Hello everybody and welcome to this tutorial. Today, I will begin a chapter on
wireless hacking. So, first off, you need to know that there are different types
of encryption. There is WEP, or WEP, and whoever still is using WEP
doesn't really deserve to have wireless, just saying. Primarily because, it's
practically as if you had a free password or an open Wi-Fi. It doesn't
really matter, it's quite easy to crack, no problems, three-two-one. However, if
you're using WPA or WPA2, that is another story, that's quite difficult to
crack. Especially if the passwords are longer, or something of a kind. There are
different methods for direct wireless hacking, and I really would not recommend
them in all circumstances. There are some
circumstances which are favorable to these sort of methods, however what is
always better is to actually get the IP of the router, and then attack
the router itself. Because usually it has far more vulnerabilities than the WPA2
encryption, than you are trying to crack. However, since we are cracking wireless,
I'm just going to go ahead and type in ifconfig here, and you
will notice that I don't have a wireless interface here. Why is that? Well, even
though I have a network integrated card, wireless one, within my laptop this is a
virtual machine, and virtual machines do not support integrated network cards.
They can only go through your host machine, and in such a
way virtual machines are secure. So you can install all sorts of stuff on
them, viruses, etc., and you'll still be safe.
They won't be infecting you, and they won't be able to disrupt the normal
functioning of your host machine. However, there are methods where we can get a USB
wireless card and plug it in. Then you can set up a pass-through for your
wireless machine and in such a way gain access to wireless. However, password
cracking from a virtual machine is not a good idea. I mean it's a terrible idea.
Especially using VirtualBox. Maybe if you were using Xen, or something
of a kind, where you have 90 to 95 native performance, that would be great, but
using VirtualBox for password cracking is a really bad idea. Primarily
because, let me just show you here. If you go to devices, and I can
click, sure, why not. I'm just going to go ahead and click on network
settings, and then I will get the menu for the other things. So let's just go
ahead and click on general. Is it here? No, system, sorry.
Look, first of all, it has base memory. This can be altered when the machine is
off, you cannot change these settings here while the machine is turned on.
First of all, it says that I have 2 gigs of RAM available for this particular
virtual machine. Now that's great for day-to-day operations, especially for
Linux that requires 512 megabytes to run. However, if you want to crack, if you want
to brute-force a password, if you want to take that path, if you want to use a
brute force method, just by generating huge password lists and trying to guess
it, this is not really a good amount of RAM. Actually, this is a terrible amount
of RAM for such a task. And if we go ahead and click on the processor, you
will see that ok execution cap is 100%, but we only have a single core assigned. It
says here one CPU core in the upper bar, in the upper status bar, it says processors.
It's gray at the moment because you can't change the amount of processors
that a machine is using while it's running. So that makes no sense
whatsoever. You wouldn't be able to do that in the real world either. Maybe on
some large servers, or something like that, but even there very doubtful that
you could actually swap a processor. That's mainly for swapping disks, or
adding RAM, or something of a kind. In any case, it has only one
CPU assigned to it. I know it says here 4 but I have an Intel i7 inside, and
the VirtualBox supports only 4 CPU cores for its machines.
You should take it in to consideration that you really
won't need more than four for your virtual machines, especially if you're
performing some testing tasks. Or, I don't know, even if you're programming, unless
you're doing something specific that is strongly related to graphics, you
won't be needing that many cores, or anything of a kind. One CPU is perfect,
that's fine, you won't need any more. So, anyway, I'm just gonna go ahead and click,
oh, wait, acceleration. Yep, never mind, I'm gonna click OK here, and I just want to
show you that in order to demonstrate that the resources of your virtual
machine are simply not sufficient in order to support a brute force method. As
I said, you can actually buy for about 20 bucks, somewhere in the store, a
network card, a USB network card, a wireless one. Plug it in, pass through the
ports, and it's gonna work, but it's gonna be terribly slow. What you need to do is
either set up a dual boot, or if you are running a Linux machine as your host
machine you can do what I will do now. Let me just move away from
this, excellent! So, because my main machine is Fedora Linux I have installed
all the necessary tools on it. You can install the same tools
on Fedora as you can on Kali, and I will be doing my pen testing from here, from
fedora. I will exit the virtual machine, I will no longer use Kali for this purpose.
However, if you are a Windows user, if you don't have a native Linux system as your
host machine, you will also be able to do this in Windows. I will show you the
installation process alone, I will not show the actual method, but principles
are the same. Primarily because, when you do it in
Windows you have to use the GUI mode, and quite frankly for these sort of things I
personally do not like to do them via a GUI. It's far more effective to do them
from the terminal. So some of the tools that we will need I will just mention
them here, and feel free to read up on them a little bit on the net as you
progress through the course, and then go through the videos as well. So
there's a lot of extra information out there on the net, especially if you're
facing some sort of bugs, or something of a kind. Also, feel free to post it in the
question section if something is not working, I will be more than happy to try
to fix it for you. So just type in yum search...oops, sorry...
