Welcome to part four of this module in the last video we looked at how to grab WPA a two handshakes
and cracked them.
Now it's time to look over beside Angie a useful tool for attacking WPP networks and cracking them in
around 5 to 15 minutes or so.
Wired equivalent privacy or WPP is a standard of encrypting wireless networks that has been around since
1997.
It was cracked back in 2001 and rendered essentially worthless as a security measure at least.
But in spite of this it still turns up in the strangest of places.
You might think that by now WPP would be gone completely.
But if you run arrow dump in G over a large enough scale you'll still see the occasional network pop
up.
These are usually a case of someone mis configuring their router or more likely an extremely old router
such as your grandma and grandpa's router.
That being said it can still pop up in major financial institutions which never fails to astonish me
in this video.
We'll see just how easy it is to crack a few years ago.
Award driver using arrow dump or an equivalent program detected in WPP in use in some of the terminals
used by T.J. Max.
The result was one of the largest credit card breaches in U.S. history as the hacker was able to siphon
credit card data off the network for years.
Beside energy comes prepackaged with Cally and will load it from the terminal so we start out with all
the usual stuff we're going to bring down our interface device or devices change the Mac kill off any
processes that are causing problems and then bring them back up into monitor mode.
You've seen this all before so I'll go through this quickly but if you have any questions please go
back and watch the first video in this module.
So I have config to be land zero down the same either card or run Mac changer and assign a random Mac
just because it's a good practice to do it and then we'll do airman and G check usual usual culprits
airmen energy check kill and as soon as this is done we'll bring up our wireless devices and we'll be
ready.
We don't need two cards for this.
So I'm in this case I'm just going to use the slightly more powerful alpha card.
So next we're going to run aero dump energy to grab our target info
and there's our target router.
It's still Sanyal.
I just went into the router and changed the encryption to WPP.
It's an older router so it was available as an option gonna grab the BSA side.
Copy it.
OK there we go now let's open up a fresh window.
I think that would be wise.
We'll bring it beside Angie.
This is an extremely dangerous program.
The program itself is deceptively simple and very straightforward.
As you can see there aren't a lot of switches but be very careful beside has a couple of different modes
of operation.
Now the one that we'll be using today will be to attack WPP.
But what you must absolutely not do is type B side in G and then supply your interface device now were
we to do this if you were to type this command and press enter beside would then proceed to attack every
single Wi-Fi network within range it would scan gather targets and attempt to systematically and automatically
hack all of them for you.
WPP networks would be attacked automatically one after another in exactly the same way as we're about
to see demonstrated WPA networks would also be attacked.
And if you have an injection capable card beside will attempt to deal authenticate and grab handshakes
for every single access point in range it will then collect these handshakes into a single WPA dot cap
file which will be stored in the root directory and it will log all of its resources and results to
the beside dot log file which is also stored in the root directory.
You'd check that file for the specific ESFs I.D. of the network you wish to attack then run air crack
in G against the WPA cap specifying the correct SS I.D. but the problem with that is that it is basically
impossible to do that legally unless you personally own every single network and every single device
that is within range or or you have written permission from the owners to conduct that sort of a test
you will absolutely be breaking the law beside attacks literally everything it can.
So even if you did own every single thing in range of your Wi-Fi card you may still end up breaking
the law.
If a cell phone or a foreign device comes within range during the attack.
In short just don't do this period.
Instead we will use it more selectively by typing beside energy supplying our interface text C for channel
which in this case is one tack B for B SSI D which is our target information we'll just paste that in
there the MAC address of the router.
Simple and straightforward program name interface device taxi for channel.
Give it a target.
And from there we can enter now.
We could use the TAC V or TAC v v for verbose or double verbose but honestly we really don't need to
see every single ping attempt.
So we hit enter and that will start the attack exactly how long this will take will vary but generally
speaking it shouldn't take longer than about 15 minutes.
I found that when I cracked this network earlier it took about five minutes.
But on the second attempt it only took about two so factors like signal strength will play a role.
Rest assured though if the encryption being used is WPP it will fall.
Five minutes 15 minutes it will fall if you owned this network you'd really want to be concerned right
now at how quickly this is going.
Once a hacker breaks into a network they can conduct man in the middle attacks to manipulate the user
experience on of connected machines.
They can redirect them to fake Web sites and so on and so forth.
We'll be looking at things like that a bit later in this series as well as directed attacks against
other connected machines through met exploited and so on and so forth.
But the takeaway never goes the takeaway here is it's just that quick.
Some people in the security field joke that certain forms of protection are really just suggestions
rather than defenses.
WPP isn't even a suggestion.
It's an open invitation.
So here's the hex version of the password.
If we want the plain text we just need to use air crack N G
that's gonna be air crack in G.
Dot forward slash web dot cap.
If you have multiple web captcha files you'll be presented with a list and asked to select by number
which one you want to crack.
But since I only have one this will happen instantly
and there we go there's our password in plain text
so that was cracking at WPP network.
It took us really about an hour five minutes and could go even faster in some cases if people are on
the network and doing things like streaming or heavy downloads.
The process might run a little longer.
The point is that WPP is no barrier against a hacker with even a modicum of skill who can then hijack
your Internet experience with man in the middle attacks and do nasty things like reroute you to web
pages that you think are safe but are in fact controlled by the attacker.
So if you or anyone you know is still using WPP security please consider upgrading.
Now with all that being said beware of honey pots.
If during a penetration test you see a WPP network come up where you might think it is too good to be
true that such a thing would exist.
It probably is some system administrators will run WPP devices as a kind of a trip wire to catch overconfident
attackers.
Consider where you are seeing such a device pop up.
If it is in the home of an old retired couple then it's probably what it seems.
But if it shows up during a scan of a bank or something.
Well at least consider the possibility that it might just be a trap and that is really all there is
to say about it.
I realise this was a rather short video but WPP can be cracked in your sleep and there isn't that much
really to talk about.
I suppose the last thing to point out is that beside keeps a log in your root directory of everything
that you attack.
Using the program you can open it with any old text editor or you can just cut the file like so.
And remember that everything beside attacks gets put into one of two cap files WPA dot cap for any flavor
of WPA and WPP dot cap for web related captures to crack WPA.
You just run air crack and G.
Exactly like you saw in the last video and you would specify which handshake you're trying to crack
by using the appropriate SS I.D..
Right here and that's really about it.
Remember never to use this or any other program to attack any network or computer that you don't personally
own or have written permission from the owner to penetration test.
Thank you.