WEBVTT

00:00:01.840 --> 00:00:04.150
Welcome to our Kali Linux virtual machine.

00:00:04.540 --> 00:00:08.380
I like to use Kali Linux because it has everything we need already preinstalled,

00:00:08.390 --> 00:00:09.970
so it saves us some time.

00:00:10.940 --> 00:00:14.860
Already connected my USB wireless card to my computer, so we are good to go.

00:00:14.860 --> 00:00:20.450
In our first demo, let's take a look on how to exploit a legacy WEP network.

00:00:21.140 --> 00:00:23.110
Those networks I consider insecure,

00:00:23.120 --> 00:00:24.800
but I still see a lot of companies that are still

00:00:24.800 --> 00:00:27.350
using WEP because of legacy devices.

00:00:27.940 --> 00:00:31.270
So, if you see a WEP network, you know it's an easy target.

00:00:32.439 --> 00:00:34.450
Let's get started by opening the terminal.

00:00:35.440 --> 00:00:35.690
Perfect.

00:00:35.690 --> 00:00:38.680
I already created a folder on my desktop for this demo so

00:00:38.680 --> 00:00:40.360
we can keep our files in one place.

00:00:40.360 --> 00:00:42.090
To get started,

00:00:42.090 --> 00:00:45.310
let's list our network interface is by using the command ifconfig.

00:00:45.310 --> 00:00:46.410
Perfect.

00:00:46.410 --> 00:00:50.790
In here, you can see that my network card is called wlan0.

00:00:50.790 --> 00:00:54.510
To be able to collect packets from a network that

00:00:54.510 --> 00:00:55.700
we don't have the password yet,

00:00:55.700 --> 00:00:58.490
we have to change our network card to monitor mode.

00:00:59.240 --> 00:01:03.220
This enables our card to see packets of any network that is nearby,

00:01:03.430 --> 00:01:05.120
even if you don't have the password for it.

00:01:05.120 --> 00:01:07.620
To enable the monitor mode,

00:01:07.620 --> 00:01:11.490
we use a tool from the aircrack framework called airmon.

00:01:12.440 --> 00:01:15.910
This tool requires that no other network management services are running.

00:01:16.340 --> 00:01:19.600
So, let me first check if there's any other service that will cause me trouble.

00:01:19.600 --> 00:01:24.870
For that, let me type airmon‑ng and then check.

00:01:27.140 --> 00:01:27.790
Perfect.

00:01:27.800 --> 00:01:31.720
Here, the script shows me that a few services could be an issue for me,

00:01:31.720 --> 00:01:34.170
so I have to kill those services.

00:01:34.740 --> 00:01:39.960
And the easiest way of doing that is using the airmon‑ng check and then kill.

00:01:40.710 --> 00:01:42.990
This command will check all the services and kill

00:01:42.990 --> 00:01:44.360
the ones that could cause trouble.

00:01:46.640 --> 00:01:47.250
Perfect.

00:01:47.260 --> 00:01:49.710
Now, we can turn on the monitor mode on our network card.

00:01:49.710 --> 00:01:55.160
For that, I'll type airmon‑ng start and wlan0.

00:01:55.160 --> 00:01:59.720
And note the wlan0 is the name of my network card.

00:02:00.090 --> 00:02:01.750
In your case, it may be different.

00:02:03.140 --> 00:02:05.750
Now I pressed Enter and wait a few seconds.

00:02:08.139 --> 00:02:11.470
Then, as you can see, the network card is now in monitor mode.

00:02:12.340 --> 00:02:15.250
And to confirm that, I will run ifconfig again.

00:02:17.520 --> 00:02:18.160
Take a look.

00:02:18.360 --> 00:02:21.370
Now my network card name is wlan0mon.

00:02:22.100 --> 00:02:25.220
This mon means that my network card is a monitor mode.

00:02:25.220 --> 00:02:26.690
So, that's perfect.

00:02:26.700 --> 00:02:27.370
We're ready.

00:02:28.940 --> 00:02:31.460
Now I want to check out the networks around me.

00:02:32.140 --> 00:02:32.740
For that,

00:02:32.750 --> 00:02:37.430
I can type airodump‑ng and then the name of a network card in monitor mode.

00:02:37.430 --> 00:02:42.170
This airodump will show me all the networks around here.

00:02:42.170 --> 00:02:44.260
And take a look.

00:02:44.640 --> 00:02:48.750
We found this WEP network here, and this will be your target.

00:02:50.740 --> 00:02:53.490
A quick tip here is that if you are doing a red

00:02:53.490 --> 00:02:55.040
team exercise in a large company,

00:02:55.050 --> 00:02:58.570
try to walk around the building to see all the networks that they may have.

00:02:59.240 --> 00:03:01.620
You can literally walk outside of the building since

00:03:01.620 --> 00:03:03.560
the wireless traffic can cross walls.

00:03:04.240 --> 00:03:08.250
And I say that because sometimes those insecure WEP networks may

00:03:08.250 --> 00:03:09.820
be in just a certain area of the building.

