WEBVTT 00:00:01.440 --> 00:00:02.020 Hey there. 00:00:02.029 --> 00:00:02.800 I'm Ricardo. 00:00:02.810 --> 00:00:04.220 I'm a cybersecurity specialist, 00:00:04.220 --> 00:00:07.040 and I'll be showing you how to use the aircrack‑ng to get 00:00:07.040 --> 00:00:08.850 initial access to wireless networks. 00:00:09.540 --> 00:00:13.380 Testing Wi‑Fi networks is extremely important because in the majority of the 00:00:13.380 --> 00:00:16.050 cases it will give access right into the internal network. 00:00:16.540 --> 00:00:19.000 And the best part is you don't even need to be physically 00:00:19.000 --> 00:00:21.170 inside of the office to get access the network. 00:00:21.180 --> 00:00:23.860 You can just park your car close by and hack away. 00:00:25.340 --> 00:00:27.920 Aircrack‑ng is one of the most used frameworks for 00:00:27.920 --> 00:00:29.150 wireless security assessments. 00:00:29.640 --> 00:00:33.420 This tool was developed by Thomas d'Otreppe, which is also known as Mr. 00:00:33.420 --> 00:00:33.970 X. 00:00:34.200 --> 00:00:37.470 And thanks to him, my life as a red team specialist is way easier. 00:00:38.140 --> 00:00:41.030 Also, I learned a lot from Thomas in DEF CON talks, 00:00:41.060 --> 00:00:44.190 so if you haven't checked them out, I do recommend them. 00:00:44.200 --> 00:00:45.460 So, thanks, Thomas. 00:00:46.540 --> 00:00:50.170 The aircrack‑ng is actually a fork from the original aircrack 2, 00:00:50.540 --> 00:00:53.850 and this fork became the most famous Wi‑Fi assessment tool. 00:00:53.850 --> 00:00:58.950 The aircrack‑ng is a complete suite of tools to assess Wi‑Fi network security. 00:00:59.540 --> 00:01:02.660 This framework contains a lot of tools that can be used to monitor, 00:01:02.670 --> 00:01:05.570 attack, test, and crack wireless networks. 00:01:06.240 --> 00:01:08.940 What I love about this tool is that it's very simple to launch 00:01:08.940 --> 00:01:12.500 attacks. And also, because it's a command‑line tool, you can create 00:01:12.500 --> 00:01:14.670 your own scripts to automate the whole process. 00:01:15.940 --> 00:01:20.170 The aircrack‑ng is an open source tool for Wi‑Fi security assessments. 00:01:20.540 --> 00:01:23.960 It is available under general license, meaning that you can use it for free. 00:01:25.040 --> 00:01:28.690 The aircrack‑ng is the most used tool by wireless penetration testers. 00:01:28.700 --> 00:01:30.950 As you see, it has tons of features. 00:01:31.940 --> 00:01:32.430 Also, 00:01:32.440 --> 00:01:35.930 this framework is included in the majority of the Linux security distributions, 00:01:35.940 --> 00:01:38.270 such as the Kali Linux and the Parrot Linux. 00:01:38.640 --> 00:01:41.640 But if you want to install it in your favorite operation system, 00:01:41.750 --> 00:01:44.760 you can just download it directly from this GitHub repository. 00:01:45.540 --> 00:01:46.050 Also, 00:01:46.060 --> 00:01:49.030 you can use the aircrack to crack both WPE networks and 00:01:49.030 --> 00:01:51.660 WPA networks. And if you're successful, 00:01:51.670 --> 00:01:54.060 it can give you initial access to the company network. 00:01:55.740 --> 00:01:58.340 So, if you're familiar with the red team kill chain, 00:01:58.350 --> 00:02:01.450 the aircrack‑ng suite can be used in the recon, as 00:02:01.450 --> 00:02:02.970 well as the exploitation phases, 00:02:03.340 --> 00:02:06.280 which means with aircrack you can find potential target 00:02:06.280 --> 00:02:09.150 networks and exploit some of the WPE and WPA 00:02:09.150 --> 00:02:11.240 vulnerabilities to get the Wi‑Fi password, 00:02:11.250 --> 00:02:13.750 which then will give access to the internal network. 00:02:15.340 --> 00:02:17.670 So, if we map the techniques that we learn in this 00:02:17.670 --> 00:02:21.460 course to the MITRE ATT&CK framework, you see that we cover three areas. 00:02:22.140 --> 00:02:25.430 The main one is the initial access, or more specifically, 00:02:25.440 --> 00:02:30.150 the technique T1465, which is attcks to Wi‑Fi access points. 00:02:31.240 --> 00:02:35.250 Also, as the aircrack can be used to brute force WPA2 passwords, 00:02:35.260 --> 00:02:38.700 we can also map the aircrack to the T1110 technique, 00:02:38.760 --> 00:02:40.270 which is brute force techniques. 00:02:41.240 --> 00:02:42.650 And last, but not least, 00:02:42.660 --> 00:02:45.070 you'll learn how to use the aircrack‑ng to cause a 00:02:45.070 --> 00:02:46.970 denial‑of‑service in a Wi‑Fi network, 00:02:47.340 --> 00:02:51.270 which is the technique T1464 in the MITRE ATT&CK framework. 