Hello everybody and welcome to this tutorial. I will just continue from where
I left off in the previous one. So I have a live capture here in progress, I'm just
gonna go ahead and cancel it, and now I will take from it what I need. So, the
next command that we're gonna use, again, is airodump-ng, but we will use it in
combination with a few more arguments in order to conduct a more precise scan, in
order to conduct a more precise capture, so that we may achieve that four-way
handshake which we need so desperately in order to do this. So go ahead and type
in airodump, but if you don't know the exact command you don't need to memorize
it. Just do what I did, type in air, and then
press tab twice fast. If it doesn't work twice press it
how ever many times you need it, just press it really fast, and then the
terminal will actually tell you what your possibilities are. What we need is
airodump, and this is the command that we need. So just go ahead and type in o,
tab it again, it will give you fewer options, dump-ng, that's it. One of the
first things that we're gonna need to do is specify the channel on
which my wireless is functioning at the moment. I've configured for this
particular exercise is channel 6. So channel 6, and what is the bssid? This is
the bssid. Don't try to retype it, or something like that,
copy/paste it just to be sure. Because if you miss a single a single character
here you're gonna be in a world of problems, primarily because you will
achieve nothing, and there will be no capture, or anything of a kind. Now we
need a file to write to. I will name mine SCAN_test because
I usually named them scans. That's why I want to distinguish
this one as test, just in case I have some of the files here written as well. And then the
final thing that I'm going to need is this bssid, I haven't actually typed it
in here, bssid. That was a bit neglected, and
it shouldn't go here, sorry. So just go ahead and copy it, and we'll just reformat this a
little bit. I'm pretty sure it would work like this as well, but we always want to
make our code nice and clean so that it can be seen and understood. This is
primarily done for troubleshooting purposes, because when you have commands,
and text, and code spread around, you can't really figure out what is where.
Maybe you can in that moment, but try doing it the next day and you will
absolutely lose yourselves. I do, anyway, perhaps it doesn't work the
same for everyone. Go ahead and press Enter.
Okay, what does it say? No interface specified. So every time you do this you
actually do need to specify an interface. Mine is wlp2s0, that is my wireless
interface that is currently in monitor mode, so press ENTER, and there we go. We
have a scan in progress, and I have another device that is hooked up, that's
this device, it's bssid, and station. Station is a device that is
connected to this access point. You will not be able to perform this method if
you do not have any stations that are connected to a certain access point, or
are associated with it. This is because you have nothing to deauthenticate, there
is nothing conducting the authentication process which you can capture. We will at
the moment be deauthenticating this device, and this is also a method that
you can use in order to perform a DoS attack on wireless networks. It is guaranteed
to work. Actually, I'm really surprised that the wireless networks
are so vulnerable to this. Pretty much any wireless in the city, or any
wireless in a building, or something of a kind, will be vulnerable to this, and you
will be able to deauthenticate pretty much everybody. Even in a university, or
something of a kind. It is susceptible to misuse, but I would like to ask you, since
I am doing this for educational purposes, not to do that, primarily because, as I've
stated before, the beginning of this tutorial you can achieve your
purpose, and you can make a profit, without doing anything against the law.
Anyway, that being said, we need to use aireplay-ng, and this is used
for deauthentication purposes. So we'll just go ahead and type it in, air, once
again I just tabify it because there's no point to risk anything, replay-ng.
What I want to do is pass an argument of -0, and then I'm gonna give it the
0 again, I will explain in a moment what these are, - a, and the MAC address
of the access point. We don't need the bssid flag there. Anyway, these two
arguments state the, basically this argument states the amount of the
deauthentication transmissions that you wish to send. If you put a 0 in
it sends it into an infinite loop. Basically, you will permanently be the
deauthenticating pretty much every device on this particular MAC address, that is
all the devices that are trying to associate themselves with a wireless
access point on this MAC address. You can put, for example, if you want to
temporarily disrupt connections you can type in here 10, or 9, or
something like that. There are even options to deauthenticate particular
clients. But for the time being, I'm just gonna send a general deauthentication
request transmission, actually this will deauthenticated everybody on this
particular wireless access point. Since it is my wireless access
point I don't really care. I do have only one device associated with it, and that
device will shortly be disconnected. Now if you wish to verify this, you can
connect your cell phones, or smartphones, and you can connect them to your Wi-Fi
access points within your houses, or apartments, or whatever, and then you can
try performing a DoS attack on yourself to see how it works. It will be a
fantastic exercise. If you have any troubles, feel free to ask me in the
question section, but it should work. The procedure is exactly the same as what I'm
doing now. You will then notice that the Wi-Fi connection on your phone is
breaking. So when that starts happening, when did the deauthentication request
starts being sent, try accessing some sort of a website through your
cell phone. Whichever one you have, I don't know if it's Android, or iPhone, or
something, just try doing it. You will see that you
can't, because there is something obstructing your connection, you are no
longer associated with that access point. That is quite problematic. I would
recommend doing that as that's a fantastic exercise. You cannot cause any
damage, as soon as the deauthentication requests stop your connection will be
restored. So we'll just go ahead and, I cancelled press enter because I need to
actually type in the interface. This is one of the downsides of aircrack, I would
definitely suggest that they change this so you don't have to type in the
interface every single time, but that being said, excellent! I am sending the
deauthentication to broadcast, bssid, there you go, it's 90, and excellent! Yep, I
have definitely lost my wireless on all of my devices, pretty much, or on the
device that I have connected to this wireless access station. And you see,
you can just leave it running like this, you can. Just leave it running
for a while just to make sure that you have deauthenticated the device, because
you cannot see the device that you are deauthenticating. You don't know if
you've deauthenticated it, so just let it run for a while, no problems
there, you won't lose anything. At a certain point of time, after a couple of
minutes, probably less, you can go ahead and cancel it. Due to the proximity I can
go ahead and cancel it now, and my device will try to reconnect in an automatic
fashion. Once it does that I will capture that
authentication, and it should work just fine. In a moment, we should get a
four-way handshake in the upper right corner, there we go.
It says WPA handshake for this MAC address. At this point of time, you can
just go ahead and stop the capture process as there is really no longer
a point to do it. We have gotten what we needed, it's all here. In the
next tutorial we will take apart the file which we have captured, and see what
we can do with it, how we can actually crack it. That is the difficult part
of it all. Capturing traffic is not a problem, finding the
wireless access point is not a problem, the problem is cracking
the encryption itself. Now, just keep in mind what I've said in the beginning, I
want to mention this one more time before I wrap this tutorial up, you must
absolutely have at least one device that is associated with this the BSSID. Of
course, if there are more devices the better for you, but you must at least
have one. And if there are lots of devices you might consider a different
denial of service attack. To deauthenticate them you shouldn't probably deauthenticate
them all. Select a few and leave a few running. So, I don't know, if you
have 10 or 20 of them, usually there are a lot of Wi-Fi access points, you can
select five of them. So if just five of them don't work they'll usually
look to the person next to them, or something like that, and they'll see that
it's working for them, and that it's not working on their devices, but it is
working on the devices of the person next door, or the person sitting next to
them. So, the general conclusion that pretty much everybody draws from that is, oh,
it has to have something to do with my device, probably.
It's not working, or something of a kind. I will go over this in great
detail when I go into a denial of service, but for the time being just know
that that is an option. In any case, I bid you farewell, and I sincerely hope to see
you in the follow-up tutorial where we will actually crack the
code.