Instructor: In the previous lecture,
we've seen how easy it is to crack WEP.
All we had to do is capture enough data
and then run aircrack-ng to crack the encryption
and give me the key.
Now, one problem that we could face
is if the network is not busy.
If it's not busy,
then the number of data
will be increasing very, very slowly.
Therefore, we're gonna have to wait
for a while before we have enough data
to crack the key.
So let me show you an example.
I'm just gonna run airodump-ng here
and list all the networks around me.
And you can see I have my test network,
my Test AP in here, it's using WEP.
And if you look under the Data,
you'll see that it's at zero
and it's not increasing
and even if it's gonna increase,
it's gonna increase very, very slowly
which means that I'm gonna have to be waiting
for hours before I can crack this network.
So a solution to this
is to force the AP to generate new packets with new IVs.
Now, before doing this,
we need to associate with this network.
So what I mean by associate
is we need to tell this network
that we want to communicate with it
because by default,
access points ignore any requests they get
unless the device has connected to this network
or associated with it.
So don't get this mixed up with connecting.
We're still unable to connect to the network
because we need the password to be able to connect
to the network
but what we're doing right now
is literally just telling the target network look,
I want to communicate with you.
Don't ignore my requests.
That's all we're doing.
So it's something similar to what happens
when you just click on the network when you want
to connect to it.
You still haven't put the password,
you just telling the target network
I want to communicate with you,
please don't ignore me.
So in this lecture, I'm gonna show you
how to associate with the target network
so we can communicate with it
and in the next lecture,
I'm gonna show you how once associated,
we can inject packets into the network
and force the number of data to increase very, very quickly.
First, I'm going to run airodump.ng
against my target network
which has this BSSID.
So I'm gonna copy it
and we're gonna use the exact same command
that we've been using so far.
So we're gonna do airodump.ng --bssid
followed by the MAC address of my target --channel
followed by the channel
which my target is running on which is six
and we're gonna store all of this.
So we're gonna do --write
and we'll call this file arpreplay
because that's the name of the attack.
And then I'm gonna put my wireless adapter
in monitor mode which is mon0.
So a very simple command that we've done before.
We're using airodump.ng to capture data
from a network with this MAC address,
running on this channel,
we're storing everything in a file called arpreplay.
I'm gonna hit Enter
and as you can see, it's running against my target
and notice the data is increasing really, really slow
or it's actually not increasing at all right now.
Now, to associate with this network,
we're going to use a program called aireplay-ng.
So we're gonna type aireplay-ng
followed by --fakeauth
because we want to do a fake authentication attack.
We're gonna put zero
because we only want to do this once.
We're gonna do -a to specify the MAC address
of the target network.
So I'm gonna paste it, I've already copied it.
Then we're gonna do -h
to specify the MAC address of my wireless adapter
and to get the MAC address of my wireless adapter,
I'm gonna do ifconfig.
And it's the first 12 digits of the unspec field.
Usually you'd see it after the ether
but when you enable monitor mode,
it'll show up like so.
So I'm gonna copy this.
And I'm gonna paste it here.
And I'm gonna replace the minuses with colons.
And that's it, it's done.
And finally, I'm just gonna give the name
of my wireless adapter in monitor mode.
So a very simple command.
We're using aireplay-ng
which is a tool that can be used
to run a number of attacks
and we've seen using this with the de-authentication attack.
We're telling it that we want
to run a fake authentication attack.
We wanna do this once.
We're giving it the MAC address of my target network
after the a.
Then I'm giving it the MAC address of my wireless adapter
after the h
an finally, I'm giving it my wireless adapter
in monitor mode.
Now before I run this,
notice in here under the AUTH, we have nothing.
And we don't have any clients showing up in here
at the bottom.
Now, if I hit Enter,
you can see under the AUTH,
it's showing up as OPN
and you can see we have a new client here associated
with the network.
If you look in here,
you'll see this is the MAC address of my target network
and right here is the MAC address
of my wireless adapter.
So right now, I am associated with the target network
and if I send it anything,
it's going to accept it
and it's gonna communicate with me.
Again, I am not connected to the network,
I still can't use the internet,
I'm literally just associated with the network
so I can communicate with it.
Now, in the next lecture,
I'm gonna show you how we can communicate
with this network in a way
to force it into generating new packets
with new IVs which will allow us
to crack the key very, very quickly.