00:02:52.840 --> 00:02:55.750 I want to quickly show you how attacking wireless networks 00:02:55.750 --> 00:02:58.610 can help you on your red team engagement. Imagine you're 00:02:58.610 --> 00:03:02.370 trying to compromise Globomantics, which is a medium‑sized consultancy company. 00:03:02.940 --> 00:03:05.460 Their network looks like this one you're seeing in this slide. 00:03:06.140 --> 00:03:08.470 Basically, most of employees have laptops, 00:03:08.750 --> 00:03:10.670 and for this reason, when they're in the office, 00:03:10.680 --> 00:03:13.760 they use the corporate Wi‑Fi to access the internal service. 00:03:14.740 --> 00:03:17.350 You, as an attacker, can try to attack the Wi‑Fi 00:03:17.350 --> 00:03:19.150 access point to get its password. 00:03:19.840 --> 00:03:22.530 If you're successful, you have access to their Wi‑Fi, 00:03:22.540 --> 00:03:25.570 and we have the same level of access then the other employees. 00:03:26.040 --> 00:03:28.090 And with that, you're in the internal network, 00:03:28.100 --> 00:03:32.010 meaning that you go ahead and try to hack the internal servers. Pretty cool, 00:03:32.010 --> 00:03:32.350 right? 00:03:34.040 --> 00:03:36.270 But before getting to the technical part of this course, 00:03:36.280 --> 00:03:39.390 I want to keep in mind that hacking to Wi‑Fi networks without 00:03:39.390 --> 00:03:41.800 authorization is illegal in most of the countries. 00:03:42.040 --> 00:03:44.580 And this means that if you hack into someone's Wi‑Fi, 00:03:44.590 --> 00:03:46.760 you may go to jail, and that's not cool. 00:03:47.540 --> 00:03:50.570 So, it is important to stay legal. First, if you're 00:03:50.570 --> 00:03:52.020 working on a red team project, 00:03:52.030 --> 00:03:54.630 make sure you have a letter of engagement from the client 00:03:54.640 --> 00:03:56.850 detailing the dates that the test will be executed, 00:03:56.870 --> 00:03:58.850 as well as the type of attacks that are in scope. 00:03:59.840 --> 00:04:00.320 Also, 00:04:00.330 --> 00:04:04.120 it is important to have a formal document signed by the client detailing 00:04:04.130 --> 00:04:06.260 and authorizing the attacks that you'll be performing. 00:04:06.940 --> 00:04:10.060 And this is the document that differentiates a criminal from professional 00:04:10.060 --> 00:04:13.730 red team specialist. And as a personal recommendation, 00:04:13.740 --> 00:04:16.209 always consult the client before executing any 00:04:16.209 --> 00:04:17.670 attack that may impact the network. 00:04:18.140 --> 00:04:20.450 So, the bottom line, don't be a criminal. 00:04:22.240 --> 00:04:24.850 To follow the demos in this course, you need two things. 00:04:25.340 --> 00:04:28.850 The first one is a laptop or a virtual machine with Kali Linux. 00:04:29.440 --> 00:04:32.030 In theory, you can use any Linux distribution you want, 00:04:32.180 --> 00:04:33.850 as long as you install aircrack on it. 00:04:34.440 --> 00:04:35.160 However, 00:04:35.170 --> 00:04:37.730 I do like to use Kali Linux because everything in 00:04:37.730 --> 00:04:41.060 preinstalled and ready to use. Here, in this case, 00:04:41.070 --> 00:04:45.200 I'm using the Kali Linux version 2020.1, but you can 00:04:45.200 --> 00:04:46.890 use any Kali Linux version you want. 00:04:46.900 --> 00:04:51.320 All of them have the aircrack‑ng. Also, I do recommend you 00:04:51.320 --> 00:04:53.150 having an up‑to‑date operational system. 00:04:53.540 --> 00:04:58.850 For that, just open the terminal and run apt‑get update and then apt‑get upgrade. 00:04:59.340 --> 00:05:02.160 This will install any updates and upgrades in the operational system. 00:05:03.640 --> 00:05:07.660 The second requirement is a Wi‑Fi network card that supports monitor mode. 00:05:08.240 --> 00:05:09.780 If you're familiar with monitor mode, 00:05:09.790 --> 00:05:12.350 it basically means that the network card should be able to sniff 00:05:12.350 --> 00:05:15.120 wireless traffic and inject packets into the wireless network. 00:05:15.120 --> 00:05:19.020 Just google network card monitor mode, 00:05:19.160 --> 00:05:22.070 and you'll find a list of all the network cards that supports monitor mode. 00:05:22.740 --> 00:05:28.850 My two favorite network cards for this are the TP‑Link 722N and the Alfa 036NH. 00:05:28.850 --> 00:05:33.350 Both of them are supported by Kali Linux and the aircrack. 00:05:33.840 --> 00:05:36.370 And in this demo, I'll be using the TP‑Link one, 00:05:36.380 --> 00:05:38.370 which I paid less than $15 on Amazon. 00:05:39.240 --> 00:05:40.470 So, if you're ready, 00:05:40.480 --> 00:05:43.470 let's go to Kali Linux and see how to crack some Wi‑Fi networks.