00:03:09.820 --> 00:03:13.270
For example, only where the IP cameras are.

00:03:13.840 --> 00:03:16.560
So, if you don't see a WEP network right away,

00:03:16.760 --> 00:03:20.050
it may be worth just walking around the target to try and find one.

00:03:21.340 --> 00:03:22.020
Perfect.

00:03:22.030 --> 00:03:23.290
Now that we know our target,

00:03:23.300 --> 00:03:26.500
we need to collect packets for this network so we can crack the password.

00:03:26.500 --> 00:03:29.670
In here, we can use the airodump again,

00:03:29.930 --> 00:03:33.200
but now we can add some filters since we know the target.

00:03:33.200 --> 00:03:34.730
First,

00:03:34.740 --> 00:03:40.160
I would add the bssid filter and then put the MAC address of our target router.

00:03:41.140 --> 00:03:44.290
Also, since our target network runs on channel 6,

00:03:44.300 --> 00:03:47.350
then I will put ‑c and 6,

00:03:47.390 --> 00:03:51.260
which says that I only want to monitor the channel 6 of the wireless space.

00:03:53.040 --> 00:03:55.860
Now we are seeing all the traffic for that specific network.

00:03:56.540 --> 00:03:59.540
As we can see, there's only one machine connected to this network,

00:03:59.870 --> 00:04:01.460
and the number of packets is increasing,

00:04:01.470 --> 00:04:04.460
which means that that is traffic between the machine and the router.

00:04:04.940 --> 00:04:06.260
And that's exactly what we want.

00:04:07.540 --> 00:04:09.380
Now we need to save those packets in the file,

00:04:09.380 --> 00:04:16.190
so let me stop this and run the exact same comment with the flag ‑w and

00:04:16.190 --> 00:04:18.800
then the name of the file that I want to save the packets.

00:04:19.339 --> 00:04:21.950
In my case, I'll call the file as capture.

00:04:24.840 --> 00:04:25.510
Perfect.

00:04:25.520 --> 00:04:26.970
The data now is being captured.

00:04:27.810 --> 00:04:30.650
Let me open new tab and show you the files that were created.

00:04:33.140 --> 00:04:36.050
As you can see, airodump created five files for us,

00:04:36.440 --> 00:04:40.070
but the one we are interested is the capture‑01.cap.

00:04:40.740 --> 00:04:42.990
This is the one that contains all the packets that we need.

00:04:42.990 --> 00:04:49.050
So, we can use the command aircrack‑ng and then the name of the cap file.

00:04:50.240 --> 00:04:53.770
this aircrack‑ng script will analyze all the packets that were

00:04:53.770 --> 00:04:56.270
captured and try to crack the password for them.

00:04:57.240 --> 00:05:00.150
As you can see, I left my packet capture running in the background.

00:05:00.540 --> 00:05:03.010
And that's because if you don't have enough data yet,

00:05:03.020 --> 00:05:06.270
I can just leave the capture running for a few more minutes and then try again.

00:05:07.240 --> 00:05:10.150
Okay, now all I have to do is run this command.

00:05:13.440 --> 00:05:16.560
And as you can see, in less than a second, we have our password here.

00:05:17.040 --> 00:05:20.970
This password is in the hex format, but we can use it to connect to the network.

00:05:22.140 --> 00:05:23.400
That was pretty easy, right?

00:05:23.410 --> 00:05:26.850
That's the reason that WEP networks are considered really insecure.

00:05:27.440 --> 00:05:29.750
So, let me show you how to connect to the network

00:05:29.750 --> 00:05:31.070
that we just got the password for.

00:05:32.440 --> 00:05:34.660
First, let me just stop the packet capture.

00:05:35.640 --> 00:05:38.890
Then, let me stop the monitor mode on my network card by using

00:05:38.890 --> 00:05:46.080
the airmon‑ng and then stop and then wlan0mo. And let me restart

00:05:46.080 --> 00:05:49.640
the Linux network‑manager service, which was the one that we disabled before.

00:05:49.670 --> 00:05:51.860
So then, I can use it to connect to the network.

00:05:54.040 --> 00:05:54.650
Perfect.

00:05:54.660 --> 00:05:57.870
Now all you have to do is connect to a wireless network as we would do

00:05:57.870 --> 00:06:01.470
normally. I can go to the list of available wireless networks,

00:06:02.140 --> 00:06:06.410
then select the Globomantics‑IoT network, and then type the

00:06:06.410 --> 00:06:09.560
password in the hex format, but without the colons.

00:06:11.840 --> 00:06:14.150
And just like that, I can click on Connect,

00:06:14.740 --> 00:06:19.850
and after a few seconds, that's it; we're in the network. And take a look.

00:06:19.910 --> 00:06:23.750
I even got assigned to an IP, and I even have connectivity to the servers,

00:06:24.240 --> 00:06:25.260
which is pretty cool, right?