Welcome to part three of this module in this video.
We're going to be looking at capturing WPA handshakes in real time and then cracking them for plain
text passwords using air crack energy.
The advantage of this approach to what we saw in the last video on river is that once you have the handshake
file you no longer need to be anywhere near your target.
You could be a million miles away and you can still crack it.
It is therefore possible to walk to an access point bump a client off of it using packet injection or
just wait for a client to associate on its own and thereby grab the handshake and then walk away with
it.
Once you have the handshake cracking it is just a matter of time and computer power.
Before we begin I do have to point out that what you are going to see here will not work correctly in
virtual box.
You therefore need to have Calleigh installed to a dedicated partition on your system or you need to
be live booting it a USB B life boot with persistence will work.
But if you live boot without persistence nothing you do will be saved between reboots.
The other thing about virtual box is that it is a very poor choice for password cracking a virtualize
system is going to be using a fraction of the available resources for a real system which is going to
make an already slow process even slower.
This video will also be covering the basics of packet injection in order to do this.
You will need a wireless card with a chipset that is capable of packet injection.
Not all of them are in fact the vast majority of Broadcom cards that come shipped with commercial laptops
will not be capable of doing this.
If you don't have the right card that's OK several steps of this tutorial will still work for you but
you won't be able to perform any attacks that call for injection.
In other words you can still capture the handshakes and crack the passwords but you won't be able to
bump anyone off the network or D os a router.
I'll speak more on this as we go along.
Finally I'm going to skip over the basic setup for these attacks because if you've been following these
modules in order you've already seen this information.
If you have any questions about what I'm doing to get this process started please see video 1 of this
module.
OK so we're going to begin by opening a terminal window and Cally air crack in G comes prepackaged with
Cally and it is located under applications.
Wireless attacks so we don't actually need to install any packages or dependencies provided that we
are using an up to date version of Cally.
So at this point we're going to use Arum on energy
to confirm that our cards are recognized and they are good because one particular step of this process
is going to require the use of two cards at the same time.
So I'm going to bring both of these into monitor mode.
If you type airman energy in virtual box you won't see your cards displayed.
If you aren't using virtual box and still don't see your cards displayed you may need to update your
drivers in any case we'll begin by taking both of these cards down.
I have config w Lancer a down I have config w land one down and once again the names of your interfaces
may vary depending on your card and what specific operating system you're using.
They will generally be w when 0 or w land 1 but if the name very is just use whatever name you see displayed
under interface in airmen N G.
So with that will change the MAC address on both cards because it is simply a good practice.
And once again if you have configured Mac changer to do this automatically every time you boot your
system you may not need to do this.
But keep in mind the bug that I mentioned in the first video Mac change you can sometimes claim that
the Mac was changed and then it will revert back the second your card associates with a network.
So be sure to test it out before you put your trust in it.
Mac change or tack a for random Mac w Len 0 Mac.
Change your tack capital aid of you when one.
There we go now we'll do airman energy check verify.
There are indeed processes that are in operation that are going to mess things up so we will then do
Aram on energy.
Check.
Kill
again if this is new to you please see the first video in this module
and we'll do airman energy check one more time.
Excellent.
All of these processes are now dead.
We will now bring both of our cards back into monitor mode.
Airman Angie start w land zero
airman energy start w land 1.
Now I know I said this in a prior video and I don't want to repeat myself too much but this confuses
so many people I am going to repeat it.
Older versions of Kali change the card name simply to mourn 1 0 Man 1 month 2 etc. newer versions of
Kali will append mourn to the name of the card.
In this case the built in Wi-Fi card on this laptop is now w n 0 Amon which signifies that W and 0 is
now in monitor mode.
The injection capable card which if you're wondering is an alpha by the way is w land one man.
All right so both cards are now operating in monitor mode.
Our goal is now going to be to capture a WP a handshake between the router that we wish to attack and
a client using the correct password for this.
We need to use aero dump energy first to find the correct network and then to scan it individually and
capture the handshake in real time as it is taking place.
Arrow dump n g w land zero on what arrow don't populate for just a moment and I think that's enough.
We don't need to see every router within range so I'm going to quickly explain what it's about to happen.
