[Autogenerated] MAC filters are a security method that use
allow lists based on the connecting clients.
MAC address The trouble with this method is that it's trivial to
spoof and interfaces MAC address In windows.
It can be done through device manager control panel,
the registry and through the use of 3rd Party software and in
Linux there are similarly diverse methods.
But in this demo we'll focus on a tool called Mac Changer,
which is built into Cali by default.
Let's start by taking a look at our access points.
Mac filtering features by navigating to wireless
and then wireless mac filtering, as we can see,
Mac filtering is currently disabled, but when it's enabled,
we can choose to either allow or deny a specified list of clients
based on their MAC address Let's fire up Wireshark so that we can
observe the effects of applying mac filters.
And what happens when we spoof the mac address of our wireless
interface to be the same as that of an allowed client.
To make things easier.
Will apply Some filters will focus on authentication,
request and response frames by filtering on frame
control subtype zero or one respectively.
We then start capturing on the W LAN zero mon interface will now try to
connect to the wifi lab access point and watch for the response and
because wireless security and mac filtering are disabled were able to
connect to the access point and we see the corresponding association
request and response frames digging into the management frame of the
association response.
We can see that the status code reads successful.
Let's now go back to the access point.
Mac filtering configuration page and enable Mac filtering.
The allow option has been selected to only allow access to clients with
the MAC address specified in the list underneath.
This is currently configured to only allow access to the
Windows 10 client in our lab environment.
So what happens when we try to connect to the wifi lab access point now?
Well,
let's set Wireshark to capture packets using the same
filters as before and give it a go.
The first thing we can see is that it takes a long time before we start to
see any authentication frames because the client will make multiple attempts
to connect if it's initially unsuccessful but eventually the attempts time
out and we get an authentication response which has a status code that reads
unspecified failure were being blocked from connecting to the access point
because the Mac address of the wireless network card isn't on the allowed
list.
So we need to find the MAC address of an allowed client and spoof our
address to be the same to look for allowed clients.
We can use a road.
Um Benji from the aircraft suite we set the channel 22 and use the
dash a option to filter out and associated clients.
We then specify the MAC address of the access point and the
monitoring interface aero dump monitors,
beacons to and from the access point and identifies associated clients which
are identified in the station column of the table here.
We have a single client which is the Windows 10 device
that forms part of our test lab.
The W LAN zero wireless interfaces currently in monitor mode.
So I've added a second interface.
W Land one that we can use to connect the client.
Mac Changer is a tool built into Kali that can be
used to modify a network interfaces.
MAC address It's a simple utility with just a handful of options.
Among other things,
we can choose to set a random MAC address or specify our own keep
the vendor bytes and only change the ending or reset the
MAC address to its true hardware address.
We can't change the MAC address while the new network interface.
W land one is up.
So we use config to take it down temporarily.
We then invoke Mac Changer using them to specify the Mac
address as that of the Windows 10 client and then specify the
interface that we want to change.
Finally,
we bring the W Land one interface back up running out of config
we can see that the change has taken place after launching
Wireshark with the same filters as before.
We can again attempt to connect to the wifi lab access point when the
association request and response exchange comes in.
We see that the status code in the wireless management frame
of the response packet reads successful