In this demo, we are going to run network reconnaissance with Cain.
This includes actively monitoring wireless networks
and cracking WPA preshared keys,
as well as sniffing our victim network to identify
systems that we can target in our attack.
We are going to start off on our Windows attack system.
I have the system antivirus disabled to ensure I can successfully install Cain,
and I have a USB wireless card connected to my virtual machine to
allow me to review wireless networks nearby.
Let's start off by installing Cain.
The setup is very simple.
I will double‑click on the executable for Cain and Abel and
click Next through the default setup.
Ensure you also install WinPcap as well,
when prompted during the installation process,
to take advantage of the network capabilities of Cain.
Now that the install is complete, let's get started using Cain.
We will start by opening Cain.
For this demo we'll be using the Wireless, Cracker, and Sniffer tabs.
We will begin on the Wireless tab.
Here we can use our wireless card and the WinPcap driver to review
some basic information on nearby wireless networks.
Start by navigating to the config menu.
On the Sniffer tab, it will show the available network cards to use by Cain.
Scrolling to the right to the Description column will help
better identify the different network cards.
Now we will close the config menu and select our wireless card
from the drop‑down menu on the Wireless tab.
We now click Active Scan, and Cain will begin scanning for wireless networks.
From the scan, we can easily see the types of wireless networks available to us,
including the network name, whether it is encrypted,
the BSSID, and the channel it's on.
The remaining features of the Wireless tab focus on passive scans,
which allow for gathering of network traffic.
However,
these features will require the use of an AirPcap card
connected to the Windows system.
However, if you have a wireless capture,
Cain can still identify and crack preshared keys using a dictionary attack.
For this demo,
we will download a WPA capture sample from the Wireshark
website to perform our attack against.
Once we have our sample,
we will move to the Cracker tab in Cain and click on the 802.11 Captures filter.
We now click on the blue plus icon in the top ribbon and
select the capture file and click Open.
The file directory will now appear as a capture file,
which we'll right‑click on and select Analyze.
Here Cain will identify any potential WPA handshakes that can be cracked.
We see our capture file does indeed have a handshake available to crack.
We will click on it and select Send WPA Hashes to Cracker, and close the window.
Click on the WPA‑PSK Auth filter option,
and we see the handshake information has been found.
Selecting and right‑clicking will give us two options to crack the PSK,
either performing a dictionary attack against the
handshake or a brute‑force attack.
For this demo,
we will select a dictionary attack to run against the handshake.
In the Dictionary Attack window, we will have the option to
select our dictionary file in the Dictionary section by
right‑clicking and select Add to list.
We select our dictionary text file and click Open.
With the dictionary now loaded,
we can start our attack. Cain offers the ability to not only
submit the words listed in our dictionary file,
but use derivatives of the words,
such as changing the case or order of the words in our list.
To reduce the time it will take us to run through our dictionary, I will
uncheck the various options so that we are only submitting the words as
they are contained in the dictionary file.
However, during an actual attack,
I would recommend taking advantage of these options available in Cain,
depending on the size of your dictionary list and the
time you have to run your attack.
We're now ready to start our attack and click Start.
Cain will now cycle through the words contained in our file to find a
match against the WPA handshake the program has analyzed.
And after submitting a number of failed passwords,
we have identified the key. Back on the Cracker tab, the password is
now listed along with the handshake information.
Once we're on a network we want to target,
we can use Cain to click on the Sniffer tab to perform some
reconnaissance to identify systems to target with Cain and
Abel to access credentials.
We will again click on the config menu and the Sniffer tab so we can select
our network card to use for our network sniffing activities.
For this demo,
we will assume that we're connected to the Globomantics local area network,
so we will select our internal network card for our sniffing attack.
Additionally,
we can configure the sniffing feature of Cain to start
automatically upon running Cain on our system.
By default,
the sniffer will run in promiscuous mode, which will mask our network card's
MAC address. This feature will also allow us to run added tests against systems
on the victim network to help our reconnaissance.
With our network card selected,
we will click OK and start scanning for systems on the network.
We will start the sniffer by clicking on the red‑and‑green
icon in the ribbon menu and then click on the blue plus
icon, also in the same menu.
We will choose to scan all hosts on the subnet; however,
you can also choose a specific range of IP addresses to target.
We're also going to select all promiscuous mode tests and click OK.
The Cain sniffer will now perform all of its tests to
identify systems on the network.
Different types of systems will respond to some of the tests,
but not others, so using all of the tests at our disposal will help to ensure we
have the fullest picture of the victim network as possible.
Cain will populate IP and MAC addresses and place stars in the column
for each test that a response is received for. Now select the first
entry and the last entry while holding the Shift key and right‑click
and select Resolve Host Name to populate additional information about
the systems on the network.
We now have a full list of systems we can target with Cain
and Abel on the Globomantics network.
This will end our demo, where we learned how to run reconnaissance
on a network using Cain, as well as how to analyze and crack WPA
handshakes using a dictionary attack.