Welcome to Part Five of this module in this module we'll be taking a look at Fern Wi-Fi.
Cracker Fern is a wireless security auditing and attack tool that is written in pure Python and uses
the python Kuti Ji UI library.
The program is theoretically able to crack the W E P WPA and P S keys and also run other network based
attacks on wireless and Ethernet based networks but all it really is is a graphical tool for doing things
that you've already seen done in this module so far.
Fern is located under applications wireless attacks we'll just click on it to load it.
Now I say that this all works theoretically and that is because whether or not for her actually operates
correctly seems to depend on its mood and maybe the weather.
I've tested this tool on several different systems so I've ruled out hardware problems.
I haven't gone through the code line by line because quite honestly I don't use Fern for actual pen
tests but as near as I can determine Fern just kind of works properly whenever it wants to which isn't
necessarily that often.
So right away we are greeted with a pretty simple graphical interface.
If you've watched the prior videos in this module and nothing about this is going to be mysterious or
require a lengthy explanation but basically in a nutshell Fern does everything that you've seen so far.
Again in theory you don't need to put your card into monitor mode or mess around with Arrow dump n g
because all of that is actually built into Fern.
It even allegedly changes your mac address for you although the bug with Mac changes still seems to
apply on some systems so I wouldn't trust that it is in fact working as intended.
Until you test it yourself we begin with Fern by selecting our interface device
in this case it's going to be w land 1 and you can click the Refresh button if you insert a USP device
after loading Fern.
And here we get the tool tip saying to access the settings for the network scan preferences.
Double click on any area of the main window scan for network button is used for scan for network based
on the settings option of the settings dialog.
Default is automated scan fake MAC address is always used OK but it said nothing about the fact that
you need your Wi-Fi card to be capable of injection for injection based attacks to work.
So maybe not the most useful tool tip ever.
In any case if we double click on this screen we can see that it is possible to set what channels we
scan for.
In other words we can narrow that to a single channel from the drop down menu if we want to.
Again this is exactly like using arrow dump from the command line.
Where if we don't specify a single channel it'll just get everything in range.
So now we're going to click scan for access points it's initializing and we'll take a second and once
it does we'll see a number next to the Wi-Fi WPA which tells us how many routers have been detected
within range.
You might also see a few pop up next to the Wi-Fi WPP button although those are rare in this day and
age and few people are really still using WPP.
If we'd let this go for a while more than 8 should pop up but I think 8 will be good enough so I'm going
to stop the scan by pressing the button again.
And we're gonna go into WPA and this brings up a graphical readout of nearby access points this is basically
a prettier version of aero dump energy.
I'll click on the old router I've been using for these demonstrations.
It's still Sanji all in here we see the SS I.D. be SS I.D. or Mac channel power rating and encryption
style.
We also see that it supports WP Yes basically everything we'd see an arrow dump from here we can select
the attack method.
I'm going to pick WP s first just to demonstrate that contrary to the access point details we will be
told that Wi-Fi protected setup is not supported or distributed by the selected access point.
This is what I mean about Fern being rather unreliable
but it's always worth trying the WPA attack first.
As I mentioned in the Reaper video earlier in this module although it is admittedly pretty rare that
such a straightforward approach will actually provide results.
It is much faster when it does work so to begin we need to give it a dictionary file for brute forcing
assuming it successfully captures the handshake firm will immediately go to work to try to crack it.
There are no fancy configuration methods here as we saw in prior videos.
You can't piping characters or curtail the min max length of the password.
This is a straight brute force cracker.
We give it a word list file and it will try every word in that file so we click browse we're going to
go to the desktop and we'll give it this file password and of course I I'm cheating here.
You see it cracked the key earlier when I tested it.
So it's displaying it.
I'm going to go ahead and delete the key from the key base so that this scan process plays out as if
I'd never done it
and we'll try this again.
OK.
Now in a perfect world we select our access point which in this case is Sandhill.
We select regular attack and then we just click the Wi-Fi attack button.
So begins by probing the access point and launching D authentication attacks and Fern will now proceed
to try to kick client off the access point through these d authentication attacks.
Then it will grab the handshake when the client Client reach authenticates with the network.
Well that went rather quickly.
OK well that went faster than I expected.
Basically what happened is Fern probed the access point.
It found the target client in this case the laptop the junkie laptop that I had connected to the junky
router and using for this demonstration.
It does authenticated it with packet injection.
Similar to what you saw in the prior modules then captured the handshake when the client was bumped
off the network and then re authenticated automatically once it had the handshake.
It began a brute force attack reading off every password in the password file that we provided it.
Now of course I cheated and put the correct password Hanako 20 asterisk into that file to make sure
that it would crack in a timely manner.
I mean we don't want to be here all day and once it did that it successfully cracked the password it
displayed it here and we'll be able to find it in the Keys database which I will show you in a moment.
I think it's also a good idea to point out here that even though the probe access point phase of this
attack is supposed to provide you with this MAC address right here in a in a dragged down menu form
it doesn't always work that way.
You may end up having to use aero dump in g to get the MAC address of a connected station because for
the life of me I could not get this to work properly using firm Wi-Fi.
