Now, let's try to get the password for a WPA2 network.
As you may know, WPA2 networks are way more secure than WEP networks,
but that doesn't mean that it's impossible.
The main idea is monitoring the network and capturing
when someone logs into the network.
If we can capture the packets containing this authentication handshake,
then we can brute force the password offline.
So, let's get started by putting my interface into monitor mode. As this is
exactly as we've done before, we can speed up this video.
Then, as you can see, now I have my network card into monitor mode.
So, let's get started by checking the networks around
me using the airodump tool. Again,
this is very similar to what we've done before.
Awesome.
Take a look.
This is our target network.
It is called Globomantics‑Corporate.
These network is a WPA2 network with a PSK authentication
method. PSK stands for pre‑shared key,
which is a network in which there's only one password for
everyone. And this is very important because our attack
only works in PSK networks.
So, let's rerun the airodump,
but including the bssid filter and the channel
filter, exactly as we've done before.
Now, take a look.
We have one computer connected to this network.
As I mentioned,
we need to capture the moment someone's logging into the
Wi‑Fi, so we have two options here.
We can wait until someone new connects to the network, or
we can cause a denial of service for this person that is
already connected. In this way, when the computer gets connected,
it will try to reconnect.
And then,
as we are capturing the packets, we'll be able to capture
the initial authentication handshake.
That's pretty cool, right?
So, how can we force the computer to disconnect? For that, the
aircrack suite has a tool called aireplay.
So, let me just stop this capture, add the flag ‑w
to save the packets into a file,
put the name of a file, and leave this running on the background.
In this new tab, I'll use the aireplay to run a deauthentication attack.
So, I type aireplay‑ng wlan0mon, which is my interface,
then ‑‑deauth, which is to specify the deauthentication attack,
then 20, which is the amount of deauthentication packets we will send,
then ‑a and the MAC address of the Wi‑Fi router,
which you can get from the airodump.
Also, we'll put ‑h and the MAC address of the computer connected to the network,
which you also can get from the airodump screen.
Perfect.
So, we have airodump capturing the packets on the background.
Now, all I have to do is run this command here.
As you can see, this sends deauthentication packets to the
router pretending that we're the victim computer.
So then, the router will drop their connection.
If we go to the airodump tab, we'll see that the data stream has
stopped, and then we can just wait a few seconds, and the victim
computer will automatically try to reconnect to the wireless
network. Whenever this happens, we see this message here showing the
WPA handshake was captured.
Pretty cool, right?
If that doesn't work,
you can try to rerun the deauthentication attack again. Once we
have the handshake, we can stop the package capture. And a quick
pause here for two important comments.
First, even though this only dropped the victim connection for a few seconds,
please talk to your client before executing this attack.
Some clients do not like the idea of denial‑of‑service attacks, so talk to
your client and explain that someone may be disconnected for a few seconds,
and make sure the client's okay with that.
Also, if the client's happy with denial‑of‑service attacks,
this can be a great tool in your toolbox.
Denial of service is a good distraction tool for the IT team.
For example,
if you keep disconnecting a few users from the wireless, do you call
their IT department to complain about the issue?
So, while the IT department is working on that, you can
execute more complex attacks and hope that the IT team is
too busy trying to fix the Wi‑Fi.
But again, make sure your client is okay with those kind of attacks.
Okay, cool.
Now, let's go back to the WPA2 attack.
We have the handshake captured.
The next thing we need is a word list to be used in
the offline brute‑forcing process.
I downloaded from the internet a huge list of WPA2 passwords. I also
manually added some passwords to be tested. And here, I'll not enter
too much details about a word list,
but I do recommend you to use tools such as John the
Ripper to create your own world lists.
Perfect.
We have the handshake, and we have the word list.
Let's crack the password.
We have here two options.
You can take the WPA2 handshake and crack with external tools such as
the hashcat, or you can use the aircrack tool to crack this password.
As this an aircrack course, let's use it.
So I type aircrack‑ng,
then ‑w, then the name of the file containing my word list,
then the name of the file containing the packet capture with the handshake,
which is the wpa2.‑01cap.
Perfect.
Pretty simple, right?
Let's run this command. In this process, aircrack will
try to brute force the WPA2 passwords.
Depending on the quality and the size of your word list,
this may take some time.
If the password is really strong, it may take days or even weeks.
In our case, Globomantics had not a so complex password, so take a look.
The aircrack found the password, and that's amazing.
Now, let's try to connect this network. As we've done before, let
me disable the monitor mode using the airmon‑ng,
and then let me restart the Linux network‑manager service.
Perfect.
Now let's try to connect the Globomantics network.
I typed the password that we just got, and that's it.
After a few seconds, we're now connected.
As you can see,
I've got an IP address, and I'm able to access the internal service.
That's pretty cool, right?
Attacking wireless networks can give you access
right into the corporate network.
Now, you can go ahead and have fun trying to hack other internal servers.