[Autogenerated] in this demo will begin by looking at the structure of
wireless frames at the data link layer of the OSI model Will then move on to
setting up a wireless interface to sniff local wireless network traffic and
inspect individual frames in wireless networks.
Communication happens over frames which have this structure fields
within the frame are typically two or six bytes long.
With the exception of the frame body, which can be up to 2312 bytes long.
From a security perspective where most interested in the frame control field,
which has a more complex structure.
Again, most of the fields aren't of immediate interest,
but the type field defines three types of field that
we might want to interact with.
Management frames,
maintain communications between wireless access points and clients.
They have a number of subtypes such as authentication and d authentication,
association request and response.
Re association request and response disassociation and probe
request and response control frames ensure an orderly exchange of
data between access points and clients.
They too have a number of subtypes including requests to send or RTs
clear to send or CTS and acknowledgment Finally,
we have data frames which have no subtypes but carry the data
that is sent across the wireless network.
Let's capture some wireless packets and take a look at each of these
different frame types running the IW Config command.
We see that we have a wireless interface called W land zero that is in
managed mode and is not associated with any access point.
This is the interface that has the alpha network adapter connected.
Let's bring the interface ups that we can use it to
sniff local Wi-Fi traffic with I F.
Config we can see that the interface is connected but it isn't
associated with an access point because no data is being sent or
received before we start to sniff local wireless traffic.
Let's first check that we have the right drivers installed for the
network card by running Airman N G part of the air crack.
N G suite.
Airman has identified the chip set of the alpha adapter and
confirmed that the appropriate driver is installed.
There are a number of common processes running in a default
Linux installed that might interfere with Airman and its access
to the wireless network interface.
So we run Airman N G.
Check kill to identify and stop them.
I've already stopped network manager and W P A supplicant,
which are the process is most likely to cause us problems.
Okay,
we're now ready to put our wireless network interface
into monitor mode with Airman N G.
Start W LAN zero.
Running him on N G again,
we can see that the interface has been renamed from W LAN 02 W
Lanzi roman And running IW configure again,
we see that the wireless network adapter is in monitor mode and is
connected to the 2.4 GHz frequency spectrum also running I have config
with the newly created W LAN zero mon interface.
We can confirm that we're receiving wireless packets.
It's also worth noting that they've all been dropped as well
monitoring and therefore not responding.
Let's launch Wireshark and connect the new monitoring interface we
created so that we can start to inspect some of the wireless frames were
receiving and straight away we start to see lots of 802.11 traffic
flooding in much of its from the TP link access point but we also have
some other stray network traffic including our victim client with the
panda wireless network card.
Let's apply some Wireshark filtering to hone in on some
specific wireless frames to identify and inspect.
Wireless management frames.
We filter on w land frame control and type to view all the
management frames in the packets being captured.
We set the type to zero in this example we have a beacon which is
one of the management frames in eight or 2.11.
Wireless networks,
it contains all the information about the network and periodically announces
the presence of a wireless network and synchronizes the members in the
service set by setting the frame control type to one.
We focus on control frames which focus on cTS.
RTs and acknowledgment here.
We have an act frame which is a delivery verification method.
Out frames are expected after the transmission of data
frames to confirm receipt of the frame.
In this final example we set the frame control type two to to
filter on the data frame and here for example,
we see the HCP and ARP requests.
Let's now look at how we can move from passively monitoring
wireless network traffic to being more active.