I entered this MAC address myself so if that's a problem for you just go back and look at the prior
videos in this module to see how aero dump engine works but basically we've got the password.
So now if we close out of this and go into the Keys database we can see that the password is now stored
in our database.
Now if we want to keep this password the next time we load Fern we need to click save changes.
We also have the option of inserting a key manually for a station where the password we already have
it.
Or we could delete an existing key.
So now let's take a look at the tool box.
Button
will begin by clicking on the geo locator free tracker and if we click on this we get the unhelpful
message telling us that this feature has been depreciated.
In other words it just doesn't work anymore.
From what I've been able to determine this feature used to make a handy real world map with pins showing
the locations of access points.
That's a very nice feature and I hope the designers consider bringing back in the future if we click
on Wi-Fi attack options we can see that we have the option to specify a specific mac address to spoof
again with the stated disclaimer that I don't entirely trust any Mac change or program in Cally Linux.
And you really want to test them carefully to make sure that they work correctly with your hardware
before you put your trust in them.
Remember that just because Mac change your claims that your mac address has been changed doesn't always
mean that it doesn't snap right back the second you associate with an access point so tested thoroughly
and we can also specify our capture file settings if we want firm to store the captured hands handshake
somewhere else if we click on font settings.
This is exactly what you think it is and don't make the mistake I did earlier.
If you click okay here to get out of this dialog box the next time you load Fern there will be no text
anywhere on the screen.
That's because it will switch Fern to font size 1 which is basically nonexistent.
So make sure that your font size is 7 or bigger or you just you'll be stuck or you can just cancel out
of the screen.
So now we'll take a look at the last kind of selling point of fern at least back in the old days the
cookie hijacker.
And this will take a moment or two to load.
Here we go.
So for this I've plugged in the Ethernet connection to the router so I'm going to select that now in
the form of at the zero if we were connected to the router.
That is to say we were we entered the password and we associated with it.
Normally we could use one of the Wi-Fi cards down here but Ethernet is a lot faster for this sort of
thing which is already going to be a little bit slow and a little bit buggy.
So now we need to give the default IP address of the router the default gateway which in this case is
going to be one ninety two dot 168 dot one dot one your default gateway may vary.
And we're going to start sniffing and this is engaging a man in the middle attack which is intended
to grab cookies that are being exchanged over the network.
So I'm going to briefly go into my other little laptop here and I'm going to click on some Web sites
that I know to be insecure and hopefully the cookies will be grabbed immediately.
However this doesn't always work quickly.
And when you try this yourself on your own computer you'll see just how much these sorts of attacks
will slow down the connection of the target machine in this case I'm getting a lot of DNS probes failed
before the Web site actually comes up and that can be a giveaway to someone who's kind of savvy about
these things that something odd is going on with the connection OK we've captured our first cookie for
the machine on the network that has a dot eleven as the IP address the end so we click here.
It's still loading that's why going to give this just a second to finish this just does not want to
cooperate
so I'm going to grab a few more cookies before I stop the sniffing.
These are just random web sites I'm visiting on the computer that I'm using as a target for this man
in the middle attack and what we're doing here is were stealing these cookies in real time unfortunately
real time is very slow because man in the middle attacks really slow down the network connection.
Okay.
That should be good enough.
I'm going to click stop sniffing.
OK.
Let's see what we've got.
So I visited two Web sites here's the British Museum.
Here's the cookie we captured for it
no Cookie hijacker used to be a lot more effective in the old days it basically works like this.
You connect to the access point that you just hacked select the interface that you're connected through
which again in my case was at zero since I'm plugged into the router and then you supply the default
gateway.
Then you click the Start sniffing button.
Once you do that you start gathering cookies from any insecure Web sites that the other clients on the
network visit and we can right click on the cookie and click hijack session.
If we wanted to that will eventually open a web browser or whatever you happen to have is the default
browser and allows you to literally hijack the user's session if they're logged into Facebook.
You'll be logged into their Facebook as though you were sitting at their computer.
But on your computer but in reality that just doesn't happen anymore.
I mean good luck finding any Web site that isn't each to CPS the security has to be really poor for
anything to show up here.
And honestly there are better ways of conducting man in the middle attacks enter cat better cap wire
shark SSL strip just to name a few when you try this on your own target machine you'll also see just
how much the internet connection of the target that you're using slows down and that pretty much covers
it.
First Wi-Fi cracker is just another way of doing what you've already been learning to do if you've been
following this modules videos and order.
But in my opinion it isn't the better approach because its functionality tends to be very spotty and
because all you can do is a direct brute force attack which quite honestly is the worst way to crack
anything and should always be the last choice because in reality it's always going to take about you
know ten thousand years unless the person is very very dumb about their password.
And another thing I have to mention and I know it seems like I'm really kind of ragging on firm Wi-Fi
cracker but when I ran this initially and tried to record the capture of these cookies it not only crashed
it crashed the entire operating system which I can honestly say has never happened before with any of
these tools.
So it is kind of spotty but it can be a useful tool as always.
Never use this or any other tool shown in these videos to hack anything that you don't personally own
or have written permission from the owner to penetration test.
I hope you found this video helpful.