Welcome to our Kali Linux virtual machine.
I like to use Kali Linux because it has everything we need already preinstalled,
so it saves us some time.
Already connected my USB wireless card to my computer, so we are good to go.
In our first demo, let's take a look on how to exploit a legacy WEP network.
Those networks I consider insecure,
but I still see a lot of companies that are still
using WEP because of legacy devices.
So, if you see a WEP network, you know it's an easy target.
Let's get started by opening the terminal.
Perfect.
I already created a folder on my desktop for this demo so
we can keep our files in one place.
To get started,
let's list our network interface is by using the command ifconfig.
Perfect.
In here, you can see that my network card is called wlan0.
To be able to collect packets from a network that
we don't have the password yet,
we have to change our network card to monitor mode.
This enables our card to see packets of any network that is nearby,
even if you don't have the password for it.
To enable the monitor mode,
we use a tool from the aircrack framework called airmon.
This tool requires that no other network management services are running.
So, let me first check if there's any other service that will cause me trouble.
For that, let me type airmon‑ng and then check.
Perfect.
Here, the script shows me that a few services could be an issue for me,
so I have to kill those services.
And the easiest way of doing that is using the airmon‑ng check and then kill.
This command will check all the services and kill
the ones that could cause trouble.
Perfect.
Now, we can turn on the monitor mode on our network card.
For that, I'll type airmon‑ng start and wlan0.
And note the wlan0 is the name of my network card.
In your case, it may be different.
Now I pressed Enter and wait a few seconds.
Then, as you can see, the network card is now in monitor mode.
And to confirm that, I will run ifconfig again.
Take a look.
Now my network card name is wlan0mon.
This mon means that my network card is a monitor mode.
So, that's perfect.
We're ready.
Now I want to check out the networks around me.
For that,
I can type airodump‑ng and then the name of a network card in monitor mode.
This airodump will show me all the networks around here.
And take a look.
We found this WEP network here, and this will be your target.
A quick tip here is that if you are doing a red
team exercise in a large company,
try to walk around the building to see all the networks that they may have.
You can literally walk outside of the building since
the wireless traffic can cross walls.
And I say that because sometimes those insecure WEP networks may
be in just a certain area of the building.
For example, only where the IP cameras are.
So, if you don't see a WEP network right away,
it may be worth just walking around the target to try and find one.
Perfect.
Now that we know our target,
we need to collect packets for this network so we can crack the password.
In here, we can use the airodump again,
but now we can add some filters since we know the target.
First,
I would add the bssid filter and then put the MAC address of our target router.
Also, since our target network runs on channel 6,
then I will put ‑c and 6,
which says that I only want to monitor the channel 6 of the wireless space.
Now we are seeing all the traffic for that specific network.
As we can see, there's only one machine connected to this network,
and the number of packets is increasing,
which means that that is traffic between the machine and the router.
And that's exactly what we want.
Now we need to save those packets in the file,
so let me stop this and run the exact same comment with the flag ‑w and
then the name of the file that I want to save the packets.
In my case, I'll call the file as capture.
Perfect.
The data now is being captured.
Let me open new tab and show you the files that were created.
As you can see, airodump created five files for us,
but the one we are interested is the capture‑01.cap.
This is the one that contains all the packets that we need.
So, we can use the command aircrack‑ng and then the name of the cap file.
this aircrack‑ng script will analyze all the packets that were
captured and try to crack the password for them.
As you can see, I left my packet capture running in the background.
And that's because if you don't have enough data yet,
I can just leave the capture running for a few more minutes and then try again.
Okay, now all I have to do is run this command.
And as you can see, in less than a second, we have our password here.
This password is in the hex format, but we can use it to connect to the network.
That was pretty easy, right?
That's the reason that WEP networks are considered really insecure.
So, let me show you how to connect to the network
that we just got the password for.
First, let me just stop the packet capture.
Then, let me stop the monitor mode on my network card by using
the airmon‑ng and then stop and then wlan0mo. And let me restart
the Linux network‑manager service, which was the one that we disabled before.
So then, I can use it to connect to the network.
Perfect.
Now all you have to do is connect to a wireless network as we would do
normally. I can go to the list of available wireless networks,
then select the Globomantics‑IoT network, and then type the
password in the hex format, but without the colons.
And just like that, I can click on Connect,
and after a few seconds, that's it; we're in the network. And take a look.
I even got assigned to an IP, and I even have connectivity to the servers,
which is pretty cool, right?