Now that Kismet is running, you might have noticed a URL up there.
That's the URL of its own web server where there is a
more graphical interface for Kismet.
You can right‑click it and open that link. The first time you
connect to it, it's going to ask you to create a username and
password to be the Kismet admin.
That's the account that will have permission to change some settings.
Once you create the account,
you'll be presented with the UI where you would see the different networks
if you had any source configured. Sources can be configured by going into
the Kismet menu and selecting Data Sources.
As you can see here, I only have a Linux Bluetooth capture source available.
I don't have the Wi‑Fi card that I want to use. Now,
if you are using a USB interface,
it's really important that you make sure that that USB interface is
made available to the virtual machine you are using.
Now that I've added the device to my virtual machine,
I'm going to run iwconfig just to see if it's connected properly.
And even though it's been connected to my VM, it's not showing up,
so I'm just going to reboot now that it is connected because with
the kernel modules and all of that,
especially if you're in a virtual machine that can be rebooted
because it's not used for anything else,
it's just easier. Now that we're back, I'm going to run iwconfig
again after checking that my card is connected to my virtual machine.
And now you can see the wlan0 interface,
which is the card I just connected.
So we're going to go ahead and run Kismet again and reopen that link.
Now if I go back to Sources, I can see that there's two of them available,
and one of them is the Wi‑Fi adapter I just added. You
should be able to enable it from here, but in the current version of Kismet,
it seems there's a bug and it doesn't think we have permission to
do that. Because that web interface is fairly recent, it's not
surprising to see a few issues like that.
So how would we enable that network card?
Well, we have two options.
We can go back to our terminal and kill Kismet,
and we can edit that kismet.conf file.
So these are the default settings that Kismet uses where it's going to log data,
where its web server is going to run if channel hopping is enabled,
remember we talked about that in the first clip of this module, as well as
what interface is being used. Now, the thing I don't like about this is if
you want to change this pretty often,
it's a little bit annoying to edit the configuration file all the time, so I
think if you're doing red teaming or penetration testing,
it's very useful to just be able to change things on the fly.
So what I prefer doing is specifying some of these options at the command line.
So in this case,
the option is ‑c, followed by the interface name, so ‑c wlan0.
We can then give it a name, and we could even specify what
channels we wanted to be listening on, which I'm not going to do right now.
So, kismet ‑c wlan0 with the name wifi.
If I go back to the web interface, which I still have in my browser right here,
you'll see right away a bunch of networks popping up showing
that this source was configured properly.
Now,
everything that is blurred in this video are simply
SSIDs or BSSIDs of real access points,
including mine and neighbors, so for privacy purposes I am hiding
them, but that is what you would see in those fields.
Now what's interesting with the web interface of Kismet is it's much better at
showing things like graphical displays of how many packets are coming in and
how much traffic is going on on whatever channel.
Now, if we go back to that Source configuration again,
as you can see,
Wi‑Fi is enabled, it is hopping, and it is going
between all of these different channels.
Now, I'm interested in seeing if there is an
unprotected Wi‑Fi network out there.
So what I'll do is I'll sort by type,
because I'm really looking for Wi‑Fi access points more than anything.
Remember,
Kismet is also able to see other devices, so you'll see a lot of things here,
especially if you live in an area where there's a lot of devices.
Here we go, we see the DangerZone Wi‑Fi, which is using an open network.
There's no crypto at all.
And if I click on it, I can see some more information about it.
It's a Cisco‑Linksys device, and as you can see,
it is on channel 6. We can see that it has more management
packets than data packets right now,
which probably indicates that there's not too much going on on that Wi‑Fi
network since management usually is not using that much bandwidth.
So what I'm going to do now is connect one of my
mobile devices to that Wi‑Fi network.
As you can see, as I start generating traffic on it,
we're getting more and more packets.
That being said,
remember what we said about channel hopping. We're
definitely not gathering everything because we're only on
channel 6 a fraction of the time.
So what we'll do now is we'll go back to our terminal,
we're goign to kill Kismet,
and we're going to run it with that same command, but we
are going to specify channels="6".
Now if we go back to that interface,
we should now see plenty of traffic coming in for that network
because we're not hopping between the different channels. And
now you can see that the data portion of the graph is catching
up fast on the management.
We can see some more stats about the package rates,
how many packets per hour are sent if you leave Kismet running for a long time.
But now, since this is unencrypted,
what I would like to do is be able to sniff some traffic there.