Hello everybody and welcome to this tutorial. Today, I will be talking about
DoS attacks and how you can actually deny wireless access to pretty much
anybody within the range of your wireless card. Now your current range of
your wireless card is not your permanent range, or probably it's not your maximum
range, because you can boost the signal as well, but of that I shall speak a bit
later on. For the time being, I wish to focus only on the actual dos attack as
that can, well, not only can you deny the service, but as I stated in the previous
tutorial, you are actually able to trick a user into resetting the
router. Primarily, because if you can't connect your wireless what are
the first things that you do? You basically just reset the router. Even if
you call the ISP provider, one of the first things that they will tell you is
reset the router. And these sort of attacks they don't, unless they are
going over an extended period of time, or something like that,
they don't raise a lot of suspicion. I mean most people when they can't connect
to wireless in their houses, or something like that, oh,
well, reset the router. If it works out, great. If it doesn't,
oh, well, call the ISP then they try to fix it, but you're not gonna be running
the DOS attack probably for that long. Your idea is to force a reset, however
you can run actually permanent dos attacks, and in such a way deny service
to a certain user, or company, or something of a kind. There is no known
way to actually stop this. There are, as I've stated in the previous tutorials
as well, you can use some paint that doesn't allow signals to
pass through, or you can use some tinfoil, or something like that on the walls, but
you are effectively limiting what you can do with your own wireless in such a
way, and that's not really the best of solutions. Anyway, there are certain
things that a user can do on the other side to mediate this sort of an attack,
such as change the channel of their wireless access point, change the
MAC address, but none of those things are actually stopping the dos attacks. All of
those things, all that they are doing, is
simply hiding and buying time. All you need to do is simply follow up on
the changes, for example do a scan. Again, if you see that there is something wrong,
and that's it, you will find a new MAC address, you will
find a new channel, and you will see the new ESSID as well. So, anyway,
without further ado, let's just go ahead and perform this sort of attack. See what
happens and how can we actually confirm it. Anyway, the first thing that we need
to do is set our wireless network card into monitor mode. I have a small script
that I have written for myself here. I have explained it in the previous
tutorials. If you're just wondering why am I not doing this via airmon-ng, so
airmon-ng, and you can also do it like this, wlp2s0, well I've discovered that
on Fedora, the distribution that I'm using at the moment, and the one that I'm
using for the demonstration of this tutorial, well it just presents problems.
I mean, it creates virtual interfaces, and, I don't know, you get an error like name
not unique on the network and there's a way to fix that, or a workaround, something
like that, but I've just written my own script that I'm going to use. You can
use it as well, I've shown it in the previous tutorial. All it does is bring
the wireless interface down, changes its state,
changes the mode to monitor mode, and then changes the state back to
up again. Here you can just see it one more time, quickly, excellent! Perhaps I
should have added a Mac change here as well. That would
actually be a good idea, but for the time being I'm not gonna do that. Primarily,
because there is no need to hide as I'm doing this to my own wireless system.
However, if you're doing this outside, definitely use macchanger -r
wlp2s0. You can only change the MAC address when the
interface is down, you cannot change the MAC address of the interface that is up.
How to do this? I have shown in the previous tutorials as well. Anyway, let's
just go ahead and clear the screen. I usually run
this command airmon-ng check wlp2s0. I use this not to
set in monitor mode, but rather instead to perform a
check-up to see if there are any programs, any processes out there within
my computer that might cause problems or interference. Apparently, there are none.
If there were, once you run this command, it would give you the PIDs of the
processes and you could kill them easily. No problems there. Let's just go ahead
and clear the screen, and the tool that we need to use in this part of the aircrack
package here is AI replay. So before we actually start doing that we will of
course need to perform a scan with a tool that we have used previously. So
airdump-ng, I have no idea why they call it this, so airdump-ng wlp2s0. Oops,
airodump-ng. It's airodump, sorry. I always make a mistake there, but you can
just use tab as I've shown and it's gonna work out well for you. So, apparently, I
have some open access points here as well, and I have noticed a very strange
thing. When I performed these scans during different times of day, the
signal strength varies, and the amount of wireless access points also changes. I'm
just gonna stop this because there are too many of them now.
The amount of wireless access point changes and the signal
strength changes. What I've noticed that people are doing is that they actually
turn their WiFi off during certain times of the day, when they are not
there, or when they are not using it, or something of a kind, and that is a very
wise precaution. I mean, that's a very intelligent thing to do.
