Welcome to part one of this module in this module.
We're going to be covering various methods of Wi-Fi hacking breaking into networks is obviously a very
important part of penetration testing since once you're on a network you can attack other machines locally
or perform men in the middle attacks and what have you.
However many of the tools we're going to be using will be requiring the same starting prerequisites
that is to say there are several tools we need to learn about first before we look at these specific
methods of attacking networks.
So rather than cover these setup tools multiple times in every video in this section I've decided to
present them as one single video at the start of the module.
We'll be looking specifically at IFR config IOW config airman N.G. aero dump N.G. and Mach changer also
touch briefly on the wash command.
These tools are all important for what we will be doing next.
And none of them are so complicated as to justify doing a video on each one.
Since all of these are terminal based commands will open up our terminal window and we will begin by
typing I f config This command will show all of the network interfaces that are available and give you
details about each one the names of these interfaces may vary depending on certain factors such as your
operating system but in Cali you should see at least w land 0 and EF 0 which are your wireless card
and Ethernet capability respectively.
Don't worry if your system calls these interfaces something else.
Just remember the name and use it when it's called for I actually have two wireless cards working on
this computer.
One is the built in Broadcom that is W and 0 and the other is an alpha card which is capable of packet
injection and that's a subject we'll be covering a bit further down the line in this module for this
demonstration I'll be using just w and 0 so to begin we're going to bring our wireless interface devices
down they need to be down in order for us to tweak them.
So we're gonna do.
I have config w lan 0 down and just for good measure I'm going to bring w lan one down as well
and this is Mac changer.
So what we're gonna do is we're going to type Mac change or tack a W lan 0 that's uppercase a and of
course substitute w lan 0 for whatever the name of your interface device is and note that I am using
the TAC uppercase a switch.
So this tells Mac changer that we want a random Mac.
We could also input a specific Mac if we wanted to.
For example some networks block all but specifically authorize devices from associating with them.
If we happened to spot a mac address of an associated device using the tool that we'll be looking at
in a few moments which is arrow dumping G we might use packet injection to kick that device off the
network and spoof its Mac so that we can associate with it in its place.
This is a bit advanced though and we'll be covering that later for right now.
I just want you to be aware that you can specify your Mac and I'm going to do this with you land one
just for good measure.
So by changing the MAC address what we're effectively doing is we're changing the fingerprints of this
device.
I'll speak about this a bit more later.
So now we need to bring our device back up and into monitor mode.
Now there are two ways of doing this.
We could use the command ie w config w land 0 mode monitor and after pressing Enter we would follow
that command up with I f config w land 0 up but there is another way of doing this and in my opinion
a better way
we're going to use the Arum on N G command
airmen and G lists are wireless interfaces and what we're doing here by the way is switching the mode
that our wireless card is functioning in by default.
Most cards are in standard mode.
The difference is that in monitor mode a wireless card will accept packages that are not necessarily
intended for that card.
So we need to bring our card into monitor mode but before we do that we need to check and see if any
system processes are currently running that are going to interfere with our efforts here.
So to do that we're going to run em on energy check and we can see that there are some network processes
currently running that will cause us problems.
Now we could kill these one by one using the kill command followed by the IED but the problem with doing
that is that these these processes have a funny habit of responding themselves.
It's much more efficient to just use airmen in G check kill and kill all processes simultaneously.
That will cause any kind of a problem
once this is done we'll do airman G check again to verify that they are killed and now we'll do airman
engine start w land zero
now our interfaces.
Up I Want to explain something about how Kelley handles this because it tends to throw a lot of people
for a loop.
The interface device in this instance is called W. land zero and now that Kelly has put it into monitor
mode it is being listed as W land zero Morn.
Basically what Kelly is doing is signifying that the device is in monitor mode by putting Mohn at the
end of the device name.
Now in previous versions of Kelly the operating system used to simply change this to mourn and drop
the original name at the device itself.
