Wi-Fi Pentesting with Aircrack-ng

Wi-Fi Pentesting with Aircrack-ng
Wi-Fi Pentesting
with Aircrack-ng
About Me
• Hi there!
• I'm Keya Lea Horiuchi
– Engineer at AppliedTrust
– I like to play with stuff.
– I like the mountains, desert and the beach.
• What we'll cover – Demos!
• Using basic tools in Kali, introduction
– Learning by doing – Wi-Fi basics
– Getting things up and running
• Challenges
• We're at a conference, others may be using
the conference Wi-Fi. Respect!
What you need
• Kali Linux
• USB Wi-Fi card capable of
– Alfa Networks 802.11 b/g
Wireless USB Adapter
• AWUS036H
• Set up to allow USB device
access from the client to
guest VirtualBox
• Challenges
• How many Wi-Fi SSIDs?
• Name the SSIDs, use the MAC to ID the
manufacturer and the type of encryption
– They may not all be broadcasting
– Identify open ports and any web interfaces
• Why is this handy?
• SSIDs you can play on
• Unfortunately not connected to Internet
– Test_lab
– wep-crack
– open_jk
• See what ports/interfaces are reachable
• Modify packets, send deauths only to these
– What could be keeping you off?
• Crack WEP
• Aircrack-ng
Let's take a moment to think about Wi-Fi
Wireless data transfer
A radio frequency traveling through time and
Through the air!
• Three types of WLAN frames
• Management
– Maintains communication between APs and
clients, used to join and leave APs (Auth, deauth,
association, beacons)
• Control
– Property exchange of data (RTS, CTS, ACK)
• Data
– Data from the higher protocols
• Use your better judgement.
• Unauthorized access to data is against the law.
• Don't go to the dark side!
– Set up a lab environment
– Ask your friends!
Let's capture some packets!
• Look at the Wi-Fi environment
– Gather evidence / information
– Many different tools
• Basic config tools
• Airmon-ng
• wireshark
• Target a specific device and crack some stuff!
– Airmon-ng, aireplay-ng and aircrack-ng
• What interfaces are available to Kali?
– # ifconfig and iwconfig
• Attach the USB Wi-Fi card.
• Check out the environment.
• # iwlist wlan0 scanning
• Important note
– The headers in the frames are in plain text and not
encrypted. Anyone sniffing can see these headers.
– Any header can be spoofed and transmitted.
– Do not have to be connected or authenticated to
do this.
• Can do one of two demos, or just sniff traffic
with different tools.
• Have an SSID with not broadcasting, but have
a client connecting.
• SSID that is open and has a name, but using
mac filtering. A client needs to connect.
• Use its mac address and connect.
Cracking WEP
• Put the wlan interface into monitor mode with
– # airmon-ng start wlan0
– # airodump-ng wlan0mon
Cracking WEP
• After determining the target, focus listening
on that one device.
• After identifying the station
• # airodump-ng - - bssid <00:32:d8...> - channel 6 - - write <WEPCracking> wlan0mon
• Use airodump-ng to write all the packets to a
traffic dump file
• Need a large number of data packets
encrypted with the same key.
– In order to make this happen, will used aireplayng to inject packets into network to force the
WAP into interacting with us.
– Do not yet know the WEP key, but can ID ARP
packets by the size of the fixed header.
• Packet injection – open another terminal
• # aireplay-ng -3 -b <BSSID> -h <clientspoofing> wlan0mon
– 3 specifies ARP packets
-3, --arpreplay
The classic ARP request replay attack is the most
effective way to generate new initialization vectors (IVs),
and works very reliably. The program listens for an ARP
packet then retransmits it back to the access point. This, in
turn, causes the access point to repeat the ARP packet
with a new IV. The program retransmits the same ARP
packet over and over. However, each ARP packet repeated
by the access point has a new IVs. It is all these new IVs
which allow you to determine the WEP key.
• In order to crack the key, aircrack looks at the
collected data packets in the file
• # aircrack-ng <WEPCrack*.cap>
– Aircrack is a 802.11 WEP / WPA-PSK key cracker
• The amount of time it takes to crack a key
depends on the amount of traffic in the
network because a large sample needs to be
collected to compare and identify a collision.
• The weakness in WEP stems from needing to
reuse initialization vectors (IVs). Once they are
reused, which is pretty often, the key can be
• Clean up
• Take it out of monitor mode
– # airmon-ng stop <wlan0mon>
– # service network-manager start
• Hopefully the demo worked and you don't see
this slide.
Thanks! That was good fun!
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF