WEBVTT 00:00:01.540 --> 00:00:04.570 Now that Kismet is running, you might have noticed a URL up there. 00:00:05.140 --> 00:00:08.590 That's the URL of its own web server where there is a 00:00:08.600 --> 00:00:10.420 more graphical interface for Kismet. 00:00:10.430 --> 00:00:13.670 You can right‑click it and open that link. The first time you 00:00:13.670 --> 00:00:17.010 connect to it, it's going to ask you to create a username and 00:00:17.010 --> 00:00:19.050 password to be the Kismet admin. 00:00:19.060 --> 00:00:21.950 That's the account that will have permission to change some settings. 00:00:26.340 --> 00:00:27.870 Once you create the account, 00:00:28.240 --> 00:00:32.070 you'll be presented with the UI where you would see the different networks 00:00:32.080 --> 00:00:36.280 if you had any source configured. Sources can be configured by going into 00:00:36.280 --> 00:00:38.860 the Kismet menu and selecting Data Sources. 00:00:40.640 --> 00:00:45.670 As you can see here, I only have a Linux Bluetooth capture source available. 00:00:45.680 --> 00:00:48.970 I don't have the Wi‑Fi card that I want to use. Now, 00:00:48.970 --> 00:00:51.360 if you are using a USB interface, 00:00:51.370 --> 00:00:56.200 it's really important that you make sure that that USB interface is 00:00:56.210 --> 00:00:59.170 made available to the virtual machine you are using. 00:01:00.340 --> 00:01:04.470 Now that I've added the device to my virtual machine, 00:01:04.480 --> 00:01:09.490 I'm going to run iwconfig just to see if it's connected properly. 00:01:09.500 --> 00:01:12.720 And even though it's been connected to my VM, it's not showing up, 00:01:12.720 --> 00:01:16.290 so I'm just going to reboot now that it is connected because with 00:01:16.290 --> 00:01:17.660 the kernel modules and all of that, 00:01:17.660 --> 00:01:20.600 especially if you're in a virtual machine that can be rebooted 00:01:20.600 --> 00:01:22.200 because it's not used for anything else, 00:01:22.200 --> 00:01:30.990 it's just easier. Now that we're back, I'm going to run iwconfig 00:01:30.990 --> 00:01:38.310 again after checking that my card is connected to my virtual machine. 00:01:38.310 --> 00:01:42.870 And now you can see the wlan0 interface, 00:01:42.880 --> 00:01:44.550 which is the card I just connected. 00:01:45.240 --> 00:01:49.270 So we're going to go ahead and run Kismet again and reopen that link. 00:01:51.340 --> 00:01:55.120 Now if I go back to Sources, I can see that there's two of them available, 00:01:55.130 --> 00:01:58.530 and one of them is the Wi‑Fi adapter I just added. You 00:01:58.530 --> 00:02:02.280 should be able to enable it from here, but in the current version of Kismet, 00:02:02.360 --> 00:02:05.350 it seems there's a bug and it doesn't think we have permission to 00:02:05.350 --> 00:02:08.750 do that. Because that web interface is fairly recent, it's not 00:02:08.750 --> 00:02:10.750 surprising to see a few issues like that. 00:02:10.740 --> 00:02:13.260 So how would we enable that network card? 00:02:13.240 --> 00:02:14.940 Well, we have two options. 00:02:14.950 --> 00:02:18.250 We can go back to our terminal and kill Kismet, 00:02:20.840 --> 00:02:24.300 and we can edit that kismet.conf file. 00:02:24.310 --> 00:02:29.010 So these are the default settings that Kismet uses where it's going to log data, 00:02:29.020 --> 00:02:32.770 where its web server is going to run if channel hopping is enabled, 00:02:32.770 --> 00:02:35.960 remember we talked about that in the first clip of this module, as well as 00:02:35.960 --> 00:02:41.080 what interface is being used. Now, the thing I don't like about this is if 00:02:41.080 --> 00:02:43.130 you want to change this pretty often, 00:02:43.130 --> 00:02:46.610 it's a little bit annoying to edit the configuration file all the time, so I 00:02:46.610 --> 00:02:49.960 think if you're doing red teaming or penetration testing, 00:02:49.970 --> 00:02:52.970 it's very useful to just be able to change things on the fly. 00:02:53.340 --> 00:02:57.010 So what I prefer doing is specifying some of these options at the command line. 00:02:57.020 --> 00:02:57.880 So in this case, 00:02:57.890 --> 00:03:03.050 the option is ‑c, followed by the interface name, so ‑c wlan0. 