Kali/Wireless Reboot - Revision history

Admin: /* Alternatives to Cracking WPA */

2016-08-29T11:54:57Z

Alternatives to Cracking WPA

← Older revision		Revision as of 11:54, 29 August 2016
Line 164:		Line 164:
	So you don't wanna rent out a GPU box, spend a week trimming your fingernails, and spending the entire time hoping that somehow, magically, you'll nail the one-in-a-bazillion-million chance you'll get it. That's understandable. Let's talk about alternative options. These are going to depend primarily on your target network and your scenario. For example, what kind of physical access to the primary wireless networking area do you have? What kind of antenna(s) are you using?		So you don't wanna rent out a GPU box, spend a week trimming your fingernails, and spending the entire time hoping that somehow, magically, you'll nail the one-in-a-bazillion-million chance you'll get it. That's understandable. Let's talk about alternative options. These are going to depend primarily on your target network and your scenario. For example, what kind of physical access to the primary wireless networking area do you have? What kind of antenna(s) are you using?

	===~~Client Attacks~~===		===Rogue AP: WPA Pickpocket===

	~~Client attacks are essentially about tricking the client into connecting to you~~, ~~and not~~ the ~~access point. These take advantage~~ of ~~the way wireless networks work to attack clients in various ways~~.		A rogue access point (AP) is an AP that is installed somewhere where it should not be, for the purpose of stealing information.

	~~===Rogue~~ AP ~~Attack===~~		In the WPA pickpocket attack, a rogue AP is set up with an SSID to match the SSID of a "remembered" network on a device nearby. The rogue AP advertises that SSID, and the target device attempts to connect to it. When the target attempts to authenticate with the fake access point, it will fail (the password will also not be correct). The client half of the handshake process is captured by the rogue AP. This is called "half handshake" mode.

	~~A rogue AP~~ is ~~an access point that is installed somewhere where it should not be.~~		This is how the conversation goes:

	~~====Rogue AP Password Pickpocket:====~~

	~~Rogue APs can be used to steal the passphrase of your remembered networks - a la Hak5 Pineapple - in which case,~~ the ~~conversation ends once the connection is initiated and the client sends over the (encrypted) Wifi password. The~~ conversation goes ~~something like this:~~

	~~Sheep Client Device~~: ~~Hello, attention everyone, I'm looking for "Linksys Home". Is anyone here "Linksys Home"?~~

	~~(crickets)~~

	Sheep Client Device: Hello, attention everyone, I'm looking for "Linksys Home". Is anyone here "Linksys Home"?		Sheep Client Device: Hello, attention everyone, I'm looking for "Linksys Home". Is anyone here "Linksys Home"?
Line 188:		Line 180:
	Evil Twin AP: (Puts on disguise) Well hello, yes, I am "Linksys Home." Over here. Yes, hello.		Evil Twin AP: (Puts on disguise) Well hello, yes, I am "Linksys Home." Over here. Yes, hello.

	Sheep Client Device: Oh, wow! Boy am I glad I found you! I'm at the airport~~. You seem totally legit~~. Here's my wifi password. Can I check my email now?		Sheep Client Device: Oh, wow! Boy am I glad I found you! Even though I'm at the airport and you couldn't possibly be my home network, I'll trust you anyway. Here's my wifi password. Can I check my email now?

	Evil Twin AP: Thanks for the password. Let me validate it. I'll be right back... (Disappears)		Evil Twin AP: Thanks for the password. Let me validate it. I'll be right back... (Disappears)
Line 239:		Line 231:
	* Evil Twin APs (wireless mitm)		* Evil Twin APs (wireless mitm)
	* Fake APs		* Fake APs

	~~===WPA2 Half Handshake===~~

	~~Cross between the above methods. This is essentially the Rogue AP Pickpocket attack.~~

	Another alternative to the classical wifi cracking process of obtaining a handshake is to obtain half a handshake. This method examines incoming packets from phones that are searching for remembered networks, and sets up an access point with the name of that network. When the client attempts to authenticate with the fake access point, it will fail (the password will also not be correct), but it's okay - half of the WPA handshake process is still recovered.

	==Other Stuff==		==Other Stuff==

Admin: /* WPA2 Half Handshake */

2016-08-29T11:39:36Z

WPA2 Half Handshake

← Older revision		Revision as of 11:39, 29 August 2016
Line 242:		Line 242:
	===WPA2 Half Handshake===		===WPA2 Half Handshake===

	~~There~~ is ~~another~~ alternative to the process of obtaining a handshake~~, and that~~ is to obtain half a handshake. This method examines incoming packets from phones that are searching for remembered networks, and sets up an access point with the name of that network. When the client attempts to authenticate with the fake access point, it will fail (the password will also not be correct), but it's okay - half of the WPA handshake process is still recovered.		Cross between the above methods. This is essentially the Rogue AP Pickpocket attack.

			Another alternative to the classical wifi cracking process of obtaining a handshake is to obtain half a handshake. This method examines incoming packets from phones that are searching for remembered networks, and sets up an access point with the name of that network. When the client attempts to authenticate with the fake access point, it will fail (the password will also not be correct), but it's okay - half of the WPA handshake process is still recovered.

