WEBVTT

00:00:01.540 --> 00:00:04.950
Now, let's try to get the password for a WPA2 network.

00:00:05.340 --> 00:00:09.810
As you may know, WPA2 networks are way more secure than WEP networks,

00:00:09.900 --> 00:00:11.760
but that doesn't mean that it's impossible.

00:00:12.740 --> 00:00:15.480
The main idea is monitoring the network and capturing

00:00:15.480 --> 00:00:17.150
when someone logs into the network.

00:00:17.840 --> 00:00:21.640
If we can capture the packets containing this authentication handshake,

00:00:21.650 --> 00:00:24.120
then we can brute force the password offline.

00:00:25.540 --> 00:00:29.990
So, let's get started by putting my interface into monitor mode. As this is

00:00:29.990 --> 00:00:32.870
exactly as we've done before, we can speed up this video.

00:00:35.190 --> 00:00:38.950
Then, as you can see, now I have my network card into monitor mode.

00:00:39.840 --> 00:00:42.530
So, let's get started by checking the networks around

00:00:42.530 --> 00:00:45.520
me using the airodump tool. Again,

00:00:45.600 --> 00:00:47.450
this is very similar to what we've done before.

00:00:49.840 --> 00:00:50.310
Awesome.

00:00:50.320 --> 00:00:51.010
Take a look.

00:00:51.020 --> 00:00:52.310
This is our target network.

00:00:52.320 --> 00:00:54.370
It is called Globomantics‑Corporate.

00:00:54.740 --> 00:00:58.570
These network is a WPA2 network with a PSK authentication

00:00:58.570 --> 00:01:02.280
method. PSK stands for pre‑shared key,

00:01:02.290 --> 00:01:04.959
which is a network in which there's only one password for

00:01:04.959 --> 00:01:07.720
everyone. And this is very important because our attack

00:01:07.730 --> 00:01:09.350
only works in PSK networks.

00:01:11.140 --> 00:01:13.240
So, let's rerun the airodump,

00:01:13.250 --> 00:01:16.010
but including the bssid filter and the channel

00:01:16.010 --> 00:01:18.070
filter, exactly as we've done before.

00:01:20.040 --> 00:01:21.200
Now, take a look.

00:01:21.210 --> 00:01:23.370
We have one computer connected to this network.

00:01:23.910 --> 00:01:24.550
As I mentioned,

00:01:24.560 --> 00:01:26.820
we need to capture the moment someone's logging into the

00:01:26.820 --> 00:01:29.370
Wi‑Fi, so we have two options here.

00:01:29.840 --> 00:01:33.340
We can wait until someone new connects to the network, or

00:01:33.350 --> 00:01:36.040
we can cause a denial of service for this person that is

00:01:36.040 --> 00:01:40.230
already connected. In this way, when the computer gets connected,

00:01:40.240 --> 00:01:41.560
it will try to reconnect.

00:01:42.140 --> 00:01:42.550
And then,

00:01:42.560 --> 00:01:45.370
as we are capturing the packets, we'll be able to capture

00:01:45.370 --> 00:01:47.150
the initial authentication handshake.

00:01:47.940 --> 00:01:48.870
That's pretty cool, right?

00:01:49.740 --> 00:01:53.970
So, how can we force the computer to disconnect? For that, the

00:01:53.980 --> 00:01:56.850
aircrack suite has a tool called aireplay.

00:01:58.140 --> 00:02:01.360
So, let me just stop this capture, add the flag ‑w

00:02:01.360 --> 00:02:03.270
to save the packets into a file,

00:02:03.740 --> 00:02:06.870
put the name of a file, and leave this running on the background.

00:02:08.840 --> 00:02:13.070
In this new tab, I'll use the aireplay to run a deauthentication attack.

00:02:13.740 --> 00:02:18.860
So, I type aireplay‑ng wlan0mon, which is my interface,

00:02:19.640 --> 00:02:25.370
then ‑‑deauth, which is to specify the deauthentication attack,

00:02:26.240 --> 00:02:30.260
then 20, which is the amount of deauthentication packets we will send,

00:02:31.310 --> 00:02:35.560
then ‑a and the MAC address of the Wi‑Fi router,

00:02:35.940 --> 00:02:37.470
which you can get from the airodump.

00:02:38.240 --> 00:02:44.100
Also, we'll put ‑h and the MAC address of the computer connected to the network,

00:02:44.190 --> 00:02:46.750
which you also can get from the airodump screen.

00:02:48.440 --> 00:02:49.210
Perfect.

00:02:49.220 --> 00:02:52.070
So, we have airodump capturing the packets on the background.

00:02:52.540 --> 00:02:55.150
Now, all I have to do is run this command here.

00:02:55.940 --> 00:02:58.620
As you can see, this sends deauthentication packets to the

00:02:58.620 --> 00:03:01.160
router pretending that we're the victim computer.

00:03:01.730 --> 00:03:04.250
So then, the router will drop their connection.

00:03:05.840 --> 00:03:09.170
If we go to the airodump tab, we'll see that the data stream has

00:03:09.170 --> 00:03:13.460
stopped, and then we can just wait a few seconds, and the victim

00:03:13.460 --> 00:03:16.220
computer will automatically try to reconnect to the wireless

00:03:16.220 --> 00:03:20.990
network. Whenever this happens, we see this message here showing the

00:03:21.000 --> 00:03:23.060
WPA handshake was captured.