Because if there's nobody in your house, if there is nobody using your Wi-Fi,
there is literally no reason for you to leave it online. Just pull the plug,
simple as that. You increase the safety of your wireless, of your home network,
exponentially. Primarily, because not only are you invisible, permanently invisible,
during certain periods of time, but you are also
effectively limiting windows of opportunity for anybody to attack you,
and that can cause a ridiculous amount of problems to an attacker. Anyway, so
over here I have my wireless interface, it's called something, it's on channel 6,
and it's power, it's relatively good. But, look at my neighbors. I
conducted the scan last night, and my own wireless was about 50 something, and my
neighbors was 59 which was ridiculous. I'm guessing this guy's right next to me,
or right below me, with an antenna attached to the ceiling, or something of
a kind. I have no idea, but he's getting a really strong wireless signal. I'm gonna
have to ask around to see who this is just to see what
the signal strength is on this router. But, anyway, it doesn't really matter.
Let's just use let's just use the aireplay. However, I didn't find a way to
actually specify a channel in aireplay, and perhaps there is an option there, or
something of a kind, but it doesn't it doesn't really matter, I didn't try too
hard. What I wanted to show you is that you can actually change the channel of
your wireless network card manually. So just type in...wait, before
we actually do that, lets just try a random scan and see what happens. So aireplay-ng,
and here we're gonna need to specify -0. So -0 is
from the list of arguments that I do believe that I've showed previously, but
it doesn't really matter. So you see in the help menu you have the authentication, you
can use -0 instead of that. Fake authentication, you can use -1 instead
of that, and so on, and so forth. You don't actually need to type in the whole
command, rather instead they've numerated them, so it's a lot
easier to actually use. Anyway, we're gonna say -0, and space. It says count,
so how many the authentication requests do you want to
send. You can specify a number, it can be a very large number here, or you can just
say one for single authentication, for
capturing the wpa2 handshakes. Well, you're probably gonna need more than one,
but it doesn't really matter. I usually have a tendency to place a zero here. Zero
tells it simply to do it continuously. So, you can just do it until you feel
satisfied, or until you've achieved your purpose, and then ctrl C to actually
cancel it. No big deal there. Anyway, after that we need to specify a -a option,
which is the BSSID, and then in addition to that we need to specify the
interface that we're going to be using, press ENTER, and there we go. So it says
here on channel 3, but I know for a fact, and you can scroll up and you can see here's
something, it says channel, it's channel 6. So, this is not gonna work. It says no
such bssid available. Please specify essid so the name, perhaps the name of the
network. Yeah, that is due to this channel problem. So this is channel 3, and my
wireless interface card is functioning on, my wireless access point is
actually functioning on channel 6, while my wireless network card is functioning
on channel 3 in my laptop. What we need to do is manually configure the channel
of our network card. So, iwconfig wlp2s0, which is the name of
our interface, and then channel, and then just say 6. So it's very simple, it's like the
English language. You have a command, so iwconfig, the name of your
wireless interface, just type in the argument that you want to change, which
is channel. Same thing with mode, so just type in mod here and change it
to whatever you want. But in this case we're changing the channel, so just type
in channel, space, and then just type in the number of the channel you wish to
tune it, you wish to change it to. Anyway, now our wireless network card is running,
is operating on channel 6, and if we repeat the command that I have
previously shown, you will see immediately, immediately it actually
passes. This attack is more effective when targeting a connected wireless client, yep, okay. So,
there is this message that we're being displayed here.
This is not an error message, this is just a note of a sort. We can also
deauthenticate individual clients on the network, so we don't need to...see this
attack that I am performing now, this will be authenticate everyone on that
wireless card, on that wireless access point.
Everybody will be deauthenticated. I mean, you can confirm this by using your
smartphone, or tablet, or another PC that is connected to your home
wireless network, and it might show the status that it is still connected, but
try browsing the net, try opening up a website, or something of a kind. You will
not be able to do it, like not in a million years. Also, there are some Mac
filtering options that routers attempt to impose, but it doesn't matter. I've shown
you how you can change a MAC address, and you can also set a script which will
rotate your MAC addresses periodically. So, that that can be a nightmare.
Also, the routers have the option to adjust the MAC address, to adjust to a
certain range of MAC addresses which can access it, but, again, you will be able to
see the authenticated clients on that network, and just use their MAC addresses
instead and pass through. As I said, this is ridiculously difficult to stop, and
it's really painful when you're being DoSed in terms of wireless.
There is very little that you can do. I honestly don't know of any known
method to actually completely stop this, but we'll see. There are
some enterprise type routers that are actually able to fight this off to an
extent, but we'll see what the future brings. Anyway, I will be doing more of
this in the follow up tutorial, and I will show you how you can deauthenticate
single client. Plus, we'll be writing down some bash scripts and see how that works
out to improve our attack. In any case, I bid you farewell, and I hope to see you
in the next tutorial.