	==Other Stuff==		==Other Stuff==

Admin: /* WPA2 Half Handshake */

2016-08-29T11:37:19Z

WPA2 Half Handshake

← Older revision		Revision as of 11:37, 29 August 2016
Line 242:		Line 242:
	===WPA2 Half Handshake===		===WPA2 Half Handshake===

	There is another alternative to the process of obtaining a handshake, and that is to obtain half a handshake. This method examines incoming packets from phones that are searching for remembered networks, and sets up an access point with the name of that network. When the client attempts to authenticate with the fake access point, it will fail (the password will also not be correct), but it's okay - half of the ~~handshakes~~ is still ~~received~~.		There is another alternative to the process of obtaining a handshake, and that is to obtain half a handshake. This method examines incoming packets from phones that are searching for remembered networks, and sets up an access point with the name of that network. When the client attempts to authenticate with the fake access point, it will fail (the password will also not be correct), but it's okay - half of the WPA handshake process is still recovered.

	==Other Stuff==		==Other Stuff==

Admin: /* Making Fake APs */

2016-08-29T11:37:05Z

Making Fake APs

← Older revision		Revision as of 11:37, 29 August 2016
Line 217:		Line 217:

	===Making Fake APs===		===Making Fake APs===

			====hostapd====

	In general, you can make fake access points using the hostapd tool. This software turns wifi cards into access points. There are plenty of notes on the wiki about how to use hostapd. Here are a few links:		In general, you can make fake access points using the hostapd tool. This software turns wifi cards into access points. There are plenty of notes on the wiki about how to use hostapd. Here are a few links:
Line 237:		Line 239:
	* Evil Twin APs (wireless mitm)		* Evil Twin APs (wireless mitm)
	* Fake APs		* Fake APs

			===WPA2 Half Handshake===

			There is another alternative to the process of obtaining a handshake, and that is to obtain half a handshake. This method examines incoming packets from phones that are searching for remembered networks, and sets up an access point with the name of that network. When the client attempts to authenticate with the fake access point, it will fail (the password will also not be correct), but it's okay - half of the handshakes is still received.

	==Other Stuff==		==Other Stuff==

Admin: /* What's Next */

2016-08-19T07:12:49Z

What's Next

← Older revision		Revision as of 07:12, 19 August 2016
Line 254:		Line 254:
	}}		}}

	The point of wireless hacking is to gain control of the communication channel - once you gain access, you pivot to a different toolset, and decide what to do with the channel. Cut it off? Modify it in transit? Record it? Search for things to flag?		The point of wireless hacking is to gain control of the communication channel - once you gain access, you pivot to a different toolset, and decide what to do with the channel. Cut it off? Modify it in transit? Record it? Search for things to flag? It all depends on what you want to do and what the target system is. This kind of decision-tree branching, with infinite possibilities, is what makes modern hacking so hilariously and frighteningly powerful.

	Packet injection: http://airpwn.sourceforge.net/Airpwn.html		Packet injection: http://airpwn.sourceforge.net/Airpwn.html

			Let's work a little more on the workflow, and address those "now what" questions: [[Kali/Workflow]]

	=Flags=		=Flags=

Admin: /* Making Fake APs */

2016-08-18T20:57:53Z

Making Fake APs

← Older revision		Revision as of 20:57, 18 August 2016
Line 237:		Line 237:
	* Evil Twin APs (wireless mitm)		* Evil Twin APs (wireless mitm)
	* Fake APs		* Fake APs

			==Other Stuff==

			airbase-ng: http://aircrack-ng.org/doku.php?id=airbase-ng
			* complicated tool, but basically, focuses on client attacks, so acting as an AP or ad-hoc AP

			airpwn: http://airpwn.sourceforge.net/Airpwn.html
			* Live traffic injection for 802.11 packets

	=What's Next=		=What's Next=

Admin: /* What's Next */

2016-08-18T20:56:25Z

What's Next

← Older revision		Revision as of 20:56, 18 August 2016
Line 247:		Line 247:

	The point of wireless hacking is to gain control of the communication channel - once you gain access, you pivot to a different toolset, and decide what to do with the channel. Cut it off? Modify it in transit? Record it? Search for things to flag?		The point of wireless hacking is to gain control of the communication channel - once you gain access, you pivot to a different toolset, and decide what to do with the channel. Cut it off? Modify it in transit? Record it? Search for things to flag?

			Packet injection: http://airpwn.sourceforge.net/Airpwn.html

	=Flags=		=Flags=

Admin: /* Making Fake APs */

2016-08-18T20:31:58Z

Making Fake APs

← Older revision		Revision as of 20:31, 18 August 2016
Line 231:		Line 231:

	Github repo for script to create fakeap in 1 command: https://github.com/DanMcInerney/fakeAP		Github repo for script to create fakeap in 1 command: https://github.com/DanMcInerney/fakeAP

			Need to clean up some of these pages and reorganize the content:
			* Rogue APs (umbrella term)
			* Rogue Pickpocket APs
			* Evil Twin APs (wireless mitm)
			* Fake APs

	=What's Next=		=What's Next=

Admin: /* Making Fake APs */

2016-08-18T20:30:57Z

Making Fake APs

← Older revision		Revision as of 20:30, 18 August 2016
Line 229:		Line 229:

	This process is also covered here: https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/		This process is also covered here: https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/

			Github repo for script to create fakeap in 1 command: https://github.com/DanMcInerney/fakeAP

	=What's Next=		=What's Next=

Admin: /* Making Fake APs */

2016-08-18T20:30:33Z

Making Fake APs

← Older revision		Revision as of 20:30, 18 August 2016
Line 227:		Line 227:

	[[Kali_2016-03-13]] - tips and tricks on generating wireless traffic on a network.		[[Kali_2016-03-13]] - tips and tricks on generating wireless traffic on a network.

			This process is also covered here: https://www.offensive-security.com/kali-linux/kali-linux-evil-wireless-access-point/

	=What's Next=		=What's Next=