Instructor: Now if WPS is disabled
on your target network, or if it's enabled,
but configured to use push button or PBC,
then the method that I showed you in the previous lecture
will not work.
Therefore you will have to go and crack the actual WPA
or WPA to encryption.
And like I said, when these encryptions were designed,
the developers knew about the weaknesses in WEP
and they made sure that they properly fix these weaknesses.
They actually did a pretty good job at this.
Therefore, we cannot use the same method used in WEP
to crack WPA and WPA2.
So in WPA2, the keys are unique, they're temporary.
They're much longer than what they were in WEP.
Therefore the packet sent in the air contained
no information that is useful for us.
So it doesn't matter even if we capture 1 million packets,
we can't use them to crack the key.
The only packets that contain useful information
are the handshake pockets.
These are four pockets transferred between a client
and the router when the client connects to the network.
So in this lecture,
I'm gonna show you how to capture these pockets.
And in the next lectures,
we'll see how to use them to crack the WPA or WPA2 key.
First of all, as usual, you'd wanna run airodump-ng
against all the networks around you.
I've already done that and as you can see,
this is my target right here.
It's using WPA2 and this is the Mac address,
I'm gonna copy it.
And the first thing we'll do is just run airodump-ng
on this network and store the data in a file,
exactly the same way that we used to do with WEP.
So we're just gonna do airodump-ng --bssid
and give it bssid of my target, --channel
and give it the channel of my target
which is 1 --write, to specify a file name,
to store all the data that we're gonna capture in.
And let's call this WPA handshake
because we're gonna capture the handshake.
And finally we're gonna give it my wireless adapter
in monitor mode, which is mon0.
So, very simple command.
We've done this multiple times by now,
we're using airodump-ng,
we're giving it the Mac address of my target,
after the bssid, I'm giving a --channel
to specify the channel of my target.
I'm using --write to store all the data in a file.
This file will contain everything that we capture.
So if we capture the handshake, it will be in this file.
And finally,
I'm giving it the name of my wireless adapter
in monitor mode.
So now I'm gonna hit enter.
And as you can see, airodump-ng
is working against my target network.
And right now,
all we have to do is literally sit down
and wait for the handshake to be captured.
Like I said,
the handshake is sent when a client connects to the network.
So we'll literally have to sit down and wait until a new
client connect to the network.
Once a new client connects,
we will capture the handshake and you will see in here,
airodump telling us that the handshake has been captured.
Alternatively, we can use something that we learned before,
which is a deauthentication attack.
We know using that attack,
we can disconnect the client from the network.
So we can do this for a very short period of time.
We can disconnect this client from the network.
He will automatically connect once we stop the attack.
Therefore, when he automatically connects,
the handshake will be sent in the air
and we will be able to capture it,
this way we will not have to sit down
and wait for someone to voluntarily connect to the network.
So we've seen how to do this before,
and it's gonna be exactly the same command
as we did it before,
we used aireplay-ng, we did --deauth.
Then we specified a really large number of packets
to keep the client disconnected for a long period of time.
This time I'm gonna set this to four,
to only send four deauthentication packets.
This way, my client will be disconnected
for a very short period of time.
They won't even feel that they got disconnected,
but this is enough for the handshake to be sent
because they will be disconnected.
They will automatically connect.
And when they do that, we will capture the handshake.
Now, the next argument we wanna set
is the Mac address of my target.
So we're gonna do -a
followed by the Mac address of my target.
Then we're gonna do -c followed by the Mac address
of the client that we want to disconnect.
So it's this client right here.
I'm gonna copy, paste it here.
And finally, we're gonna give it the name
of my wireless adapter in monitor mode, which is mon0.
And we are done.
Again I've spent a full lecture on this command
explaining what a deauthentication attack is.
So if it's a bit confusing
please go back and revise that lecture.
Basically, all we're doing is we're using aireplay-ng
to run a deauthentication attack,
to disconnect this device for a very short period of time.
That's why I'm setting this to only number four,
then I'm using -a,
to specify the Mac address of my target, -c to specify
the Mac address of the client connected to this network.
And then I'm giving it to my wireless adapter
in monitor mode.
Now I'm gonna hit Enter
and keep an eye on this side right here.
You'll see the handshake will be captured in here.
So we're gonna hit Enter, deauthentication packets
are being sent and perfect.
As you can see, once the client connected again,
we receive the handshake.
So now we can quit airodump-ng.
So Control C because we have the handshake.
Now it is stored in the file that we set
after the right option, which is called WPA handshake.
And in the next lecture,
I'll show you how this handshake can be used
to get the key for the network.