In this lesson,
I'm going to demonstrate how to conduct
an initialization vector attack
on a WEP-protected access point.
As I said before, WEP is extremely insecure
because it only uses a 24-bit initialization vector.
Regardless of what key you choose,
this attack is going to work every single time.
This is the reason that I say
you never ever want to use WEP in your networks.
If you find a network using WEP in your organization,
you should immediately work to upgrade it to WPA2 instead.
Let's jump into the lab
and I'll show you exactly how this works.
So the first thing we're going to do
is where you're going to start with airodump-ng,
and then the card that we have, which is wlan0mon.
And notice, it's starting to scan
for that particular network that we're looking for.
In our case, we already found it.
It is WirelessHacking. This WEP network right here.
And this is the BSSID or the MAC address for that network.
So for us to attack it,
we are going to use airodump-ng again.
And in this case, we are going to specifically tell it
which channel we want to go after,
which is channel 1 right here
from the WirelessHacking network.
We want to go after the BSSID
that was provided for that network,
and we want to go ahead and write that data to a file,
which is going to be WirelessHackingDump,
is what we're going to call that file.
And then we're going to give it the card itself,
which is wlan0mon, and hit Enter.
And off it goes, starting to scan the network,
which is helpful, but we're not quite there yet.
Notice the data packets are climbing,
but we haven't yet associated ourself to that network
to be able to start doing things like packet injection
and capturing those initialization vectors.
So I'm going to go ahead and put this up here
to make some extra room,
and we'll just bring that right across the top
and let it continue to run.
We're going to open up a new terminal
and I'm going to bring that down here to the bottom.
Now, in the new terminal,
what I need to do is I need to start doing a authentication
to the network using fake authentication,
which is our first step in the hack.
So that first step in the hack
is that we are going to do a program called Airplay.
And in aireplay-ng,
we are going to use fakeauth as our command,
0 for infinite attempts,
a and the MAC address that we are going after,
which again, we still have pasted right there.
And then we're going to use the MAC address
that we're coming from, which we have to find ourself.
So we are going to open up another terminal.
You can see how you start getting quite a few terminals,
and just type in something like ifconfig.
When you do that,
you're going to get the MAC address for wlan0mon,
and the first eight, sorry, the first 12 digits here
is that MAC address for our network card.
So I'm just going to copy that and then we can paste that in.
Now, this uses dashes,
but for this particular command, you have to use colon.
So I'm going to arrow through and change those to colons,
as you can see.
And the command's not done yet
'cause what's the one thing we haven't told it,
we haven't told it which card to use.
So we have to use wlan0mon, and then we will hit Enter.
And off it goes, sending an authentication.
We now have an authentication made with this network.
So we can move into the second phase of our attack,
which is going to be the packet injection.
So for the packet injection,
we are going to still use the aireplay command,
and most of it is going to be the same.
So what I'm going to do,
instead of typing it all is hit the Up Arrow,
which will bring back the last command I used.
The big differences here
is we are not going to use fake authentication anymore.
Instead, we want to use an arpreplay
so that we can create additional traffic on this network.
Instead of a for the access point,
we're going to use b for the access point,
which tells that that's the base station.
We're still going to use the card that we're coming from
and the network card wlan0mon.
When we hit Enter, off it goes.
And notice that we have a couple of art packets here,
and our data is going to start going up.
We have a lot of frame loss.
Once you have a couple of ARP requests
that have been successful,
you can hit Control + C and stop that.
Now, with this attack,
it does help if this is a busy network.
Right now as we're doing this,
you can see the data packets are going up.
The reason those data packets are going up
is because I'm streaming YouTube on the device.
This base station here, this client, which is my iPhone,
is talking to this access point and streaming YouTube,
which is collecting a lot of data.
Now the next thing you want to do is start cracking.
And every 5,000 data packets that go up,
it will start trying to do another attempt.
And it's really easy.
You just use aircrack-ng,
and then the file name of what you're going to be using.
So let me clear the screen here.
And the file that I'm going to be using
is WirelessHackingDump-02.cap.
And the reason it's the second one
is 'cause I've run this attempt once before showing you.
So all we're going to use is aircrack-ng,
and then the file name that you're going after,
and hit Enter.
And off it goes, starting to crack away.
Right now,
it already has 14,000 initialization vectors collected,
and you can see that here from the Data,
but that wasn't enough.
So when this hits 15,000,
you're going to see this kickoff again
without me doing anything,
and we'll see if we can crack that key.
So here it goes again, it's going off
and testing the different keys.
And it didn't find it.
So it'll try again at 20,000.
Generally, it's going to find it somewhere
between 10,000 and 25,000.
It really depends on where that particular key is
inside the key space,
depending on what that hexadecimal password was
that we used.
So again, you can see the data packets
climbing up as I'm streaming different YouTube videos.
Every time I start another video,
it starts downloading all that data.
All those frames have an initialization vector in there
and they're able to be captured
so that we can start seeing that information.
So now we have over 20,000, it's going to try again.
And there it is.
It found our key, 17:25:83:AE:FA.
So we now have a key, what are we going to do with it?
Well, the next thing we want to do
is we want to see if that key actually works
and be able to get onto a network.
We can do that through Kali
or we can do it through your Windows machine
or your Mac machine.
It depends on where your ultimate goal is.
For this example, I'm going to show you how to use it
inside your Macintosh machine.
You can do the same thing in Windows, and again, in Kali.
So if we can cancel this capturing at this point,
so we hit Control + C.
And we're going to switch back to our client machine,
in my case, Macintosh.
So now that we're back on our Windows
or our Macintosh machine,
you'll connect to that wireless network
just like you normally do.
So we're going to go down to WirelessHacking,
and it's going to ask us for the passcode.
My passcode that we just cracked was 17:25:83:AE:FA.
And if I go ahead and Join,
we should see if I can pull an IP address from this network.
And if we look at it,
you can see here we did pull an IP address from this network
and we are connected to that access point,
starting with c8:a7 BSSID,
which is the one for WirelessHacking.
So our hack did work and it was successful.