[Autogenerated] now that we've established how to
passively monitor wireless network traffic.
Let's take a look at how we can be more active and
interact with clients on a network.
A rogue access point is a type of ad hoc network that we
create to entice a client to connect.
The concept is pretty straightforward.
Think of a user in a public space who wants to connect to free wifi rather
than using their monthly data allowance we could create an open access
point with the name of our choosing and allow the user to get internet
access while we listen in for this demo.
We could use Air crack NGS Airbase tool together with something like
Bridget Tills to create our fake access point.
But I want you to know that there's more to wireless
___________ testing than air crack N.
G.
So we'll use a bash script available on github that creates
a knotted or bridged wifi access point.
We'll keep it simple,
but you can create the access point to broadcast on any
channel and with any type of encryption,
you can hide the ss IDE disabled communication between clients and much more.
Let's begin by installing some dependencies now.
We don't need all of these for this demo.
But if you plan to use more of create a piece features,
then these are the recommended ones.
Let's take a look at some of the key ones.
Host a pd or host access point.
_____ is a user space daemon that enables a network
interface card to act as an access point.
An authentication server.
IP Route two is an updated set of user space utilities for
controlling and monitoring various aspects of networking.
It updates tools such as I F Config route, our net stat and so on.
Similarly.
I W is a newer and more powerful version of Config.
If I W doesn't recognize your network adapter, create app will revert to I.
W.
Configure DNS mask and IP tables are required for knotted internet connections.
Next we'll clone create app from the GIT hub repository and install it create
a P is no longer maintained but it still works flawlessly.
There's a couple of forks,
one of which is focused on providing a gooey and one which
adds new features beyond Wi-Fi however, for deploying a basic rogue access point,
create app works just fine.
Before we create our network interface we need to know the names of the
wireless and wired interfaces which we can find with Config now we can call
create app specifying the wireless interface.
The one we're exposing to target clients as W land zero and the wired interface
that's connected to the internet zero followed by the name.
We want to give our fake access point and very quickly we
see that the virtual wireless interface.
app zero is created and enabled as soon as we see.
app enabled.
We're good to go to keep track of what's happening.
Let's launch Wireshark and start monitoring the virtual wireless interface.
app zero.
There's not much happening yet because no clients have
connected to our fake access point.
So let's switch across to our Windows 10 client device.
Let's start by verifying that we're not connected to any networks using IP
Config next we can try to connect to the free wifi access point.
It's pretty straightforward as it's an open network
and requires no authentication.
Great for a user but very bad.
From a security perspective running IP configure again,
we see that the wireless laN adapter is connected
and that we've been given an I.
P.
Address in the 192.168 dot 12.
subnet opening up a web browser.
We also see that we have internet access.
This is because our fake free wifi access point is relaying
traffic between the client and the internet.
But more importantly because it's passing through our device,
we can monitor every packet that's sent and received.
Let's switch back to our Cali machine and see what's happening in
Wireshark and here we see TLS encrypted traffic passing through our
fake access point onto the internet and back again up Next we'll look
at attacks against wireless infrastructure and clients by looking at
ways to find hidden wireless access points and bypass mac filters and
shared authentication