Hello everybody and welcome to this tutorial. Today, I will show you the evil twin
method. This will complement a lot of other things along the way,
not only that which will come later, but also it complements that which we've
already done. Primarily because, evil twin allows you to steal all sorts of traffic.
Now you are effectively, with this method what you are doing, you are cloning the
wireless access point, and then all the clients that are authenticated to that
access point can get can get deauthenticated, and the next time they automatically
reconnect, they will reconnect back to you should your signal strength be
stronger. Now, the issue of signal strengths. You all are able to boost the
signal strength on your own if you're using Linux, and if you have the proper
drivers. It won't work on all wireless network cards, but you can
always get an external antenna for your laptop, a USB wireless antenna, or
something of a kind. I do believe they cost, maybe you get a wireless network
card, it goes over a USB, and then that wireless network card has an antenna.
I think you can get one for 20 bucks, something like that, they're pretty
cheap. Make sure that they are compatible in terms of drivers, and your signal can
be a lot stronger than anybody else that is nearby. Or you can simply come close
to somewhere. You can go ahead if you are in a bar, or something like that,
your signal should always be stronger for people that are closer to you. Unless,
they have like a crazy good Wi-Fi system in a bar, or something of a kind. Also, useful
in companies, or something like that. This has been known, people
have been doing this, they go into a lobby, and, I don't know, they're waiting
for something, and they have a laptop that's in their bag, or something like
that, and that laptop is working while they're waiting for somebody. So they're
not suspicious at all, or anything of a kind. And especially if you have a hundred
people in a huge Lobby, or something of a kind, you will practically be
invisible, and be able to take a lot of information that way. However, you will
face the problem of encryption, once again, but encryption is, we are not doing
this for the sake of perhaps cracking the wp2a pass key, because it
can be cracked in this way through a little bit of social engineering, but you
can also, what you can also do here is play around with people's information. So,
play around with their URL, HTTP, GET requests, and you can modify their net
queries. Also, you are in control of what gets served to them, so you can control
the content that gets served to them. Primarily because, you can alter the DNS
servers, and if you alter DNS servers you can have customized MX records, or
something of a kind. What this allows you to do is say that facebook.com will be
resolved to some other IP address than the official one, so to
whatever server you want you can redirect the traffic. Which is fantastic
because you can clone a Facebook page. I'm just specifying Facebook as an
example here, this can be done for pretty for any other site. And this is
practically a foolproof way of getting credentials for any site at all by
changing the DNS servers. And if you configure the DNS servers on a
router, or on a PC somewhere, or in a network somewhere, you will be able to
give them your own DNS servers, and your own DNS servers will point the users in
very specific directions, they will point them to the cloned websites that you
will clone, and that you will host on your Apache web server. And once they
type the credentials in, they will be yours for the taking. Which can
be extremely painful. Okay, so, let's say they make a query to a website, they try
to login, login will fail of course, but you will get their credentials. And as
soon as you get their credentials you can redirect traffic elsewhere, or
something like that, to a legit page. There are limitless options
here. There was a lot of things which you can do that
people tend to do in real life, and a lot of accounts get stolen this way.
However, DNS attacks, and all of that, we will do a little bit later. For the time
being, I just want to show you how you can control, how you can
clone a wireless access point and redirect all traffic to
yourself, and therewith have a good measure of control over it. Anyway, we're
gonna be using one of aircrack's tools today that is airbase. I have the
command listed down below, let me just zoom it in. So we're gonna need airbase,
which will be our tool used for cloning, and down below
I have aireplay -ng. We have used that before for deauthentication. Anyway, let's
just go ahead and proceed with this. The first thing that we need to do of course
is, well, scan to see where we are, what's in our environment,
what sort of MAC addresses do we have, what sort of access points do we have,
and in order to do that we need monitor mode, as always. So ifconfig wlp2s0
down, iwconfig wlp2s0 mode monitor. iwconfig wlp2s0 mode monitor. airmon-ng wlp2s0, kill,
network manager will go down first, 4734. And then I need to kill...
dhclient, need to kill that too, 30664. Okay, that's one died already.
Let's see...11289, excellent! Let's perform a check now. Okay, I'm gonna leave
these running, I'm pretty sure that they won't interfere. Now the commands that
I've typed in now I'm not gonna explain them in detail, they are explained in the
previous tutorials, now we're go ahead and do some scanning. So,
airodump-ng wlp2s0, press enter, and there we go. There's a
scan in progress...I'm gonna, wait I'm not gonna hold the scan here. This
is my wireless access point, Something. As before, it's pretty strong
here. I'm gonna have to move it to the next room, or something like that, in
order to get a bit of a better signal. I'm gonna connect a device to it and
down below we're gonna see a jump, but it doesn't really matter, that's not what we
are after, we just need to clone it. But, down below
you have all of these authenticated clients to the stations. I need to zoom
this out to show them all, there's quite a bit of them, and there we go. I seem to
be authenticated. I'm pretty sure that my device is one of these.
It doesn't really matter, I just wanted to connect it. Anyway, now
that we have all this information from the scan, we're gonna go ahead and take
this one, take the MAC address. Just go ahead and copy it and type in the
following. Okay, let's just clear this...wait, I can't clear the screen, I need
the information. Let me just zoom it in. So airbase-ng space -a MAC address,
paste the MAC address. A good idea is to copy/paste the MAC addresses so you
ensure that you are not making any mistakes whatsoever. Now you need
- -essid. I'm pretty sure that you don't need to use quotation marks, but if it's like
a 2-part, or something like that, then you will need to use the quotation marks to
make sure that the string is loaded properly. And then we need a
channel of course. What will be the channel? Channel 6. For those of you who
have enabled your monitor mode via airmon-ng, start wlp2s0,
it will create a virtual interface which is mon0. I didn't do that so I'm just
gonna use wlp2s0 like this, and press Enter. And now that I have my fake
wireless access point running, I am going to deauthenticate pretty much everybody on
the real access point with the ESSID something. Now once I
deauthenticate them, if they attempt to automatically reconnect they will all
reconnect automatically back to me, and for that I'm gonna need aireplay-ng
-0 0 -a, and then this MAC address here. This is simply the MAC
address of the real wireless access point, the one that we are faking here.
Anyway, let me just go ahead and press ENTER. Now I'm sending the
deauthentication packets, and you see immediately there's a client being
reassociated with me. I'm gonna go ahead and stop the deauthentication packets,
but I will leave this running. And you see it says reassociated (unencrypted) to
ESSID "Something." Now what we can do with this traffic? I'm not going to
show you how to modify it now, I've showed that in the part for fun, where
you can do all sorts of trickery, but we will do more serious stuff as well.
However, now I would like to show you how you can actually monitor this traffic,
and what you can extract, what sort of information can you extract
from it. Anyway, I bid you all farewell, and I hope to see you all in the next
tutorial.