Hello, everyone, welcome to your new video of our wi fi pantsing series.
Last time we talked a little bit about some wireless frames and today we will take a look at them using
Wireshark.
If you want to write your own wireless pin testing tools, you need to get comfortable with Wireshark.
Let's start first by putting our wireless interface in monster mode so we can see all of those frames
that we talked about earlier.
As you see, we did that using the air Manbij energy tool.
It's very easy to do that right now.
Let's switch our channel to Channel One since most of our access point using this channel.
Next, let's open Wireshark and start capturing those frames.
Now, since we only want to capture beacon frames, we can use Wireshark Filter to show us only beacon
frames.
The subtype number of beacon frames is number eight, let's use that to filter it now.
This subtype number is the key player when we identify our frames and we will use a lot later when we
write our own wireless testing tools.
If we look at the frames we captured here, it says Beacon Frame.
The radio attack, which is the first three five bites of the frame, has information like channel antenna
signal their rate and channel frequency.
Starting from bite number thirty six is a subtype bite.
This bite is very special and important.
It tells us what kind of frame is it if you hover over those hex bites, you should see the byte number
of each.
Byte number 36 six, which is this one here.
No, sorry, no bite, no, 36 is 80, right, this one, which indicates that this is a beacon frame.
So later, when we write our own python tool to scan for wireless networks, we will check for despite
not only when we scan for Wi-Fi access points, also when we get to the death indication, attack or
disassociate association attack.
Also we will use, despite what else we can learn from this beacon frame header, we can also get the
receiver address, a destination address and the source address, which is right here.
Receiver address, destination address, transmitter ADRIS.
Since the beacon frames are always from the access point, then the transmitter address and the source
address are the same.
The destination address or the receiver address are also the same, and they are broadcast.
Why?
It's a broadcast address because this frame is sent for everyone, not for a specific device.
Later, when we want to get those Mac addresses, we need to know the start and the ending byte of each
one of them.
So if you look here at the receiver address or transmit or address, it starts from forty six up to
fifty one.
If we look at the bottom bytes, number forty six to fifty one, we can do the same with every bit of
information we want to get from any header.
OK, but what about a suicide or a suicide.
Sometimes it's called extended service set identifier or the name of the access point we can find is
this name in the ATO to dot 11 wireless management part of the frame.
Let's expand it and see.
Here, this one.
Now, everything we discussed so far is actually fixed in length, but this is a side or as a side could
be different, right?
Because people give access points, different names and different names mean different length as well.
So in order for us to calculate exactly that, it's a side length, we need to check the first tag length
in the header, which is in my life.
I had after his byte number seventy three, which is the tag length here.
This one, this one tells us exactly the length of our society, which is a b e r t two, three, four.
But the actual SS side starts from the following byte.
If we click on the yes side here starts from seventy four up to the length of the SS side.
In this case it's from seventy four to eighty four.
So that's how we get our society in the future.
Keep that in mind.
OK, we have reached the end of this lesson.
Thank you.
And see you in the next one.