Hello everybody and welcome to this tutorial. Today, I will show you another
brute-forcing method, primarily because the one that I showed you previously
does require you to gather some information prior to the attack
itself, primarily because you cannot perform a brute-force attack for every
possible combination out there for the WPA2 passkey. Why? Well, simply because you
have too many of them to try and you don't have enough processing power. The
best you could do is combine, let's say, the best home user could do is combine
pretty much all of the devices that they have in the house, for example your
smartphone, a tablet, a laptop computer, and you could combine the processing
power of all of those devices and basically distribute
the decryption cracking on to all of those devices. However, even then
you would still find it very difficult, and you
would still have way too many combinations to deal with. Again, you have
online services which you can rent a service to do this, but that costs money,
and yeah, it's not easy to come by these days. Anyway, do not despair, there's no
reason to panic, or anything of a kind. I know the previous method is somewhat
difficult and it does require you to actually go out there and gather some
information on your own, however this method that I am about to show you
doesn't require you to gather much information at all. Basically, what
somebody has come up with is this extremely stupid idea of pin
authentication for wireless networks, and there is a major flaw in it.
First of all, pin authentication only has numbers, which dramatically reduces the
amount of combinations possible. Namely, there are only 11 thousand combinations.
And considering that the reverb splits the length of the pin code in two,
once it finds the first half, finding the second half
gets a lot easier. So you don't even need to do, in all likelihood, you won't
actually need to do all 11,000 combinations at all. Now if you have
watched a previous tutorial you have seen that I can do maybe 1700, up to
perhaps 2k passwords a second, or 2K attempts per second. You
would think that oh, well, 11,000 possibilities is not much
at all, probably less than ten seconds
it would be over. However, that is not the case. Because the sort of attack we're
going to perform now is not, we're not gonna be doing it locally, we're not
gonna be doing it on the machine itself, it's not like we will have a file that
we will be able to use our processor to crack the encryption of that file, rather
instead we will be doing this remotely. So we will come into the range of a
wireless access point, and then we will attempt to attack that wireless access
point by passing it in, by trying to pass pin codes. And if any of them
work out, we're gonna get a response from the Reaver software, and it
will basically tell us what is the pass code, what is the WPA2 pre-shared key
for that particular access point. The downside of it all is that most of the
routers these days, even though the brilliant
router manufacturers have actually decided to put pin authentication to be
enabled by default on most of the routers out there, they did fortunately
put a preventive measure which is the router itself basically locks.
After you've passed the incorrect pin several times, it will lock, and it will
not allow any pin authentication, whatsoever, to go on for a certain period
of time. Usually maybe an hour, or something of a kind. You can
immediately deduce from this that this leaves possibilities for numerous dos
attacks, and all you would have to do is deauthenticate falsely a couple of times,
and authentication would be disabled for pretty much anybody there. And there
are a good amount of networks out there who rely primarily, and only, on pin
authentication. Why? I have no idea. So, without further ado, I have shown
in the previous tutorials, if you don't have Reaver installed how to
install it, but in this particular one I'm gonna just go ahead and use it. I
won't do any of the installation procedures because they're already done
in the previous tutorials. So just go ahead and type in reaver - - help, and you
will get a ton load of options. I mean maybe not a ton load, but certainly a
good amount of options. We will be using some of them, more likely than not, when
dealing with different kinds of routers. You will be required to use
some of these options use, some of these arguments, primarily because, yeah,
different routers have different configurations, and you want to be able
to hide your attacks, or to mask yourself somehow. Not because you're gonna get
detected, or something like that, because it's not likely that anybody can
actually track you down if you are attacking a wireless access point. If
provided, of course, you are not authenticated with it. If you are not
authenticated with the wireless access point, and if you're just attacking it, like
this wireless radio, or something of a kind,
basically there's almost no way to detect you. There is no way to find your
physical location, or to identify you. Sure, your MAC address will probably show
somewhere, but why do you care? All you need to do, as I stated in the previous
tutorial, is type macchanger and change it, no problems. If you don't know
how to change the MAC address, just go back a tutorial or two, and you will
you will find a tutorial called Mac, or Mac
changing, or something of a kind, but it will have the word Mac in it, Mac. And
there I have explained in great detail how you can actually hide your MAC
address without any sort of problems whatsoever. The primary
things that we're going to be using today, the primary arguments is -i
interface, and we will of course need the bssid
or Mac of the target access point. Before we do
that, as as before with aircrack-ng, we do need to do a couple of things. We need to
set the mode of our network card. So I'm not gonna go into great detail how to do
it here because I have explained it in the previous tutorials. Here I'm just
gonna do it, and hopefully you will be able to follow through. If not, just go
back a tutorial or two and see I have given detailed explanations there. So just
type in ifconfig, type in the name of your wireless access card,
and bring it down. Operation not permitted. I'm not
root, of course. Okay, I always love my passwords, primarily because of
their length. I sometimes tend to forget them which is infinitely
interesting. But there you go, I've managed to type it in. And it's actually
a good thing that I haven't managed to log in just yet as root, because I have
my router open here, which I've set up with the testing purposes of this
particular tutorial, and you can see the current pin. I mean these pins
are generated at random. So you can see the
length of the pin, and you can see the pin here, I can say generate new pin. Now
let's see what happens. The of wireless conifg...yeah, okay, so it will not take effect until
the device reboots. But here you can see the length of the pin, so it's like one,
two, three, four, five, six, seven, eight, only eight digits. And if I do it again, it's
gonna be eight again, so one, two, three, four, five, six, seven...