yum search. This is one of the tools that we will need, aircrack-ng, press enter,
and it should find it shortly. There we go. Aircrack is in the default
repositories of fedora, and you will be able to find it there without any sort
of problems. So it says aircrack-ng.x86_64, this is a standard for wireless,
and it says sniffer and WEP/WVP-PSK key cracker. We're interested in this
part, key cracker. Basically, you can install it anywhere, we can even install
it in the virtual machine, capture the file on the host machine, transfer
the file there, but there really is no point to do that. Now we will
install it and I will teach you how to use it. There are lots more things
related to aircrack, but there is one more tool that we will
use that employs a completely different method, uses a completely different way of
cracking wireless passwords, and we will mainly be talking about WPA and WPA2
password encryption methods. I will do a brief demonstration of how to
crack WEP, but, I mean, chances of you encountering WEP in today's world are
practically non-existent. I mean if you open up your cell phone,
I don't know if you're using Android, or Apple's phones, or whatever, or
Windows Phones, and whatever else is out there, just take a look at the wireless
networks around you, and take a look at the encryption methods, because they will
be shown to you. You will almost never see WEP. And if you ever do see it, it's
practically open Wi-Fi. Because WEP has been cracked, it takes a very short
amount of time to break it without any sort of problems. You don't need
to use any sophisticated methods of any kind or sort, a child
could crack it without any problems. Basically, just follow through the
procedure, and that's it. Now as I was saying, there is another method of doing
this for WPA, and the tool name is Reaver. Now Reaver is not in fedora's
default repository, so we will need to go through the installation process
and find it on the net, but basically what Reaver does is guess the
pins on your router. So most routers these days have pin authentication,
whereby you press a button and everybody around you can
connect to that router. Basically, these things have been invented
primarily for Windows users. Rarely, very rarely, will you find a Linux with
support for pins. Primarily because, the method is highly insecure. I mean, that is
really one of the downsides of wireless. If you're using pin authentication, you
should definitely disable it on your home routers as it enables malicious
attackers to basically take your Wi-Fi, get your IP address, and from there move
on to more serious things. I will show you how to disable these things as well
on one of my routers that I have here. I think I have a tp-link, or something like
that. I will plug it in later on and show you what it does. But, in any case, as a
part of the aircrack package you will get a few other programs which we will
use, and later on there is one in the aircrack package, one program in the
aircrack package that enables you to perform a DoS attack on wireless
networks around you. So you will be able to pretty much the deauthenticate whoever
you want, whenever you want, as long as two conditions are met. The first
condition is proximity that you are close enough to the network, and the
second condition is that you actually have to scan in monitor mode with your
network card and figure out what is going on around you,
what is the MAC address of that access point, and what is the MAC address of the
person you want to jam. This is not that difficult to do, this is easy,
both MAC addresses are public information. Pretty much all you need to
do is listen for them. And that is what monitor mode is. Basically, network cards
have a lot of modes that they can operate in, and maybe not a lot,
I think it was six, or something like that, but there are only two which
are of interest to us. There is a promiscuous mode where you get, where
your network card will only process traffic that is meant exclusively for it,
regardless of, I don't know, capturing some other traffic that is being
transmitted wirelessly through the air. I mean just think about it, you have so
many wireless access points around you, and they are all communicating with
devices, and it's not like that wireless access point can send a signal in a
specific direction to your device. No, it sends it in a spherical fashion,
and your device catches it. A lot of other devices catch it, but since the
information is encrypted, and since the information is not for them, they
immediately figure out that it's not for them, namely your network cards figure it
out, and they immediately disregard the information. They don't do anything with
it. However, if you put your network cards in to monitor mode they will actually
take all of this traffic, process it, and see what they can get from it. Some of it
is encrypted, most of it is encrypted, but some of it isn't. Like the MAC addresses
which can't be encrypted, and that's the bright side of it all. You can
take it, and you can jam whoever you want. You can deny wireless access to pretty
much everybody within range, with just having your laptop, and no
extra devices are needed. This is all pure software. You don't need any extra
devices. Of course, it is necessary that your network card supports monitor mode.
There is a compatibility list on the net, I will show it to you in the
follow-up tutorial. But for the time being, I just wanted to introduce you to
the chapter, and to see what we shall be doing. I would advise you, you
don't have to of course and you will be able to fully follow through with the next
tutorial, without doing this, but I would just advise typing aircrack-ng
on google, or whatever your favorite search engine is, and type in Reaver. Just
read the first post, read the first couple of sentences of the first post
that comes by, and see if you can collect some information there. So you can
continue on watching the next video where I will show you how to install
these things. I will show how to install aircrack-ng on Windows, and I will
attempt Reaver as well, but sometimes Reaver tends to break on Windows and that
can be problematic. But, primarily, I will show you how to install aircrack-ng.
I'll show you how to use it there a bit, it's not that hard, there's a graphical
interface. Practically, you can just click through it, no problems. However, I restate
once again that you should have a Linux host machine which you can
use, to which you have access. Primarily because, a lot of these tools are a lot
faster on Linux machines. They work much better, they're faster, and quite frankly
they are easier to install. Plus, you get a higher degree of anonymity. Anyway, I
bid you all farewell, and I'll see you in the follow up tutorial.