We've just used arrow dump in G in a very general way as we did in the first video in this module.
This is simply giving us the lay of the land so to speak.
Our demonstration target router is once again going to be Sanyal an old Wi-Fi router that I inherited
when the office was upgraded.
So when you're done running arrow dump energy just press control C to get back to the command prompt.
The important thing here is that we now have the MAC address of our target as well as the e ss I.D.
or name if we didn't already know what it was.
This information is important along with the channel of our target not just to target our attack but
also for the cracking process itself.
So be sure to write it down if there's any danger that you'll forget it and be unable to get it again
later copy pasting into leaf pad works great.
In fact I will do just that
remember to record this information.
You will need the channel number the name and the MAC address later in this process.
And if you're no longer near the access point you'll have to get that information again
now as I said our goal is to capture the handshake between the client and the router in real time.
Once the handshake once we have the handshake we can work on cracking it at our leisure.
The cracking process can be done anywhere on any computer but the capture does require you to be within
a reasonably close proximity to the target access point.
As mentioned previously a P W R rating of minus 70 or below will probably make capturing the handshake
very difficult if not impossible.
Remember that what you are about to see is illegal in most countries unless you own both the target
router and the computer that is logging into it or have written permission from the owner of both the
network and the computer to conduct a penetration test.
If you don't own it or have permission to do it don't do it or it could land you in really hot water
legally speaking.
So what we need to do now is make arrow dump energy scan just the target access point this skin varies
from the generalized scan and then our card is just going to be focusing on picking up everything it
can from our target while ignoring everything else going on around it.
We also need to tell arrow dump in g to write the handshake into a file as soon as it captures it.
Otherwise we're not going to have anything to crack later.
Shelly I'm going to copy this first
to get us started here.
Arrow don't energy Disneyland 0 on Taxi.
1 attack w handshake tack tack.
The SSA D.
And then we give it the MAC address of the router.
So what we're doing here we are specifying our interface.
And again yours may vary but in this case it's w n 0 man.
Then we specify the channel that the target router is using.
This is very important.
That's tack lowercase c and then we're going to use tack lowercase W which is telling aero dumped to
write the handshake file once it is captured and you can call it whatever you want.
I named it handshake.
Just to be simple but you could name it whatever your router is named.
And then we specify Tak tak be SS I.D. followed by the MAC address of the target so we're going to press
enter.
Okay error dump is now conducting a focused scan against our target which again in this case is named
Sanyal from here we have two choices right now.
There are no computers associated with the target router.
In other words nothing is logged in if we want to be stealthy or if we just don't have a wireless card
that is capable of packet injection.
What we can do is leave our computer on in the state let arrow dump energy run just like this for however
long it takes.
And hopefully sooner or later a computer will come along and associate with the target router.
When that happens we will with a little luck capture the handshake.
Now obviously this method takes a lot longer but it is very quiet and kind of sneaky now packet injection
tends to be very noisy because it involves bumping a client off the network through brute force.
Since most computers are configured to reconnect to the Wi-Fi automatically if the signal drops for
any reason most target clients will do exactly that.
Whether the target logs into the Wi-Fi on their own or whether we bump them off and they automatically
re associate doesn't really matter.
Either way we should get the handshake.
So to start off I'm going to log into San all using a broken down laptop I picked up at a thrift store
for these demonstrations.
With luck we'll be able to capture the handshake immediately but be warned.
Things aren't always that simple in real life.
Signal strength and the quality of your card and or the antenna that you're using play a major role.
And it is entirely possible for Arrow dump energy to miss the handshake on the first or even second
try.
If your signal strength is minus 70 or worse you might find that this is impossible or at the very least
quite difficult and there we go.
The WPA handshake is now visible in the upper right hand corner.
Now I confess what seemed to happen immediately actually took several tries and it's only the magic
of editing that it seemed to happen so seamlessly even with a strong signal.
You're not guaranteed to capture the handshake on the very first try.
In any case because we specified that we wanted the capture files to be written several capture files
have now been created by Arrow dump for the handshake itself.