oops, sorry, not eight, that's gonna be nine. Is it nine? One, two, three, four, five, six,
seven, eight, sorry, no, it's gonna be eight again. It's always going to be eight. So,
no problems there. You know the length of the pin, which dramatically decreases the
amount of possible combinations as well. Depending on what sort of a router you
have, the pin can be at different places in the router. I can't explain it
for every individual router, but you can find this in the manual, or something
like that. Just open up a web interface for your router
by typing in the IP address. If you want to know what the IP address of your
router is on a Linux system, that is very easy to do. You can just type in route,
press enter, and this might take a bit of time. I'm not exactly sure why is it
taking so long? Oh, primarily because I'm not connected to the network.
Okay, so ifconfig is another way, but here it would say gateway, and where it says
gateway that would be the default address of your router. However, that is
the default gateway. That is not, that does not necessarily need to be the IP
address of the router you are connected to. So, type in ifconfig. This is a
foolproof way of getting the IP address of the router, much better than the
previous one, and I want to get the IP address of the router to which my
wireless access point is associated with. So, wlp2s0, press enter, and there we
go. I have an IP address here, okay, let's just just clear this up a bit. Clear, I
want to get a bit of a better picture, grep inet,
excellent! So I have inet here, and this is the internet address, but this is my
local address, it's not to be used for external purposes at all. It's
192.168.0.102, and the difference between your wired and
wireless connection is usually this in this digit here. For wired it's one,
and for wireless it's zero, and then you have a list of hosts which are here.
Anyway, my IP address, in my local area network,
that my wireless interface has, is 192.168.0.102.
The lowest possible, well the lowest possible IP address within this range, with only
the last octet changing, is dot zero. So, from 0 to 255, and the lowest one would
be zero. But, you cannot use zero because that is the network address. So what you
do is find the lowest one here, which is zero, plus one, and that's going to give
you the IP address of your router. Very simple. And you can see that is exactly
what I've typed in here, it's 192.168.0.1. So
just find the lowest one, which is zero of course, and then add one which is
going to be the IP address of the router. Anyway, now that is out of the way, I've
showed you how you can check it out here, the pin code, but this interface will
differ from one router to another. Please keep that in mind. So this is not a
general explanation for all the routers out there, but it's fairly simple to find
the pin code on your own home router without any bigger difficulties. Just go
ahead and log into it via web interface, as I said. Just type in the address here,
you will be prompted for login credentials. Usually it's admin admin if
you haven't changed anything. If it's not, go ahead and contact your ISP
provider and ask them to provide the username and password for you, assuming
that it's not locked. If it's locked you gotta break it, but I will show
you how you can break routers in the tutorials to come. In any case, let's just
go back to the subject here. Now that I am root let's take down my wireless
interface, ifconfig wlp2s0 down, and now I need iwconfig wlp2s0
mode monitor, excellent! So ifconfig wlp2s0 up, there we go. You can
make a neat short script, the bash script, which has these commands
listed, and that could be a fantastic way to do this. You would
effectively save yourselves a lot of time there. Go ahead and clear the screen,
and there you see it says connection to something it has been
deactivated because my wireless interface has now been brought down, and
up, and, on top of that, it's in monitor mode. Now, there is a
program which I've used in the previous tutorial which is a part of the aircrack
package, it's called airmon-ng, and I want to check wlp2s0
for any possible problems. I have explained this in the previous tutorial
why am I doing this and how is this done. So, airmon-ng check wlp2s0,
of course your wireless interface name will probably not be the same if you're
not using the same OS as I am, but just substitute it with whatever it is, and no
problems there. In the previous tutorials I've also stated that. Here we have a
list of problems, as I like to call them. The primary problem
is the network manager because it's generating a lot of other things up
here. So let's just go ahead and kill them...13133, I gotta kill them one by
one because they are spawning one another, and that can be problematic. So,
kill 2498. Even if you are root they can give you a ton load of
problems, primarily because as I said they are spawning one another, and that
can be just such an unbelievable drag. Excellent! Now I have, let me just clear the
screen again, now I have ran the check once again to
make sure that I don't have any problems. If you're afraid that you will kill
something that you don't want to kill in terms of networking, don't worry, anything
from that list will auto-generate pretty much the moment you reinitiate your
network manager. You can just type in service NetworkManager restart, and
all those processes will be generated. If you don't want to do this you can just
reboot the machine, and you will have pretty much the same effect, no problems.
So just go ahead and clear the screen. Before I actually start using
Reaver, which we have installed previously, I do need to check for
wireless connections within my area, and I do need to check whether they are
vulnerable. A very important thing to do. And that I will do in the follow-up
tutorial. We will use the wash command in order
to find these at wireless access points. Until then, I bid you farewell, and I hope
to see you there.