[Autogenerated] now that we've learned some
techniques to attack wireless networks.
Let's see how we can use them to affect the confidentiality integrity
and availability of data and information that passes through those
networks will start by seeing how we can sniff sensitive information
directly from wireless traffic.
This technique is also called eavesdropping.
It's a bit like putting a cup to the wall to listen to
the conversation in the room next door.
In the first technique.
Well,
imagine being in a coffee shop or a busy public area where people
are looking for a free access point to connect to.
Let's help them out with that.
We start by creating a local access point called Free wifi which
broadcasts itself on W LAN zero and passes all requests through to F
zero which is connected to the internet,
create app generates a tap interface called a P zero,
which we can use with Wireshark to eavesdrop on all traffic
passing through the free wifi access point.
The access point we've created is open so has no encryption.
We can therefore filter on http traffic to only capture
victim traffic that's heading to the internet,
switching across to our Windows 10 victim device.
We can simulate a user connecting to the free wifi access point which doesn't
require authentication and then browsing to a web mail site.
Once there, the user enters their user name and password and then click sign in,
switching back to Wireshark We see that we've captured http traffic
between the victim device at 192.168 dot 12.101.
And the web mail server at 192.168 dot 2.5 as the log in credentials
would have been sent to the server using a post request.
Let's focus on that packet.
And we can see at the application layer that we have some
html form data which we can expand to reveal the user name
and password entered by the user.
Now of course this was easy because the user connected to an open
access point and then connected to a non secure website.
But what if the access point was protected with web or W P A.
And the client was connecting to a secure website.
Let's start by peeling back the layers of encryption that exists between
the client and the access point before moving on to the encryption that
exists between the client and the secure web server for this part of the
demo The access point has been configured with weP encryption as in the
earlier lab on cracking web and the wireless interface has been put into
monitor mode.
Let's use TCP dump to sniff on the wireless interface by using dash I
to specify the W land zero mon interface and dash W to specify the
name of the file that we want to save the capture to the same can be
achieved using Wireshark but it's useful to be familiar with a range
of tools to achieve the same task in case one isn't available when
you need it.
Let's stop the capture here and see what we have so far by
launching Wireshark with the TCP dump capture file we just
created scrolling through the captured packets.
We see that every 802.11 frame is encrypted.
In the earlier lab we cracked the weP key which allowed us to connect
to the access point but the web key is also used for encrypting traffic
between the client and the access point so we can use it to reverse the
encryption with their D cap, N.
G.
Part of the aircraft suite.
We can decrypt weapon encrypted capture files if we know the
pass phrase which from the earlier lab we know is bingo but
with the replaced by a zero.
Now Eddie cap only takes the pass phrase in hexadecimal so
we'll have to convert that into hex.
You could use an online conversion tool but it can also be done via the
command line bypassing the pass phrase to octel dump,
specifying the dash N.
Flag to avoid an ugly numerical address.
prefix on the left side and dash T.
X.
One to specify one bite.
hexadecimal this will output with spaces in between each bite which is
inconvenient if we want to copy and paste into the cap so we can pass the
output of octel dump to said and strip out the spaces this last bit isn't
really necessary but it's convenient and when you're on a pen test engagement
tricks like this Can save a lot of time,
particularly if you have a lot of pass phrases to convert all that's left to do.
Now is launch ready cap specifying the pass phrase in hex format using
dash w followed by the name of the capture file.
If no output file name is specified, Eddie cap will use the input file,
name and append dash deck to name it.
We can now use Wireshark to inspect the decrypted capture file.
As we can see we now have a bunch of TCP and http packets instead
of the 802.11 frames we had before decryption.
These decrypted packets are now ready to be mined for sensitive information.
The first form of website security was secure sockets layer or ssL,
which is a certificate based encryption scheme for securely sharing
information between a client and a server or between two servers.
There are a number of known attacks for targeting ssl encrypted connections.
Ssl stripping for example,
is an on path attack whereby an attacker acts as a
proxy between a client and a server.
The connection between the victim and the attacker is unencrypted and
that between the attacker and the server is encrypted.
A poodle attack is another form of on path attack,
which targets ssl version three TLS or transport layer security
version one was released as an evolution of ssl in 1999.
TLS is somewhat of an improvement on ssl as it provides a better
standardization process than ssL and it makes defining new cipher
suites like RC four triple days a yes and so on.
Much easier.
But TLS version one allows downgrade to ssl version three,
therefore making it vulnerable to the poodle attack and it's also
vulnerable to cipher block chaining attacks.
Further revolutions of TLS have led two versions 1.2 and 1.3
being considered the most secure for now.
Http strict transport security or H S T s is a service ID
policy that helps to mitigate some of the on path
vulnerabilities associated with ssL and TLS.
If a web server accepts connections through http but redirects to
https clients could initially communicate with the non encrypted
version of the site before being redirected.
This then creates an opportunity for a non path attack.
However,
the HST s header informs the browser that it should never load a site
using http and should automatically convert all attempts to access the
site using http to https requests instead.
So attacks like ssl stripping which rely on an unencrypted
connection between the client and the attacker won't work