These normally go into the root directory but since my root directory is very cluttered I've moved them
to the desktop for simplicity's sake
as we can see we now have a handshake zero dot one dot cap a dot CSP and another one for kismet and
still another one for dot net experimental again for kismet.
These are different formats that we can crack with various tools in this demonstration.
We'll be using air crack in g to crack the DOT cap file either way because we have these files we no
longer need to be in close proximity to our target nor do we even need to use the machine that we use
to capture these files in the first place we could for example take these files to a computer lab somewhere
and use a supercomputer with sixty five high end graphics cards for brute brute forcing procedure or
even use just a regular computer.
But several of them to divide up the load which is something I'll talk about a little later.
The point is once you grab the handshake you can just walk away.
Unlike with a river which requires you to remain routed to one spot for the duration of the attack before
we load up air crack and go to town however it's time to talk about DDR blessing with packet injection.
I realize that some of you were probably waiting for this.
So here it is.
Just remember that it is highly illegal to do distributed denial of service attacks against any target
that you don't own.
In fact if there's even the slightest chance of interfering with any system that you don't personally
own.
Don't do it.
Of course as a network administrator in a defensive role you need to know how this works.
So here it is.
Now I mentioned that I'm using two wireless cards in this demonstration.
The first card is the built in card that came with the laptop itself.
It is not capable of packet injection but it's just fine for capturing a handshake.
So we put this card into action with Arrow dump.
Well that card is scanning.
We use a second USP card that is capable to launch our distributed denial of service attack.
In this case I'm using an alpha networks a W U S 0 3 6 h in a couple of demonstrations.
I may also use in a W U S 9 3 6 and H which is a bit newer although I have found it to be slightly inferior
in terms of reliability.
In any case for a full list of cards with injection capable chipsets please look online.
The Alpha series tends to be very popular and works out of the box with Cally but beware of counterfeits.
A quick search will show that there is no real consensus about which model of card is the quote unquote
best for Wi-Fi hacking.
And while I have always found the alpha cards to be reliable they are somewhat old and I am aware that
there are newer options out there that most potentially better specs.
Ultimately you simply have to research it and decide what suits you the best.
If you do invest in a card you should also consider investing in a good compatible antenna.
I will recommend that you steer clear of the older net gear cards as I found these to be extremely unreliable
and often require special drivers to make them work in both Cowley and windows.
At any rate let's get started so I'm going to begin by running arrow dumping G again.
Like I said we're not going to write the file this time.
We're just watching the access point.
I'm actually going to adjust the size of this terminal window a bit.
We don't need it to take up the full screen and I actually want a second window open for the attack
itself.
That should be good all right.
So we can see that there is a computer associated with our target network.
Now there are two ways that we can do this.
We can d authenticate a single client such as the laptop I just associated with the router.
In this case we just bumped that one computer off the network for as long as the attack lasts.
Once we stop flooding the target with packets it can re authenticate in the normal way.
Alternatively we could attack the router itself.
In this case all clients that are currently connected will be dropped and the router will be unable
to function properly for the duration of the attack.
So we're gonna do a replay Angie
and I'll expand this briefly to show off the different features the different switches
just to give you an idea
OK.
So to do this we're gonna do air play TAC n g Tac tac d off which specifies our attack method zero which
I'll explain in a moment.
A.
For the access point which is going to be the BSN I.D. of the router that we are targeting TAC C for
client which is the Mac address of the laptop or station associated with the router that we're targeting
and then we need to specify our interface which in my case is W and one.
So to start out will attack just the laptop will bump it off the network if we didn't already have the
p cap file we'd run aero dump in another terminal window such as the one up here and capture the handshake
when it reassume shifts although since we've already done that I'm not gonna bother doing it again.
So the sequence here is every play energy Tac tac d off which is the D authentication attack 0 specifies
the number of packets per burst the 0 doesn't really mean 0 but it tells airplay play that we can loop
the attack.
In other words it's going to keep broadcasting continuously until we interrupt it.
And as long as it continues to broadcast our target should be unable to associate with the network
right.
So we are now D authenticating the client from the target router.
Unfortunately there's no way to see in the video that this is actually working but the laptop is in
fact unable to connect to the Internet.
It still will show up as being connected to the router itself but that's only until it attempts to reach
social aid when we in the attack it will attempt to re associate.
