Hello everybody and welcome to this tutorial.
I will just continue from where I left off in the previous one.
So I have a live capture here in progress.
I'm just gonna go ahead and cancel it
and now I will take from it what I need.
So the next command that we're gonna use again is "airodump-ng'
but we will use it in combination with a few more arguments
in order to conduct a more precise capture
so that we may achieve that four-way handshake
which we need so desperately in order to do this.
So go ahead and type in here "airodump"
but if you don't know the exact command
you don't need to memorize it.
Just do what I did
Type in "air", and then press tab twice fast.
If it doesn't work twice, press it thrice
how ever many times you need it.
Just press it really fast
and then the terminal will actually tell you what you were possibilities are.
What we need is airodump
and this is the command that we need.
So just go ahead and type in "airo" and tab it again.
It will give you fewer options
"airodump-ng"
That's it
One of the first things that we're going to do is specify a channel.
The channel on which my wireless is functioning at the moment.
I have configured for this particular exercise is channel 6.
So channel 6
and what is the BSSID?
This is the BSSID
Don't try to retype it or something like that
copy/paste it, just to be sure
because if you missed a single character here
you're gonna be in the world of problems
primarily because you will achieve nothing.
and there will be no capture or anything of the kind.
Now we need a file to write to
I will name mine "SCAN_test"
because I'm pretty sure that I...
I usually name them "SCAN"
That's why I want to distinguish one as "test" just in case
just in case I have some files here as well
and then the final thing that I'm going to need is this BSSID
I haven't actually typed it in here.
That was a bit neglectful
You shouldn't go here. Sorry
So just go ahead and copy it.
Let's just reformat this a little bit.
I'm pretty sure it works like this as well
but we always want to make our code neat and clean
So that it can be seen and understood this is primarily
This is primarily done for troubleshooting purposes
because when you have commands and text
and codes spread around
you can't really figure out what is where.
Maybe you can at that moment, but try doing it the next day
you will absolutely lose yourselves.
Perhaps it doesn't work the same for everyone
Go ahead and press ENTER
Okay, what does it say?
"No interface specified"
So every time you do this, you actually do need specified interface.
Mine is wlp2s0
That is my wireless interface
That is currently in monitor mode.
So press ENTER
and there we go
We have a scan in progress, and I have another device that is hooked up.
That's this device
It's BSSID and STATION
STATION is a device that connected to the access point.
You will not be able to perform this method
if you do not have any stations that are connected to a certain access point
or are associated with it
This is because you have nothing to authenticate.
There is nothing conducting authentication process
which you can capture.
We will at the moment be authenticating this device
and this is also a method that you can use in order to perform a DoS attack
on wireless networks
guaranteed to work
Actually I'm really surprised that the wireless networks
are so vulnerable to this.
Pretty much any wireless in the city or any wireless in a building
or something of a kind
will be vulnerable to this
and you will be able to deauthenticate much everybody
even in a university or something of a kind.
It is susceptible to misuse
but I would like to ask you, since I'm doing this for education purposes
not to do that
primarily because, as I've stated before the beginning of this tutorial
you can achieve your purpose and you can make a profit
without doing anything against the law
Anyway, that being said
we need to use airoplay-ng
and this is used for deauthentication purposes.
So let's just go ahead and type it in here.
Once again I just tabify because there's no point to risk anything
airoplay-ng
What I want to do is pass an argument of -0
then I'm going to give it the 0 again.
I will explain in a moment what these are .
-a and the MAC address of the access point.
We don't need the BSSID flag there
Anyway, these two arguments state...
Basically this argument states the amount of
deauthentication transmissions that you wish to send.
You put the 0 in
It sends it into an infinite loop.
Basically, you will permanently deauthenticating
pretty much every device on this particular MAC address. .
That is all the devices that are trying to associate themselves
with a wireless access point on this MAC address.
For example, if you want to temporarily disrupt connections
you can type in here 10 or 9 or something like that.
There are even options to deauthenticate particular clients
but for the time being, I'm just gonna send a general deauthentication request
transmission, actually.
This will deauthenticate everybody on this particular wireless access point
Since it is my wireless access point, I don't really care
I do have only one device associated with it
and that device will shortly be disconnected.
Now if you wish to verify this, you can connect your cell phones or smartphones
and you connect them to your WiFi access point within your houses
or apartments or whatever
and then you can try performing a DoS attack on yourself to see how it works.
It will be a fantastic exercise.
If you have any troubles, feel free to ask them the question section
but it should work.
The procedure is exactly the same as what I'm doing now.
You will then notice that the WiFi connection on your phone is breaking
so when that starts happening
when the deauthentication request starts being sent
try accessing some sort of a website through your cell phone
which ever one you have
I don't know if it's Android or iPhone or something of a kind.
Just try doing it
You will see that you can't because there's something
obstructing your connection.
You are no longer associated that access point.
That is quite problematic.
I would recommend doing that, as that's a fantastic exercise.
You cannot cause any damage.
As soon as the deauthentication request starts.
Your connection will be restored.
So let's just go ahead....I canceled press ENTER
because I need to actually type in the interface.
This is one of the downsides of aircrack
I would definitely suggest that they change this
so that you don't have to type the interface every single time
but that being said
Excellent
I am sending the deauthentication to broadcast the ESSID
There you go
and excellent
Yep I have definitely lost my wireless on all of my devices pretty much
or on the device that I have connected to this wireless access station
and you see, you can't just leave it running like this.
Just leave it running for awhile
just to make sure that you have deauthenticate the device
because you cannot see the device that you are deauthenticating.
You don't know if you deauthenticated it.
So just let it run for awhile.
No problems there.
You won't lose anything.
At a certain point of time, after a couple of minutes
probably less
you can go ahead and cancel it.
Due to the proximity, I can go ahead and cancel it now
and my device will try to reconnect in an automatic fashion.
Once it does that, I will capture that deauthentication
and it should work just fine.
In a moment, we should get a four-way handshake in the upper right corner.
There we go
It says "WPA handshake" for this MAC address.
At this point of time, you can just go ahead and stop the capture process
as there is really no longer a point to it.
We have gotten what we needed.
It's all here
In the next tutorial, we will take apart a file which we have captured
and see what we can do with it.
How we can actually crack it.
That is the difficult part of it all.
Capturing traffic is not a problem.
Finding the wireless access point is not a problem.
The problem is cracking the encryption itself.
Now just keep in mind what I said in the beginning.
I want to mention this one more time before I wrap this tutorial up --
You must absolutely have at least one device that is associated with this ESSID
Of course if there are more devices, the better for you
but you must at least have one
and if there are lots of devices you might consider
a different denial of service attack deaunthenticate them.
You should probably deauthenticate them all, select a few
and leave a few running
So, I don't know, if you have ten or twenty of them
usually there are
in a lot of WiFi access points, you can select five of them.
So if just five of them don't work
they'll usually look to the person next to them or something like that
and they'll see that it's working for them
and it's not working on their devices
but it is working on the devices on the person next door
or the person sitting next to them.
So the general conclusion that pretty much everybody draws from that --
"Oh it has to be something to do with my device probably. It's not working"
or something of a kind
I will go over this in great detail when I go into denial of service
but for the time being, just know that that is an option.
In any case, I bid you farewell
and I sincerely hope to see you in the follow-up tutorial
where we will actually cracked the code.