So in the previous lecture we've seen if we run a river against this particular network the network
will get locked and we won't be able to brute force the WPA spin because the network will just refuse
any requests.
So we said one of the ways to try and reset or get the network to get unlocked is to just run the authentication
attack like we did before and hope that one of the users will just go in and physically turn off the
router and then turn it back on.
And we said this is not a great way because we actually were relying on a person to go and turn off
the router but it has a high chance of success because what would you do when you lose internet connection.
Most people will just go and turn off their now a router and turn it back on.
So in this lecture were going to use a tool called MBK 3 and we're going to use it to run a didoes attack
a denial of service attack basically on the target network and in some routers this attack will just
flood the router.
And then it will cause the router to reset automatically and then when it resets it will get unlocked
as well.
So we'll be able to run river and start guessing the WPA Espen again.
And since reverse supports pause and rescue this cat can work really well so even if you're at 60 percent
and then the router locks you can just control Siri either run the attack get the router to be unlocked
and then run the attack again and it all starts from 60 percent.
It's not going to start from zero.
So I'm just going to split the screen here.
And I'm just going to run the tool that we're going to be using.
Is called M.D K3 and I'm going to type in help just to see the options that this tool gives us.
And we consider this to actually let us run a number of attacks and test modes are listed in here.
So the way the tool works is you specify the name of the tool.
You follow it up with your interface and monitor mode and then you follow it with the test mode which
are listed in here.
And then you give it the options for each of these test mode for this lecture we're going to be using
the option which is the authentication DOS mode.
So to see all the options and get more information about this attack we're going to do the K3 minus
minus help and then put the test mode which is a.
So I'm just going to do K3 minus minus help and I'm going to put a and this will give us more information
about the attack that we want to do so it's going to be an authentication those mood that's going to
send authentication frames to the AP.
So basically what it's going to do is we're going to specify a MYF address for our target and the K-3
will create fake mac addresses and get all of these MAC addresses to pretend as if their computers are
clients and these clients are trying to connect to that network when there is a very large number of
clients trying to connect to one network to one router.
Some routers will not be able to handle all this demand and they'll actually just restart and reset
everything.
And when they do that they'll unlock WPX and we'll be able to run river again.
So if you're on it if you're on indicator you with the option to do that on all the networks around
you.
So it's going to create a very large number of clients and it's going to get all of these clients to
connect to all the networks do you.
And we don't want that.
We only want to target one network.
So we're going to specify the target network with the minus option to specify the target mark.
And we're also going to use minus m to tell it that we want you to use valid Maxo marks of actual devices
instead of using a Mac that looks like it's fake like 000 000.
So let's run the command.
Let me show you the command that we're going to use and things are going to get more clear.
So the programs that we're going to use is called M.D K3.
Then we're going to give it the interface in monitor mode and it's 1 0.
In my case then we're going to give it the test mode or the attack mode and that's the authentication
DOS mode.
So that's going to be a and then we want to run that against only one specific router.
Not all routers.
So we're going to specify the minus a and give it the MAC address of my target's router which is the
same MAC address in here.
It's the same MAC address that's locked in here right here and then we're going to give it minus and
to tell it to use valid MAC addresses instead of just ones that look wrong.
So we're going to do minus.
And that's it we're ready to go.
So we're just going to go over the command one more time.
We're using a tool called M.D K3.
We're given at the interface in monitor mode.
In my case it's mon's euro Wartelle and we want to use the attack that's referred to with the option
which is the authentication DOS mode we're given it my target access point after the minus.
And then I'm giving it minus to use valid MAC addresses.
I'm going to hit enter and I actually misspelled M.D K-3 I said M-K D-3.
I do that a lot.
So it's MBK three hit enter
and you might see a result like this saying that the target computer see the target router does not
seem to be vulnerable but just let it work.
Sometimes you might have to let it work up to 50000 clients.
You can see that it's creating fake clients and it's trying to get them to connect to the router so
you can try to associate with the router really not connect and you can see that we reached 5000 clients
right here.
This could be different from one router to another.
So sometimes I had to let this go up to 50000.
In this case with my home router right here it usually resets between 5000 and 10000.
So I'm just going to let it go up to 10000 in this case.
And once it's 10000 like this I'm going to Control-C at the same time to get out of this and we're going
to run wash again to see if the network is still locked so you can see the last time around wash the
network was locked.
So I'm just going to give it some time to reset and then I'm just going to be run and wash the same
command that we always use this just wash minus.
I want zero and keep in mind this doesn't work against all routers but it works against a lot of routers
really but not all.
So it might not just work for you.
So I'm going to hit Enter now to look for networks around me.
Looks like something went wrong with my wireless card.
So I'm just going to disconnected reconnected enable monitor mode and run wash again.
OK so I'm just going to run wash again here.
And as you can see now our target network got reset and you can see that WPX is not locked anymore.
So I can actually start Rivara again and it will be able to pick up from where it left the last time.
So last time the pin count was left at 0 and right now if I run it again I'll be able to go to pin count
1 so I'll actually be able to test one more pin.
So if we just do revert again using the same command that we did before you can see that it's asking
me if I want to continue from where I left the last time I'm going to say yes please.
Now again the router got locked again.
Now what you can see that we managed to go ahead with one more pin to test one pin right now.
And if we do the same now get the router to unlock and do the same.
You'll be able to go to the next pin.
Now this network is actually a quite stubborn one usually networks lock after four or sometimes even
10 attempts.
Very rarely they lock after one attempt only.
But again this just serves with our examples.
The main thing is you can unlock most networks using this method use an empty K-3.