00:03:03.050 --> 00:03:07.250 We can then give it a name, and we could even specify what 00:03:07.250 --> 00:03:10.940 channels we wanted to be listening on, which I'm not going to do right now. 00:03:10.940 --> 00:03:15.580 So, kismet ‑c wlan0 with the name wifi. 00:03:15.590 --> 00:03:19.360 If I go back to the web interface, which I still have in my browser right here, 00:03:19.740 --> 00:03:22.250 you'll see right away a bunch of networks popping up showing 00:03:22.250 --> 00:03:24.580 that this source was configured properly. 00:03:24.590 --> 00:03:24.850 Now, 00:03:24.850 --> 00:03:27.850 everything that is blurred in this video are simply 00:03:27.850 --> 00:03:31.830 SSIDs or BSSIDs of real access points, 00:03:31.830 --> 00:03:35.240 including mine and neighbors, so for privacy purposes I am hiding 00:03:35.240 --> 00:03:37.650 them, but that is what you would see in those fields. 00:03:37.940 --> 00:03:41.920 Now what's interesting with the web interface of Kismet is it's much better at 00:03:41.920 --> 00:03:46.070 showing things like graphical displays of how many packets are coming in and 00:03:46.070 --> 00:03:48.860 how much traffic is going on on whatever channel. 00:03:49.340 --> 00:03:54.370 Now, if we go back to that Source configuration again, 00:03:54.760 --> 00:03:55.780 as you can see, 00:03:55.790 --> 00:03:59.300 Wi‑Fi is enabled, it is hopping, and it is going 00:03:59.300 --> 00:04:01.450 between all of these different channels. 00:04:01.840 --> 00:04:05.360 Now, I'm interested in seeing if there is an 00:04:05.370 --> 00:04:07.450 unprotected Wi‑Fi network out there. 00:04:07.940 --> 00:04:10.080 So what I'll do is I'll sort by type, 00:04:10.090 --> 00:04:14.570 because I'm really looking for Wi‑Fi access points more than anything. 00:04:15.040 --> 00:04:15.890 Remember, 00:04:15.900 --> 00:04:19.420 Kismet is also able to see other devices, so you'll see a lot of things here, 00:04:19.430 --> 00:04:22.360 especially if you live in an area where there's a lot of devices. 00:04:24.040 --> 00:04:29.200 Here we go, we see the DangerZone Wi‑Fi, which is using an open network. 00:04:29.200 --> 00:04:30.720 There's no crypto at all. 00:04:30.850 --> 00:04:33.770 And if I click on it, I can see some more information about it. 00:04:34.010 --> 00:04:36.950 It's a Cisco‑Linksys device, and as you can see, 00:04:36.950 --> 00:04:43.450 it is on channel 6. We can see that it has more management 00:04:43.450 --> 00:04:45.290 packets than data packets right now, 00:04:45.300 --> 00:04:48.720 which probably indicates that there's not too much going on on that Wi‑Fi 00:04:48.720 --> 00:04:52.550 network since management usually is not using that much bandwidth. 00:04:53.440 --> 00:04:55.980 So what I'm going to do now is connect one of my 00:04:55.980 --> 00:04:58.660 mobile devices to that Wi‑Fi network. 00:04:59.140 --> 00:05:01.870 As you can see, as I start generating traffic on it, 00:05:02.340 --> 00:05:03.750 we're getting more and more packets. 00:05:04.030 --> 00:05:05.000 That being said, 00:05:05.010 --> 00:05:07.070 remember what we said about channel hopping. We're 00:05:07.070 --> 00:05:10.440 definitely not gathering everything because we're only on 00:05:10.440 --> 00:05:12.450 channel 6 a fraction of the time. 00:05:13.240 --> 00:05:16.050 So what we'll do now is we'll go back to our terminal, 00:05:16.060 --> 00:05:17.520 we're goign to kill Kismet, 00:05:17.530 --> 00:05:20.930 and we're going to run it with that same command, but we 00:05:20.930 --> 00:05:25.450 are going to specify channels="6". 00:05:26.540 --> 00:05:28.370 Now if we go back to that interface, 00:05:29.040 --> 00:05:32.550 we should now see plenty of traffic coming in for that network 00:05:32.560 --> 00:05:35.470 because we're not hopping between the different channels. And 00:05:35.470 --> 00:05:38.300 now you can see that the data portion of the graph is catching 00:05:38.300 --> 00:05:39.660 up fast on the management. 00:05:40.640 --> 00:05:42.850 We can see some more stats about the package rates, 00:05:42.850 --> 00:05:47.030 how many packets per hour are sent if you leave Kismet running for a long time. 00:05:47.040 --> 00:05:49.190 But now, since this is unencrypted, 00:05:49.200 --> 00:05:53.060 what I would like to do is be able to sniff some traffic there.