And if we were recording the handshake we would capture it at this point for as long as the attack continues
to loop the target will not be able to use the Internet.
All right.
So that should be good enough.
You can let the attack run for as long as you want but it's definitely off the network.
So to end the attack we just press control C and the laptop will re associate
and there it goes.
And to verify this
and there it is.
So now we'll show you how to attack the target router.
It's essentially the same process we're simply going to remove the tax.
And the MAC address for the client leaving TAC lowercase a and the MAC address for the router
and once again there's no good way to see this arrow dump unfortunately.
But all clients that are currently connected to the router have been dropped.
They may still show up as being associated but they won't have internet connection and for as long as
this attack continues the router will be effectively unusable.
It's being jammed by all of the packets that we're sending when we stop the attack.
All computers that were associated with the network will tend to resuscitate automatically.
The only time this would not happen is when you have a computer where the user has specifically configured
things to not automatically join an available network that it was just connected to.
In other words to not reconnect in the event of a connection drop this by the way is how you would defend
your own machine against such an attack if one were suspected.
But obviously there is no way to enforce a policy of denying all users of a router the ability to automatically
log back in.
Since this is configured locally within the computer's operating system and unfortunately again there's
no way to tell short of trying to log in you have successfully D authenticated the router.
But if you're seeing what's currently being displayed on the screen it is being jammed.
I can tell that my demonstration laptop is no longer connected to the Internet.
But again sadly it won't be reflected in Arrow dump energy.
That is why leaving the attack running for a while is a good idea since you usually can't see the targets
drop off after a few minutes.
Go ahead and cancel it and then most devices will reconnect.
So to do that we just press control see this was how you did awesome a router or knock an individual
client often network.
It really is frighteningly and frustratingly simple.
For as long as the attack continues the target will simply be unable to access the Internet.
If you've configured arrow just dump energy to listen for and write the handshake to a file you should
be able to easily and almost instantly capture the handshake of any router that you're that you are
in close enough proximity to.
So once you have the handshake cap file How do you crack it.
OK.
This is where air crack in G comes into play.
So now we move on to the cracking part of the presentation.
There are a couple of ways that we can do this over the course of this class.
I've demonstrated many many examples of brute forcing using a password list and there isn't really a
whole lot to say about it that is new information.
Putting basic terms we can take a word list file usually called a dictionary and have air crack run
through it from start to finish checking it against the captured handshake until hopefully it finds
the correct password.
Kelly Linux has several word lists pre installed that you can use such as the Iraq you word list.
So please see the prior videos.
For more information about that.
And with that being said trying to crack a password in this way is going to be an extremely painful
experience and the vast majority of cases.
So we're going to get started here.
We're going to do air crack in G.
And I'm really just doing this to show you the syntax because we're not going to try to do it this way.
We'll give it the path to the word list handshake dash 0 1 dot cap and we have to do tech e and specify
the ESM.
Now remember I said to write down the SS I.D. error crack does require you to supply it and if you don't
supply the correct SS I.D. This won't work.
I'm not even going to let this run this way because from this password file I already know that the
correct password isn't there and it will take a million years.
You see the problem here is that our hardware is limited even if you have a supercomputer State of the
art and specially designed for cracking.
This process is still going to be extremely slow.
It is important to take into account the language being spoken in the region in which you captured the
handshake.
If you live in France for example then a word list of English words is quite possibly going to be a
waste of time.
You'll enjoy better results using a list of words in the appropriate language.
The second problem is this method is just a straight brute force attack.
It will read every word in the dictionary.
And if the password is there then eventually you'll crack it.
If not then you waste your time and that's when things get messy.
So there are a number of ways to run air crack in such a way that we can tell it to combine characters
and numbers up to certain predefined limits using crunch which I'll demonstrate here in a moment.
There are also several services online that black hat sometimes upload capture files to anonymously
of course and then crack the handshake for them using powerful computers.
I'll talk about that a little later.
Finally it is possible to divide the load between multiple different computer systems.
If you have them.
I'm getting ahead of myself though if we let this process run long enough with a strong enough dictionary
file error crack will eventually gets the correct password.