In other words if you are using an older version of Kelly or if you're reading anything written before
2016 or so about the operating system and its commands you'll always see this listed as 1 0 1 1 1 2
1 3 cetera.
Now it's going to be w when zero mourn w land 1 1 w land to on W and 3M on and so on and so forth.
It's confusing but I understand why they changed it.
It makes it more clear which device you're working with and in what mode that device is currently set
to.
For example if I do airmen in G start w land one which takes a minute it's now clear that w land 1 is
also in monitor mode so we don't have to mourns.
We have w land zero on and W land one more on just to give you some idea and I also wish to point out
that if we do I f config again and look at the interface devices we can see that the Macs have been
changed when we used Mac change the when you updated Cally Linux after you installed it either to a
partition or to a U.S. B device you were most likely prompted as to whether or not you wanted Mac changer
to assign a random Mac automatically to all interface devices every time you boot the system if you
chose to enable this feature you don't need to run Mac change or every single time because it's already
being done for you behind the scenes when you boot the system.
That being said I personally don't tend to enable this feature because associating with a network several
times and leaving a different fingerprint every time even when you don't intend to is sometimes a dead
giveaway to a system administrator that something odd is going on.
So in my opinion it's better to simply develop the habit of running Mac change for yourself as a prerequisite
to whatever you're doing it is up to you.
But if you decide not to make it automatic be extra sure that you don't forget to use it.
In any case now that our devices are ready we're going to use the arrow dump engine command and we're
going to specify which device we want to use for this demonstration I'll use w land one mine now what
we are basically doing is scanning for all networks that are within range of our interface device.
We can get more specific with our scan looking for certain networks or focusing on just one network
to capture particular information.
For right now though we're just doing a general scan to see what's out there.
It should be noted that arrow dump in G will not reveal hidden networks.
That is something that we'll be looking at later but it will show all networks that are publicly broadcasting.
This is perfectly legal by the way.
All we're doing here is seeing what networks are available and reading the information that they are
freely sending us if we let this program run long enough we can sometimes even see devices listed below
the networks.
These devices will have their own mac addresses power rating relative to our location and in some cases
we will see which access point they are associated with.
So let's break this down step by step.
The B SS I.D. is the MAC address of the device itself which is a wireless access point a router the
P.W. R is the strength of the signal.
The closer this number is to zero the better the signal strength.
In other words minus 20 is a lot better than minus 50.
Generally speaking networks that are minus 70 or below tend to be so far out of practical range that
even if you managed to associate with them you'll be getting connection drops constantly.
There are several ways of improving this number.
You can move closer to the router in question or you can get a better antenna and train it in the direction
of the router.
You could get a more powerful wireless card and if you were living in countries outside of the United
States that allow you to do so legally you can increase the power of your wireless card by bringing
the interface down and then using a few simple commands to change the country code in the operating
system and adjust the T X power as you please.
Unfortunately this is not legal in the United States due to FCC regulations since a signal strength
boosted beyond a certain threshold may potentially interfere with other devices.
But if you live somewhere like Bolivia double check that it is still legal and then feel free to boost
your cards to X power to the max.
Of course if you do decide to do that make sure your device makes sure that your device doesn't put
out any harmful radiation or overheat in any kind of a dangerous way.
At any rate beacons beacons are just the number of responses we are getting from the router itself.
The faster this number adds up the better in terms of signal strength the c h is what channel the router
is operating on.
You won't always need to know the channel number but not all tools will scan by method of channel hopping.
So when you need it that's where the info is the N C and cipher are basically the encryption form being
used such as WPP WPA or WPA to we will be looking at methods to attack all of these in this module.
P.S. K under authentication means password or passkey some routers for example only use pin authentication
although why I have no idea since it's way less secure but whatever the case may be that information
is listed here.
