In this video I am going to teach you how to use Python to discover so-called hidden wireless networks.
OK.
So why do I say so.
Well it is because in reality these are not actually truly hidden because when network administrators
activate a feature called Hidden SS I.D. what they actually do is they don't add the SS I.D. to the
Beacon frames.
So a beacon frame in simple terms contains all the information about a network and it is being transmitted
periodically or broadcasted periodically for synchronization over the wireless network and for other
purposes.
So this is actually part of the infrastructure of wireless networks and we won't get deeper into that.
What I need to add here is that SSA is not only included in the Beacon frames but also in probe requests
and probe responses so a hidden SSA is not actually a real way to truly hide a network.
But like I said some administrators actually still use it.
OK.
Now here's the outline for a potential attack that will help us find or help someone find a hidden SS
I.D..
I need to specify that for this work you need a wireless card that supports monitor mode and you can
get one very cheap for actually less than 10 dollars online.
All right.
So what is the scenario.
Let's say a client is connected to a network with a hidden SS I.D. now an attacker will wait for it
to disconnect from the network or the attacker can forcefully disconnect the client from the network
using spoofed the authentication.
Now the client disconnects and immediately tries to reconnect one of the packets from these transmissions.
Or from this traffic will contain the desire as I say.
Now let's actually get into the code which is inspired by Bastian Baldanza great book Understanding
network hacks which I really recommend.
So we'll start from scape dot all import everything.
We'll be using escapee and the first thing to do is to set a variable or to define a variable to the
name of our network card that actually supports monitor mode.
So let's say I face equals V Line V Line 0.
Then we'll define a function to output probe requests.
Association requests and or probe responses.
So probe requests probe responses or association requests.
So let's actually say the F H underscore packet and we'll take the parameter of a packet.
And if back at that has layer so back it has layer
DOT level and probe request.
So I said probe request probe responses and association requests or back it has layer dot the 11 probe
part ESB or back it has layer dot eleven a as S O BRAC.
So association requests in this case will simply print.
And for this specific script we can or we use or it was inspired using a python to so print SS I.D.
identified identified and then space and we can say plus back at DOT in full.
All right OK now will we need to put our Wi-Fi adapter or our Wi-Fi card in monitor mode and for that
we use.
Oh let's start system.
But for us to use.
Oh yes.
We need to import it first.
So import os and then as you can see as you know from previous videos we can work with system commands
using OS system.
And in this case it's gonna be I w config not icon thing but config.
And then plus I face.
So the name of our interface which is V Line 0 and then we need to specify mode monitor.
So mode monitor then what's left is just to start sniffing and dumping packets according to the function
we've just defined over here.
So we can save print
and since we're using five on food we can say sniffing traffic on interface space.
Plus a face and then actually start this net for what sniff on I face.
So sniff is a method from escaping all import all so sniff is included from this end.
So I face is going to be our I face or interface which is V1 zero and the function PR n which I've told
you about in the detail video of escapee is gonna be so the function is gonna be back at the function
we've just defined here.
Once again the PR and argument and the sniff method escapee allows us to use functions for hours and
effort.
All right.
Now in this case it will listen to network traffic using the interface or the device or the Wi-Fi adapter
in monitor mode and it will dump those packets defined as per hour if statement in the back packet function.
So like I said probe requests probe responses and association requests and it will actually output the
SSA D found as you can see there is not much glamour to the code just a bunch of commands sequenced
or chained together.
But yet again it goes to show the bar of Python and most importantly the flexibility and the large capabilities
of escape.
Which probably deserves an entire course itself.
Now let's save this.
And if you have a Wi-Fi adapter that supports monitor mode you can just simply plug it in and then run
the script and it will actually give you the hidden SS I.D. that it identified.
Now if you're eager to experiment and learn more.
Definitely check out the documentation of escapee at escapee dot net as well as the book I recommended.
Understanding network hacks by Bastian Bowman.