This is because I put the password into the file manually but in a real world situation trying to crack
a decently long or complex password in this way is likely going to fail.
And at the very least it's going to take tens of thousands of hours.
It's really not worth it.
So let's dive into this.
One of the primary problems that we're going to run into here is that we're unable to generate vast
amounts of passwords and character combinations a file containing all passwords and all possible combinations
of words would take an impossible amount of disk space.
Fortunately we don't need to do that.
We don't need to rely on a password file at all.
We can use crunch to pipe in predefined character sets right into air crack G.
In other words if we give crunch one two three four as parameters it will feed air crack in g all combinations
of one two three four that are possible.
One by one without actually writing them to a file anywhere.
The upshot of this is that you don't need a billion terabyte word list file and you don't need to monkey
around with switches trying to get aircraft combined and break apart different combinations of things
that are already in your word list the downside is that if this process is interrupted for any reason
you can't resume it like you can with a river.
And since nothing is written you can't see what word aircraft left off on go into a word list and delete
everything before that word to get aircraft to pick up where you left off.
This means you need to be fully prepared to leave your computer on for an extended length of time.
So I could have let this run for a while and shown you how completely ineffectual it is to try to attack
this particular file with a word list but I don't think we want to sit here for hours.
Instead let's crack this password by combining the output of crunch with air crack in G.
Now I believe I said in a crunch video that I'd be elaborating on this process when we got to this point.
If you have questions about crunch itself please go back and see that entry again.
In basic terms if you just want the process itself crunch is the tool that will generate character sets
for us for the purpose of brute forcing it has a video dedicated to it already but full understanding
of it is not required to get started using it in this way.
So crunch comes prepackaged with Carly but if you're using a different operating system you might need
to download it to begin with let's just type crunch 3 5 A B C D
doing this gives us an idea of how long our parameters are going to be and how big they would be in
terms of space.
We type to crunch and the first number was the minimum character length the second number was the maximum
character length and then we gave it a set of four characters to work with.
If we just let this generate for us we can see the amount of data.
This would translate out to in this case seven thousand six hundred eighty bytes worth or one thousand
three hundred and forty four different possible passwords.
Now obviously that's nothing major but if you play around with this you can see just how big these combinations
can get.
For example let's try.
Crunch 3 7 and we will specify the alphabets and wow look at that so the file size has grown exponentially
and the amount of passwords that crunch will generate to be used as guesses has become much larger that
being said this is still not a very big pool of possibilities.
If the correct password is among them it will still fall very quickly provided you are using a modern
computer 60 to 70 gigabytes or so is fairly trivial.
So what happens if we specify a length of
10.
Just look at what happens
now in the petabytes range.
Now let's see what happens if we add numbers 2 3 4 5 6 7 8 9 and 0.
Yeah 36 petabytes and this is the number of possible password combinations so I'm sure you get the point
and I promise I'll stop belaboring it but let's just go hog wild and pretend that we set a maximum of
30 possible just to be crazy almost 7000 petabytes and I don't even want to attempt to say this number.
So unless you're working for the National Security Agency you probably don't have this much storage
on your computer.
The bottom line is no matter what you do you just can't generate this kind of information as a file
to be stored locally and then to be used as a word list it is a practical impossibility.
But what you can do is pass this information directly through air crack energy as it is being generated
that way no space is being used.
So let's do that now.
Clear the skirt.
Clear the screen first crunch three 8.
So what we're doing here is running crunch and specifying a minimum password length of three.
The second number specifies a maximum length of eight.
The pipe symbol tells Linux that we want to pipe the output of crunch into the next command which of
course is going to be air crack in G.
After that we use tack lowercase W but instead of specifying a word list we just do a space and then
put another tack or dash if my calling it a dash helps.
And then we specify our capture file.
You may recall that I named handshake just to keep things simple.
So it's going to be handshake dash 0 1 dot cap your file name will probably vary.
Lastly we need to specify the e ss I.D. of the target.
Remember I said to write that information down without the SS I.D. aircraft won't be able to run so
make sure that it's correct.
After that we just hit enter.
You may have noticed that I set a character limit at 8 our password is still Hanako 20 with an asterisk
at the end.
