Wi-Fi Pentesting with Aircrack-ng About Me • Hi there! • I'm Keya Lea Horiuchi – Engineer at AppliedTrust – I like to play with stuff. – I like the mountains, desert and the beach. • What we'll cover – Demos! • Using basic tools in Kali, introduction – Learning by doing – Wi-Fi basics – Getting things up and running • Challenges • We're at a conference, others may be using the conference Wi-Fi. Respect! What you need • Kali Linux • USB Wi-Fi card capable of injection – Alfa Networks 802.11 b/g Wireless USB Adapter • AWUS036H • Set up to allow USB device access from the client to guest VirtualBox • Challenges • How many Wi-Fi SSIDs? • Name the SSIDs, use the MAC to ID the manufacturer and the type of encryption – They may not all be broadcasting – Identify open ports and any web interfaces • Why is this handy? • SSIDs you can play on • Unfortunately not connected to Internet – Test_lab – wep-crack – open_jk • See what ports/interfaces are reachable • Modify packets, send deauths only to these – What could be keeping you off? • Crack WEP • Aircrack-ng Let's take a moment to think about Wi-Fi Wireless data transfer A radio frequency traveling through time and space Through the air! • Three types of WLAN frames • Management – Maintains communication between APs and clients, used to join and leave APs (Auth, deauth, association, beacons) • Control – Property exchange of data (RTS, CTS, ACK) • Data – Data from the higher protocols Disclaimer • Use your better judgement. • Unauthorized access to data is against the law. • Don't go to the dark side! – Set up a lab environment – Ask your friends! Let's capture some packets! • Look at the Wi-Fi environment – Gather evidence / information – Many different tools • Basic config tools • Airmon-ng • wireshark • Target a specific device and crack some stuff! – Airmon-ng, aireplay-ng and aircrack-ng • What interfaces are available to Kali? – # ifconfig and iwconfig • Attach the USB Wi-Fi card. • Check out the environment. • # iwlist wlan0 scanning Demo • Important note – The headers in the frames are in plain text and not encrypted. Anyone sniffing can see these headers. – Any header can be spoofed and transmitted. – Do not have to be connected or authenticated to do this. • Can do one of two demos, or just sniff traffic with different tools. • Have an SSID with not broadcasting, but have a client connecting. • SSID that is open and has a name, but using mac filtering. A client needs to connect. • Use its mac address and connect. Cracking WEP • Put the wlan interface into monitor mode with – # airmon-ng start wlan0 – # airodump-ng wlan0mon Demo Cracking WEP • After determining the target, focus listening on that one device. • • • • • After identifying the station • # airodump-ng - - bssid <00:32:d8...> - channel 6 - - write <WEPCracking> wlan0mon • Use airodump-ng to write all the packets to a traffic dump file • Need a large number of data packets encrypted with the same key. – In order to make this happen, will used aireplayng to inject packets into network to force the WAP into interacting with us. – Do not yet know the WEP key, but can ID ARP packets by the size of the fixed header. • Packet injection – open another terminal • # aireplay-ng -3 -b <BSSID> -h <clientspoofing> wlan0mon – 3 specifies ARP packets -3, --arpreplay The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key. • In order to crack the key, aircrack looks at the collected data packets in the file • # aircrack-ng <WEPCrack*.cap> – Aircrack is a 802.11 WEP / WPA-PSK key cracker • The amount of time it takes to crack a key depends on the amount of traffic in the network because a large sample needs to be collected to compare and identify a collision. • The weakness in WEP stems from needing to reuse initialization vectors (IVs). Once they are reused, which is pretty often, the key can be cracked. • Clean up • Take it out of monitor mode – # airmon-ng stop <wlan0mon> – # service network-manager start • Hopefully the demo worked and you don't see this slide. Thanks! That was good fun! Questions?
* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project