How to hack a WiFi network, well one easy way is with a pair of binoculars.
Hey who says all hacking has to be done with a computer?
Some people leave their router sitting on a window sill with the ugly looking password
label facing the outside world.
Or you could just brazenly walk up to your neighbours house and peer through the window.
Ok if no one has left a router on show then you will have to use something like Kali Linux
with aircrack-ng, and in this video I will show you the theory and steps to take in order
to crack a WiFi password, and I will also advise how best to protect against an attack
to your network.
Despite advances in WiFi encryption technology, there have been greater advances with decryption
technology, specifically utilising ever more powerful graphics cards.
Unfortunately most WiFi passwords are relatively easy to crack!
And the reason they are easy to crack is most people leave router settings as the default
with the ISP or router name broadcast to the outside world.
So why is this such an issue?
The limitations of WPA2 are 63 alphanumeric characters upper or lower case, and some symbols.
So thats approximately 95 ^ 63 = 3.9e+124 combinations which will take many thousands
of years to crack.
But taking a known character set and make up of an ISP router, for example a BT Homehub 4
which utilises lowercase hexadecimal characters excluding zero and no repeated characters,
which gives just under 310 billion combinations.
Sounds a lot?
Well a rig consisting of eight nvidia GTX 1080 graphics cards could have that cracked
within 27 hours.
The method I am going to demonstrate in this video relies on offline cracking, where we
will grab a copy of the victims hashed password when they authenticate to their network.
In terms of equipment required, you will need a WiFi device compatible with Linux and capable
of being placed into monitor mode.
Ralink based devices tend to be easily compatible, and for device manufacturer I would look at
someone like Edimax who ensure drivers are supplied into the Linux kernel.
Now to fire up Kali and open the easy point and click Fern WiFi Cracker.
Its a GUI front-end for aircrack-ng, and although is easier to use, it may not be as quick to
actually crack a password.
First off select an interface, hopefully you should see your device here called something
like wlan0 or wlan1.
Once chosen it will automatically place your device in monitor mode, necessary for viewing
traffic over networks you are not actually connected to.
Then scan for access points.
You will now see a couple of network types available in your vicinity split into WEP
and WPA, and a number of networks Fern has identified.
If the number is a bit low move your antenna around or consider investing in a long range
WiFi antenna, or even make your own using a tin can.
A decent antenna could span a distance of a few kilometres, so even if live in a nice
open area away from anyone else, an attack against your network maybe feasible.
WEP or Wired Equivalent Privacy is a very basic crude form encryption and extremely
easy to crack with enough packets.
You can simply sit there and listen to traffic from the network, or inject your own.
Don’t use WEP on your own network, you should be using WPA2.
WPA or Wireless Protected Access is more complex.
Simply listening to the midstream traffic from a device on the victims network to the
access point and then attempting to decrypt it is not feasible.
What we require is the encrypted hash from the four-way handshake when a device authenticates
to the access point.
How do we obtain this hash?
Well there are two options: 1.
Wait for your victim to connect and listen out for the four-way handshake
2.
Boot your victim off their network with a de-authentication packet, and then listen
out for the impending four-way handshake.
Either way we require the victim to be using their network at the time.
Looking at the results of WPA.
So we have a long list of networks which could be attacked.
As you can see certain networks have the Support WPS highlighted
WPS stands for WiFi protected setup, it utilises a 7 digit pin to connect new devices.
A serious flaw was discovered with WPS back in 2011 in that once the seven digit pin was
brute forced, the WPA preshared key or password was easily obtainable.
7 digits is just shy of 10 million combinations and can be brute-forced in a matter of hours.
Lesson to learn for defending your network, turn WPS off.
Having identified a target we are now going to do some research on what the password might
be.
How can we acquire this information?
With Google or your favourite search engine.
Scrolling down the page of results and I find a useful result here.
Hacking the BT Hub 3 or 4 or potentially more.
Lets have a look a bit further into it.
They state Wireless keys are a strict length 10 and in a hex range so 0-9 a-f case insensitive.
But looking further down someone provides further information in the comments to state
that.
Length is 10.
Uses hexadecimal with no zeros.
No more than 3 numbers or 3 letters in a row.
No digit is repeated.
Only uses 3 different letters.
So they do give a rule on how to create this in crunch.
You can either find a dictionary list off the Internet or make your own.
There is a tool supplied in Kali to make your own word list.
That is called crunch.
The format is: minimum word length, maximum word length, a character set, (hexadecimal
excluding the number zero), I don’t want any duplicate characters next to each other,
and since I don’t want to sit here all day I am going to provide most of the password
to it.
The @ characters are what I’m asking Crunch to fill in using the pattern I supplied earlier.
An output file of.
An output file of words.txt in the home folder.
Press enter.
Maximum and minimum should be the same as the pattern itself.
Obviously I cannot count.
Ok I have typed too many characters Thats what I meant
Thats going to be 2744 combinations Looking at the file, well thats the first
10 lines And thats the last few lines
Found a client on the network and I’m going to select that from the list
Now to load the dictionary into Fern Looking at the hexadecimal characters at the
beginning will tell you what the device actually is.
In this instance it is a device made by HTC.
Lets commence the WiFi attack Probing
Now it will try and de-authenticate it from the network
Indeed I can see it go offline Now I can see my phone automatically re-authenticating
Yes handshake is captured Got it
That tells us the WPA Key, and that corresponds to what I have written down
Yes I have made that look easy because I knew what the password was, but while my system
could have cracked it, I didn’t want this video to take hours or days to make.
In conclusion: Make sure you’re using WPA2 for your router encryption
Rename your router in order to deny any knowledge about possible passwords to a potential hacker
Turn off WPS.
The 7 digit passcodes can be cracked within a matter of hours
Choose a complex password.
And that is it.
Thanks for watching and I’ll see you all later