Now keep in mind that we have given it the entire alphabet but only in lowercase letters.
This is fine for this demonstration but if the password contained uppercase characters or symbols we
would need to include those as well.
I did include the asterisk but if I was doing this blind I'd want to include all of their possible symbols
as well.
And this is going to take a while so I'll be doing a little bit of editing magic here to bring this
process to a speedy conclusion.
I do suggest researching your target a bit.
If you're doing penetration testing against a company for example use the company name in the character
set that you provide for this process.
Use the names of offices try different things tailor your attack.
If you have a lot of possibilities use cool to generate a word list instead of crunch please see the
video on cool for instructions on how to do this because you can just go through all possible combinations.
But regardless of your hardware it's going to take a prohibitively long time billions of years narrowing
things down in any way possible is really going to help you.
One example I can give is that if you know your target is a Comcast router and you have reason to think
that the user stuck with the default password and a lot of users do because older Comcast routers don't
let you change your password very easily then you might know that the password is going to be all capital
letters and numbers and there are going to be 10 characters with no symbols that Comcast thinks that
is a strong random password.
But by being so predictable they make it pretty easy you just tell crunch to try guessing all capital
letters in the alphabet all numbers and set the min max length to 10 10.
That's still a lot of possible combinations but far far less than a minimum length of three and a maximum
length of 10 with lowercase letters and symbols thrown in.
And even less when you consider that they don't use any kind of symbology and the default passwords.
Sorry I'm repeating myself.
I did mention before that it is possible to divide the load if you have a lot of different computers
at your disposal.
You could tell your first computer to try all lowercase alphanumeric combinations from 1 to 5 your second
all alpha numeric from 2 to 2 your third 3 to 3 your fourth 4 to 4 or whatever attack combination that
you devise in this way your covering more ground for less time spent and you will avoid redundancy.
But just remember coming at this entirely blind means you won't know going in how long this might take
leaving several computers devoted to this task for days at a time may not be viable.
Either way the captured handshake file is portable so nothing stops you from using multiple computers
with different sets of parameters to attack it simultaneously.
I also mentioned online services.
I'm not going to recommend any that is not the purpose of this tutorial and many of them are rather
sketchy anyway but you need to be aware that there are services offered online some free some not that
allow penetration testers to upload handshake capture files and then crack it on their own super servers.
If they are successful the penetration tester pays the cracked for the cracked password usually with
cryptocurrency like bitcoin turn to retain anonymity.
I'm not advocating the use of these services please don't misunderstand me I'm simply letting you know
that such things do exist.
It might be worth it to someone with a very old computer to use one of these services.
They don't have a lot of free time to spend cracking the password and pay maybe 5 dollars worth of cryptocurrency
instead of trying to crack it themselves.
In any case through the magic of editing.
Here is our successfully cracked password and didn't actually take that long just a little under six
minutes.
But then again this was a very weak password.
Knowing the exact length the password that you're trying to crack is supremely helpful.
So if you have physical access you should note the number of concealing dots used to hide a password
on systems where the dots correspond to characters which is most systems.
This can tell you the exact password length setting the min max to the exact length is really going
to make this go smoothly and this holds true of all brute force cracking really.
Just knowing passwords length reduces the total number of combinations massively so I highly recommend
reading through the man pages of both crunch and error crack.
For more information on the various switches and the ways in which you can customize your attack the
more you know about your target the easier this is going to be.
Just remember that doing it completely blind you are going to be in for a rough time or maybe you'll
get lucky and the password will be something short and stupid that gets guessed immediately.
In either case I hope you found this tutorial helpful.
Keep in mind that you can always try this technique along with river provided your computer has decent
resources.
Grab the handshake then set air crack to work cracking it using either crunch or a word list while you
run river simultaneously in another window.
That way the time spent waiting for a router lockout to expire will still be well spent trying to crack
the password and the handshake file again remember never to use these techniques in an unlawful way.
I hope you now feel confident enough to work with this tool and you have an idea of how to use it without
it taking a million years.
Just keep in mind this sort of brute forcing is usually a last resort when all else fails.
It can take seconds or it can take years.
Thank you.