[Autogenerated] Okay,
so we've got our lab up and running and we've used Wireshark to start to
explore the structure and features of wireless frames.
So let's now turn to exploiting some of the inherent weaknesses in wireless
technologies blocking the broadcast of an access point.
S.
I.
D.
Is a fairly primitive form of security but it's still
commonly used in this demo will use air replay,
N.
G.
To issue do frames to the client to cause it to
disconnect from the access point.
The client will then automatically try to reconnect and when it does it will
reveal the name of the access point that it's connecting to.
We'll start by putting our wireless network interface into monitor mode,
specifying channel two to match the channel the access point is broadcasting on.
Let's also fire up Wireshark we can see that the
access point is broadcasting its S.
S.
I.
D.
As Wi-Fi lab.
We'll leave Wireshark running while we disable the broadcast of the S.
S.
I.
D.
And the access points,
configuration pages from the access points home page we navigate to
wireless and then basic settings here we uncheck the enable S.
S.
I.
D.
Broadcast option, leaving all other settings unchanged.
Returning to Wireshark we can now no longer see the Wi-Fi lab access point.
Broadcasting it's S I.
D.
What we see instead is an access point that has its S S.
I.
D.
Set to wildcard which essentially means that the length of the S.
S.
I.
D.
Is zero.
We can also find this information by selecting a packet
and digging down into the wireless management frame tagged
parameters Now whilst the S.
S.
I.
D.
Isn't broadcast once the client has associated with the access point.
If it needs to re associate it will need to broadcast the access points S.
I.
D.
So let's launch a Ddos attack to disconnect the
client from the access point for this.
We use air replace specifying the dash zero option for both attack
and five for the number of packets we want to send.
We then provide the access points.
MAC address followed by the Mac address of the client
that we want to de authenticate.
We'll also add the ignore negative option to ignore any mismatches between
channel numbers if the interfaces channel can't be determined.
Finally we specify our monitoring interface is the interface
from which we want to launch the attack.
Let's take a look at Wireshark to see what just happened.
Now, initially we see the wild card S.
S.
I.
D.
Followed by a burst of packets.
Now it's difficult to pick out the re authentication traffic so we'll filter
on the access points MAC address and frame control subtype five to monitor
the access points responses to the client's probe requests that marks the
beginning of a re authentication attempt.
And now we can clearly see that the access point broadcasts, it's S S.
I.
D.
In response to the client's probe requests