Instructor: In the last lecture,
we've seen to use airodump-ng
to list all the networks around us
and display useful information about them.
Usually, we do this in order
to see our target network,
see the signal strength, see how far we are from it
and then start targeting this target network.
Now, in this example,
I'm gonna assume that my target network
is this one right here.
This is actually the network
that my host machine is connected to
and now that I have my target network,
and I have some basic information about it,
let's see how we can run airodump-ng
against this network only,
not against all networks.
And this way, we'll be able
to gather more information about it.
So to do this, first of all,
I'm gonna have to write the name of my program
which is airodump-ng.
Then I'm going to specify a specific BSSID
or a specific MAC address
for airodump-ng to sniff data from.
So my target network has a BSSID of this.
We can see it here under the BSSID.
So I'm gonna copy it
and then I'm gonna do --bssid
and I'm gonna give it the BSSID that I just copied.
Next, I'm gonna specify a channel
for airodump-ng to sniff.
Again, if we look under the Channel column in here,
we can see my target network
is on channel two.
So I'm gonna do --channel 2.
So now, we're telling airodump-ng
that I want you to sniff data on channel two
and only from a network that has this BSSID.
I'm also going to tell airodump-ng
that I want you to store all the data
that you're gonna gather for me in a file.
So I'm gonna say --write
and then I'm gonna type a file name
and let's call this test
and at the end, as usual,
I need to give it the name of my wireless adapter
in monitor mode
which is mon0 in my case.
So a very simple command.
Let's go over it one more time.
We're doing airodump-ng,
that's the name of the program that I wanna use.
I'm telling it that I only want you to sniff data
from a specific bssid.
Then I'm giving it the BSSID of my target.
Then I'm telling it I want you to only sniff data
from a specific channel
and I'm giving it the channel
that I want it to sniff data from,
again, we can get it from here, it's number two.
Finally, I'm telling it that I want you
to write all the data
that you're gonna capture in a file
that we're gonna call it test
and then I'm giving it my wireless adapter
in monitor mode which is mon0.
Now, I'm gonna hit Enter.
And as you can see, unlike the last time,
airodump-ng is only showing me one network in here.
This is the network that I wanted it to sniff data on.
And we can also see,
we have a completely new section right now.
So when I run airodump-ng in the previous lecture,
you've seen I only had the networks in here
and I had nothing here at the bottom.
But now, you can see we have more entries in here
at the second section of networks
and basically, anything that you see here
in the second section,
these are the clients or the devices connected
to this network.
So right now, we can see this network
has three devices connected to it
and you can see the MAC addresses of these devices
under the Station.
So you can see all of these devices
are connected to the same network.
So the BSSID is still the same,
this is the MAC address of the network
and under the Station,
we have the different clients or different devices connected
to this network.
We can also see the Power, so this is the signal strength
of each of these devices.
We can see the speed,
we can see the amount of data lost,
we can see the amount of frames or packets
that we have captured
and we can see if any of these devices
are still probing for networks.
So sometimes, when you run airodump-ng
against all networks,
you'd still see the section
and you'd see that some devices
are not connected and they're literally trying
or looking for networks.
So you'd see the name of the networks
that they're looking for under the Probe.
Now, if I hit Control + C,
airodump-ng will quit, it'll stop working
but I should have new files in my current working directory
that contain the data
that we just captured 'cause remember,
when we run the command, we use the write option in here
to store the data in a file called test.
So if I just do ls to list all the files
in my current working directory,
you can see I have four files,
all of them start with test.
But they all have different extensions.
So we have a CSV, we have a netxml,
we have a cap
and we have a Kismet.csv.
Now also notice that airodump-ng
automatically appended minus 01
to each of these files.
So in the future, when you go
and try to use the capture file,
make sure you append -01
to the file name that you specified in the command.
Now, the main file that we're gonna be using
is the cap file.
Again, this file contains the data
that we captured during the period
that airodump-ng was working on in here.
And basically this file should contain everything
that was sent to and from my target network.
So it should contain URLs,
chat messages, usernames, passwords
or anything that any of these devices did on the internet
because anything that they have to do
will have to be sent to the router
as we've seen before.
The only problem is if you look at the encryption in here,
you can see that my target network uses WPA2 encryption.
So all of the data sent between the router
and the clients is encrypted.
So let me show you what I mean.
I'm gonna use a tool called Wireshark
to analyze the data
and don't worry about how to use Wireshark.
We will talk about it in details later on.
Right now, I just want to make sure
that you understand the idea
that now we're able to capture all these packets,
the only problem is these packets are encrypted.
So I'm gonna do wireshark to run Wireshark.
And then I'm gonna open my capture file,
so I'm gonna go to File, Open
and it's already in my root directory,
so I'm just gonna scroll down
and select my test-01.cap.
I'm gonna open it
and I'll just put this in full screen
and as you can see,
if we click on any of these packets,
you see we really have no useful data.
You can see everything looks like gibberish
and we can't read anything
even though these packets might contain usernames,
passwords or URLs.
The only useful thing that we can see here
is the device manufacturer.
So we know one of the devices connected to the network
that has this specific MAC address,
so it's the one that ends with E8
and if we go up, we can see that it's this specific device,
we know now it is an Apple device.
So it could be an Apple computer,
it could be an iPhone or an iPad
and this is actually my MacBook computer
that is the host machine.
Again, we can see we also have a device
that's using a Huawei chip set
so this can be a phone or it could be the router.
And if you look at the MAC address here,
and compare it to the MAC addresses
that we have here, you can see
that this is actually under the BSSID
so this is the MAC address of the router.
So now we know that the brand
of my router is Huawei.
So we can gather more information
by opening this file in Wireshark
and we can kinda guess
what computers are there
and what operating systems they use
but this is not detailed enough
and the main problem with this
is the fact that the network is using encryption.
Now, in the next section,
we're gonna be talking about how to break this encryption
and once we do, you'll see how we can see the passwords,
the usernames in plain text
and you'll also see how we can map all
of the computers on the same network,
gather detailed information about them,
hack into them and do some really, really cool stuff.
Now, you should guess by everything that I said so far,
if this network was an open network,
if it was a network that does not use any passwords,
then you would have been able
to actually see all the URLs and everything
that they do in here.
But again, if you can't connect to the network
without a password,
then you'll automatically be at the post connection section
and in that section, like I said,
we're gonna talk about some really, really cool attacks
that you can do
once you have the password or once you can connect
to the network.
So don't worry about Wireshark for now.
I just wanted to make sure
that you understand why encryption is useful
and why it's used
and why we can't see much now
because we don't know the key.
We will talk about Wireshark and all of that later on
in the next section.