Hello everybody and welcome to this follow-up tutorial. Now, I have done the
testing part before actually beginning this tutorial, and I have realized that
when I type in the command wash and when I past interface wlp2s0, which is
my wireless interface, okay, it starts scanning now, and it seems to be working
without any bigger problems here, however, let me just go ahead and cancel it, it
tends to issue out errors, and it doesn't say much. It just
says that it's unable to open the interface that you have specified. And
after I've googled it up a little bit, I have found the problem is a missing file.
In order to fix that you just need to type in mkdir, one of the basic
Linux commands to make a directory, type in /etc/reaver, press ENTER, and there
you go. Now this command will create this file in this folder. It says cannot
create directory because it already exists, I have created it prior to this,
but if it gives you any trouble whatsoever, try doing this. Try creating
this file. Reaver can be problematic from time to time, and there are forums
dedicated to these things which you can of course use. Just type in Reaver help, or
whatever, on the net, and you will be given like a hundred forums where you can go
and turn to for help. But, you can always ask me as well to help you out, no problems,
I'll be more than happy to do it. Anyway, just go ahead, that's a small
fix that you can do if you encounter any problems, but if you don't,
well, then good for you, and good for us all. Type in, just go ahead and back, and
let's continue, and let's start the scanning process itself to see what we
need to, what we can actually attack. What services, what wireless access
points here are vulnerable, and what we can actually do. If you take a look
a bit of a closer, here you will see the bssid which is basically
the MAC address of the access point. Here you can see the channel RSSI, that's not
important for us. WPS version,
that can be important, and WPS locked. This is what we are looking for. This is
the most important thing here that we need to pay attention to. If it says no,
good for you, you can actually do it. If it says yes, it
means that the WPS has been disabled on that particular wireless access point,
and this attack is rendered pointless. You can't do anything with it,
it won't feel any results. In fact, you won't be able to try even a
single pin. So as long as the answer is no the wireless access point is
vulnerable, and you can perform this sort of attack, no problems.
I mean, yeah, depending on the router of course, and depending how
well it was configured. But out of the box usually it's not that good. Anyway,
this is the wireless access point which we will be attacking. This is mine, it's
called something, which I have set up for our tutorial today. I think that this
test router was like 20 bucks, something like that, they're pretty cheap these
days. It's not the best one, definitely, but it will serve a purpose for our
learning sessions, today. Just go ahead and cancel this. There is one
more thing which we need to be certain of. Here we can see which access
points are vulnerable, but, other than that, we need to verify the signal
strength. So, airodump-ng wlp2s0, go ahead and start, excellent!
So, I have used this command in the previous tutorials, and here you can see
the power output. So as long as it's, well -80 is not a good thing. It's
definitely not a good thing for Reaver. You want to have, let me just stop it
here because I have the network that I want. You see, something is - 43, and then
you I have this one which is - 53, these are all good ranges. They're
relatively good, they have relatively good signal strength, and somehow
even though my router is actually right next to my computer, it's
minus 43, which is not as good. And I have this minus 80 who's probably my
neighbor, or something like that. Anyway, I'm not gonna touch that, that's gonna
mess with them. I'm just gonna go ahead and focus on this one, which is mine. But
it does need to be at least minus 60, at least below minus 60. So,
minus 55, minus 40, something of a kind. You will be able to actually perform it
in minus 75 and minus 80, I have heard of these cases, but it is not easy.
I get breaks with the connection, I get problems, errors, etc, not the best of
things to do. If you want to crack it, you want to get close to it, or something
like that, you don't need to stay there for the whole duration of the attack.
Primarily because, usually these sort of attacks you can start and then continue
at a later time from where you left off, no problem.
Reaver saves this sort of information for you, and you are able to reuse it,
or to restart it from where you left it off previously.
Now, I'm gonna employ Reaver. So type in reaver -a for our MAC address, so
what we need, form something, there we go.
Second one, let's go ahead and paste it, and type in -i wlp2s0.
Sorry, my bad, it's not -a. I
want to pass the MAC address, and the interface should go first. Let's see if
it's gonna work like this. Yep, it's gonna work. You don't need to
use this specific order, restore from the previous session, no, but I do want to do
this double verbose output here. Always a good idea to do. Anyway, press Enter, no, I
do not wish to restore it, just go ahead and continue and see what
happens. OK, so, you see what it's doing here, it says switching to channel 1,
channel 2, channel 3, we don't want to do that. Let's just go ahead and cancel it. I
want to save it a lot of time, and let's see which channel
am I using. I am using channel 6 for something, that's just the frequency on
which my wireless access point functions. So let's just go ahead and type in
-c 6. Will it work like this, switching to channel 6 immediately? Yes, it will.
No, I do not wish to continue from before, excellent! So it says here trying this
pin, and it just keeps on going. It's going to tell me at a certain point of
time what percentage of the task is done, but usually you can do this within a day.
I mean, provided of course that you don't get locked out, or something like that,
and the amount of tries you can actually do before getting
completely locked out. So you see here is one pin, and where's the other one, here's
yet another pin, and here's a third pin, and so on and so forth. Of
course, we have all seen the pin that I have used at the very beginning, that the
router has generated automatically. I have not saved that I have actually just
used the one that's already there, but that's completely irrelevant because
pins vary from router to router, and this is gonna take a while. You see it
says 0.05 percent complete, and it gives you when it was done, and if you remember
at the beginning it actually asked me, do I wish to continue from the last time I
started doing this? That's the beauty of it. You can go for it, start cracking it
somewhere, and let's say you're passing by a certain place. You can sit at a
bench for an hour, or something like that, have this run for you,
leave, tomorrow, again, pass by the same bench,
leave it for an hour, half an hour, or something like that, and there you go.
Eventually, you will be able to crack it, no problems. Of course, if somebody's
reviewing the router logs, which is rarely done for routers where pin
authentication is actually enabled, then they will see that somebody's trying to
do something, and they might decide to actually close down pin authentication
altogether. However, other than that, there isn't really much
they can do. Even if they set specific MAC addresses of the computers within
the network, you will still be able to see those MAC addresses, and as I showed
in the previous tutorial, you will be prompted to, you will be able to
change your MAC address to match the corresponding MAC addresses which are
allowed to pass. And there we go, after only 0.05%
complete, it says warning detected ap rate limiting, waiting sixty
seconds before re-checking, which means that the router is now in the lockdown,
and you can't actually do anything. The good thing about the, not a bad
thing to do would be to actually see the router, see the routers MAC address and
then try to figure out which router it is, and then search on the net to see
what the AP rate limiting is, and then you can time your Reaver pin
attempts in between so that the router doesn't get locked. I will continue with
this in the follow-up tutorial, but for the time being I am locked out, and in
the next tutorial we will be doing some workarounds around this lockout and see
how we can actually bypass it. Because this is one of the most common problems
that people encounter. It's not the installation because it's relatively
simple. The usage is also relatively simple. The setup is not a big deal,
or a big problem, there's plenty of help on the net. But, here it says detected ap
rate limiting, waiting 60 seconds before re-checking. That is one of the most hated
lines as far as the Reaver world is concerned. In any case, I bid you farewell,
and I really hope to see you in the follow up tutorial where we will attempt to
bypass this problem.