In the last lecture we've seen how to capture the encrypted 4-way handshake of WPA2 that contains
the password of the WiFi network.
These are the files that contain the encrypted 4-way handshake.
Now we'll go ahead and see how to crack it.
Note that it's encrypted with AES
and if the password is a strong one, which means at least 12 random characters, we will not be able to
crack it in a reasonable amount of time.
All we can do is to launch a dictionary or a hybrid attack on the encrypted password using a word
list.
There are lots of wordlists available online but I’ll use one that's already on Kali.
The tool I'm going to use to crack the password is aircrack-ng. So aircrack-ng
the name of the file that contains the handshake, there are two files so I'll put a star here,
-w and the path to the worlist, to the dictionary file; and I'll use one that has come with
Metaslpoit; it's in usr/share/ metaslpoit-framework/ data/
wordlists/password.lst and I'm hitting enter
see how it's trying to crack the password.
If the password is found it will be printed on the screen.
Remember that the word list is critical.
If the one you have chosen is not good advanced to a larger, more complete dictionary file.
In this example I've set up a weak password on purpose so we can correct it easily; and we are waiting
a few seconds.
OK it was cracked and we can see it; the WiFi password is "sunriseview".
It has 11 characters but it's a dictionary word,
so it's not a good one! Use only random characters! Note that there could be other layers of encryption
used
and if you found the password it doesn't mean that you can sniff and see all traffic in clear text.
If someone uses https or ssh
the traffic will be encrypted by those protocols as well.
In this lecture we've used aircrack but another excellent piece of software that I want you to be aware
of is cowpatty, which seems a little bit faster and can implement an accelerated dictionary or hybrid
attack against the WPA 2 networks using pre shared key based authentication. On Kali
you install it by simply executing apt install
cowpatty
Check that you have a running Internet connection before executing this command.
If you have only one connection to the Internet using the WiFi card in it's put in monitor mode it won't
work.
So put the card back into managed mode and then run this command. That was the classical approach to
cracking WPA2. Note that it has two downsides!
The first is that someone is required to be connected to the network to attack it. The network password
might be weak and very easy to crack
but without a device connected to kickoff briefly there is no opportunity to capture the 4-Way Handshake
thus no chance to try cracking it.
The second downside of this tactic involves actively sending packets.
This is in fact a denial of service attack that can cause legal problems.
There is also another new method available to crack WPA 2
that doesn't require a connected device to the network you want to attack.
The process consists of obtaining a single year Paul Frame to capture the needed information to attempt
a brute force attack.
This attack can be launched using Bettercap, which is presented in detail in this course or using
Hashcat. I'll attach some resources to this lecture if you want to go deeper into it. As a positive conclusion
of this lecture
we can say that as long as we have a very strong passphrase, WPA2 is extremely secure and we don’t
have to worry too much.