Finally the ISIS I.D. is whatever the router has been named when you're done simply press control C
to bring yourself back to the command prompt over the course of this module we'll be looking at how
to attack routers directly with river how to grab handshakes and crack them with air crack how to attack
older forms of encryption such as WPP in a matter of minutes how to deal authenticate targets from networks
and even methods of detoxing that's distributed denial of service attacks against specific access points.
All of these tools and techniques will be using arrow dump as a starting point.
So we'll be performing more specific scans in the future.
For now I just want you to be acquainted with the tool and the basics of how it works.
Now the cousin of Arrow dump energy is the wash command.
It's not quite as useful in that it can't be used to get as much information as aero dump provides but
it does tell us a few useful things.
So I'm going to do wash tech I lowercase i for interface w lan one on
and we'll be talking a bit more about this command when it becomes relevant we'll see it a bit more
in the next video which we'll be covering attacks against access points using a river.
And those will be radio based.
For now it's just worth it to know that Walsh tells you if a router is currently in a state of lockdown
no means a router is not locked and will accept association attempts.
And yes simply means that it won't.
You can see the chipset used under the vendor entry and this can be handy when you're researching methods
of fine tuning your attacks against a particular model of router control see as always brings us back
to the command prompt
the last prerequisite command.
I want to touch on is the I w config command this command tells us things like what mode or interface
devices are in their frequency and their overall power which is listed as t x power.
I mentioned that it is illegal in the United States to boost a wireless cards power beyond a certain
threshold.
However you need to be aware that this can be done and with only a few simple keyboard commands as well.
Black Hat Hackers rarely care about the law and will adjust their operating system control and then
use IOW config to adjust their tax power ratings.
This is possible because as I said in many countries this is perfectly legal as a system administrator.
You need to be aware that this can happen because if you notice repeated brute force attempts in your
router logs such as are generated by river based attacks you can't make the mistake of assuming that
the hacker is physically present in the building or right outside in the parking lot.
There are many techniques to boost radio based attacks.
Black hats frequently adjust their t x power to the max by alternating the country code and then attach
a very powerful antenna like a Yagi to their USP card and then conduct their attacks from a range that
can be measured in miles.
Because I live in the United States I cannot legally demonstrate this very simple technique but it is
not hard to find this information online and bad actors will use it.
This is also a factor for distributed denial of service attacks.
Criminals can attack corporate routers or bump individual computers often network using injection capable
cards which again is something that we'll be looking at how to do in the following videos.
So boosting their signal strength using these techniques that I'm alluding to gives them more options
about how to position themselves physically relative to their target when performing radio based attacks.
So one more thing I want to mention and that's about Mac change the
Mac changer is an excellent little program.
How ever there have been some rather disturbing bugs with it in the past as relates to older versions
of Calleigh and certain chipsets.
So I don't know which specific versions and which specific chipsets are affected.
It is a small number but in some cases when you use Mac changer it will say that your Mac has been changed.
But as soon as you associate with a network the Mac will switch back immediately to whatever the default
value would be.
And obviously this is a very bad thing for concealing your fingerprints and covering your tracks.
So before you rely on Mac changer run it yourself and then log into your own router and check the router
logs and make sure that what you're seeing in the router logs as the connected to as the connected device
is in fact the spoofed mac address and not the real MAC address if it's the real MAC address.
I'm afraid that Mac changed or may not be effective for your current version of Carly or possibly the
chipset of the card that you're using.
So this is something that's important and you need to be aware of it.
A lot of people have blind faith in Mac changer and it can definitely blow up in their face.
So that covers the basics.
I realized this was not a very exciting way to start out the Wi-Fi penetration module but it makes more
sense than explaining each of these steps at the start of each subsequent video.
So once you're comfortable using these tools to change your interface change your mac address and find
targets you'll be ready for the real attack procedures.
Our next video is going to be on Weaver and we'll be looking at just such attack methods using radio
based attacks.
And we'll be using what we've learned here to target those attacks.
So I hope to see you then.
Thank you.