00:03:24.140 --> 00:03:24.950
Pretty cool, right?

00:03:25.030 --> 00:03:26.040
If that doesn't work,

00:03:26.050 --> 00:03:30.010
you can try to rerun the deauthentication attack again. Once we

00:03:30.010 --> 00:03:34.030
have the handshake, we can stop the package capture. And a quick

00:03:34.030 --> 00:03:35.670
pause here for two important comments.

00:03:36.340 --> 00:03:40.360
First, even though this only dropped the victim connection for a few seconds,

00:03:40.740 --> 00:03:43.350
please talk to your client before executing this attack.

00:03:44.040 --> 00:03:48.010
Some clients do not like the idea of denial‑of‑service attacks, so talk to

00:03:48.010 --> 00:03:51.160
your client and explain that someone may be disconnected for a few seconds,

00:03:51.160 --> 00:03:53.450
and make sure the client's okay with that.

00:03:54.840 --> 00:03:57.690
Also, if the client's happy with denial‑of‑service attacks,

00:03:57.890 --> 00:03:59.670
this can be a great tool in your toolbox.

00:04:00.240 --> 00:04:02.970
Denial of service is a good distraction tool for the IT team.

00:04:03.640 --> 00:04:04.290
For example,

00:04:04.300 --> 00:04:07.570
if you keep disconnecting a few users from the wireless, do you call

00:04:07.570 --> 00:04:09.550
their IT department to complain about the issue?

00:04:10.540 --> 00:04:13.440
So, while the IT department is working on that, you can

00:04:13.440 --> 00:04:16.690
execute more complex attacks and hope that the IT team is

00:04:16.690 --> 00:04:18.250
too busy trying to fix the Wi‑Fi.

00:04:18.940 --> 00:04:21.850
But again, make sure your client is okay with those kind of attacks.

00:04:23.440 --> 00:04:24.220
Okay, cool.

00:04:24.230 --> 00:04:26.470
Now, let's go back to the WPA2 attack.

00:04:27.140 --> 00:04:28.660
We have the handshake captured.

00:04:28.920 --> 00:04:31.560
The next thing we need is a word list to be used in

00:04:31.560 --> 00:04:33.170
the offline brute‑forcing process.

00:04:34.440 --> 00:04:38.490
I downloaded from the internet a huge list of WPA2 passwords. I also

00:04:38.490 --> 00:04:42.390
manually added some passwords to be tested. And here, I'll not enter

00:04:42.390 --> 00:04:44.450
too much details about a word list,

00:04:44.460 --> 00:04:47.090
but I do recommend you to use tools such as John the

00:04:47.090 --> 00:04:49.070
Ripper to create your own world lists.

00:04:50.940 --> 00:04:51.360
Perfect.

00:04:51.370 --> 00:04:53.450
We have the handshake, and we have the word list.

00:04:53.600 --> 00:04:54.660
Let's crack the password.

00:04:55.740 --> 00:04:57.220
We have here two options.

00:04:57.500 --> 00:05:01.510
You can take the WPA2 handshake and crack with external tools such as

00:05:01.510 --> 00:05:06.430
the hashcat, or you can use the aircrack tool to crack this password.

00:05:06.430 --> 00:05:09.460
As this an aircrack course, let's use it.

00:05:10.040 --> 00:05:12.350
So I type aircrack‑ng,

00:05:12.740 --> 00:05:18.150
then ‑w, then the name of the file containing my word list,

00:05:19.240 --> 00:05:22.960
then the name of the file containing the packet capture with the handshake,

00:05:23.440 --> 00:05:25.360
which is the wpa2.‑01cap.

00:05:26.940 --> 00:05:27.390
Perfect.

00:05:27.400 --> 00:05:28.250
Pretty simple, right?

00:05:28.480 --> 00:05:32.840
Let's run this command. In this process, aircrack will

00:05:32.840 --> 00:05:35.160
try to brute force the WPA2 passwords.

00:05:35.640 --> 00:05:37.970
Depending on the quality and the size of your word list,

00:05:38.100 --> 00:05:39.150
this may take some time.

00:05:39.840 --> 00:05:42.960
If the password is really strong, it may take days or even weeks.

00:05:43.640 --> 00:05:48.160
In our case, Globomantics had not a so complex password, so take a look.

00:05:48.430 --> 00:05:51.150
The aircrack found the password, and that's amazing.

00:05:52.440 --> 00:05:56.490
Now, let's try to connect this network. As we've done before, let

00:05:56.490 --> 00:05:59.350
me disable the monitor mode using the airmon‑ng,

00:05:59.740 --> 00:06:02.350
and then let me restart the Linux network‑manager service.

00:06:04.040 --> 00:06:04.590
Perfect.

00:06:04.600 --> 00:06:06.860
Now let's try to connect the Globomantics network.

00:06:11.840 --> 00:06:14.870
I typed the password that we just got, and that's it.

00:06:15.340 --> 00:06:17.170
After a few seconds, we're now connected.

00:06:18.240 --> 00:06:18.990
As you can see,

00:06:19.000 --> 00:06:21.960
I've got an IP address, and I'm able to access the internal service.

00:06:22.740 --> 00:06:23.620
That's pretty cool, right?

00:06:23.630 --> 00:06:25.810
Attacking wireless networks can give you access

00:06:25.820 --> 00:06:27.450
right into the corporate network.

00:06:28.240 --> 00:06:31.450
Now, you can go ahead and have fun trying to hack other internal servers.