all subsequent traffic ; if we can grab the handshake at that time we can then attempt to crack it.
So hacking WPA2-PSK consists of 3 different phases.
The first phase of the attack consists of injecting the deauthentication packets to make a WiFi client
to deauthenticate from the network.
Once deauthenticated,
the client will try to reconnect to the network.
This is the second phase when we grep we grab the WPA2 4-way handshake
Of course we can wait for a new client to authenticate to the network and capture the 4-way handshake
at that moment.
However it is more appropriate to make the client to dauthenticate and then authenticate back to the
WiFi network. I've talked about that deauthentication attack in the previous lecture; and the last
the third phase, is to try to crack the 4-Way Handshake which is encrypted with AES offline.
Note that if the WiFi network uses a strong password, and that means at least 12 or 14 random characters
including letters digits and symbols, you will not be able to crack the password in a reasonable amount
of time.
Let's get started with a live lab!
Now the interface wland0o is in managed mode. I'll execute the first phase which is deauthentication
attack using airplay-ng which is part of aircrack-ng package.
I'll do it fast without too many explanations because I've already done it in detail in the previous
lecture.
Take a look there if you feel the need!
First I am putting the card into monitor mode using airmon -ng. I'm killing the processes that could
interfere.
This will take up to 10 seconds
and I am putting the card into monitor mode.
Now the WiFi card is working in monitor mode.
Let's sniff the WiFi traffic to identify the network and the targe:t airdump -
i and the name of the interface wlan0mon
Okay.
This is the target network
" hack me" so I'm gonna sniff traffic only of that network.
So --bssid and the Mac of the AP, this one,
-c 1; it's working on channel 1.
These are the connected clients.
I'll take one of them and I'll kick it off making it to automatically reauthenticate whereby i can grab the
encrypted password sent in the process.
I want to save the captured traffic into a file so I'm stopping airdump-ng
and I'm starting it again adding -w, it's used to write to a file, and the name of the file to write
to, let's say wpa2crack.
So it will write to this file
in this terminal
I'm lunching the attack, the deauthentication attack/: airplay -ng --deauth I'm
gonna send only 3 frames, 3 deauthentication frames,
I want the client to be able to reconnect to the network -a the MAC address of the AP and -
c the MAC address of a client.
I'm gonna take the first client and the name of the interface wlen0mon
Look here: we see how the client was deauthenticated and then reauthenticated
back to the network. I've captured the WPA2 handshake successfully. Take a closer look at airdump -ng.
We notice at the top WPA handshake.
This is the way it tells us we have successfully captured the encrypted password. I'm stopping airdump-ng
by pressing Ctr C and if I execute a ls we'll see two files in the current working directory.
These files contain the WPA 2 4-Way handshake; that was the second phase of the attack.
The last phase consists of the attempt to crack the encrypted password offline.
Now we'll take a short break and in the next lecture I'll show you how to do it.