Hello, everybody, and welcome to this tutorial.
Today I will show you another brute forcing method.
Primarily because the one that I showed you previously does
require you to gather some information previous, prior to the attack itself.
Primarily because you cannot perform a brute force attack for
every possible combination out there for the VPA2 passkey.
Why? Well, simply because you have too many of
them to try, and you don't have enough processing power.
The best you could do is combine, let's say the best home user could
do is combine pretty much all the devices that they have in the house,
for example, your smartphone, a tablet, the laptop and a computer.
And you could combine the processing power of all of those devices and
basically distribute the decryption cracking onto all of those devices.
However, even then you would still find it very difficult and
you would still have way too many computations to deal with.
Again, you have online services, you can rent service to do this, but
that costs money, and [LAUGH] yeah, it's not easy to come by these days.
Anyway, do not despair.
There is no reason to panic or anything of the kind.
I know that the previous method is somewhat difficult and it does
require you to actually go out there and gather some information on your own.
However, this method that I am about to show you
doesn't require you to gather much information at all.
Basically, what somebody has come up with is this extremely
stupid idea of PIN authentication for wireless networks.
And there is a major flaw in it.
First of all, PIN authentication only has numbers.
Which dramatically reduces the amount of combinations possible.
Namely, there are only 11,000 combinations.
And considering that the reverb splits the length of the PIN code in two.
Once it finds the first half, finding the second half gets a lot easier.
So you don't even need to do.
In all likelihood you won't actually need to do all 11,000 combinations at all.
Now if you have watched the previous tutorial you have seen that I can do maybe
1700 up to perhaps 2K passwords
a second or two key attempts per second.
You would think that oh well,
11,000 possibilities, not much at all, probably less than ten seconds.
It would be over.
However that is not the case because the sort of
attack if we're going to perform now.
This is not, we're not gonna be doing it locally,
we're not gonna be doing it on the machine itself.
Itself like we will have a file that we will be able to use our processor to crack
the encryption of that file, rather instead we will be doing this remotely.
So we will come into the range of a wireless access point and
then we will attempt to attack that wireless access point by passing it in,
by trying to pass PIN codes.
And if any them works out we're gonna get a response from the revert software.
And it will basically tell us, what is the pass code,
what is the VPA2 preshared key for that particular access point.
The downside of it all is that most of the routers these days, even though they,
the brilliant router manufacturers have actually decided
to put PIN authentication to be enabled by default on most of the routers out there.
They did, fortunately, put a preventive measure which is
the router itself basically locks.
After you've passed the incorrect PIN several times, it will lock and
it will not allow any PIN authentication of whatsoever to go on for
a certain period of time.
Usually maybe an hour or something of a kind.
You can immediately deduce from this.
This leaves possibilities for numerous DOS attacks and
all you would have to do is authenticate falsely a couple of times and
PIN authentication will be disabled for pretty much anybody there.
And there are a good amount of networks out there who rely primarily and
only on PIN authentication, why I have no idea.
So without further ado, let me, I have showed in the previous
tutorials if you don't have Reaver installed how to install it.
But in this particular one I'm gonna just go ahead and use it.
I won't do any of the installation
procedures because they're already done in the previous tutorials.
So just go ahead and type in reaver -- help, and
you will get a ton load of options.
I mean maybe not the ton load but certainly a good amount of options.
We will be using some of them,
more likely than not when dealing with different kinds of routers.
You will be required to use some of these options,
use some of these arguments primarily because yeah,
different routers have different configurations.
And you want to be able to hide your attacks or to mask yourself somehow.
Not because you are gonna get detected or
something like that because it's not likely that
anybody can actually track you down if you are attacking wireless access point.
Provided of course you are not authenticated with it.
If you are not authenticated with the wireless access point, and
if you're just attacking it like this wireless radio or something of a kind.
Basically there is almost no way to detect you.
There is no way to find your physical location or to identify you.
Sure, your MAC address will probably show somewhere.
But what do you care?
All you need to do, as I stated in the previous tutorial,
is type macchanger and change it.
No problems.
If you don't know how to change the Mac address, just go back to tutorial 242 and
you will a tutorial called Mac or Mac Changing or something of that kind.
It will have the word Mac in it, M-A-C.
And there, I have explained in great detail how you can actually hide your
Mac address without any sort of problems whatsoever.
The primary things that we're gonna be using today,
the primary arguments, that is, is i interface.
And we will of course need the bssid, or MAC, of the target access point.
Before we do that,
as before with aircrack-mg we do need to do a couple of things.
We need to set the mode of our network cards.
So, I'm not gonna go into great detail,
how to do it here because I have explained it in previous tutorials.
Here I'm just gonna do it and hopefully you will be able to follow through.
If not just go back a tutorial or two and see,
I have given detailed explanations there.
So just type in ifconfig.
Type in the name of your wireless access card,
and bring it down, operation not permitted,
I'm not root, of course.
[SOUND] Okay, I always love my passwords primarily because of their length.
I sometimes tend to forget them which is infinitely interesting.
But there you go, I've managed to type it in, and
it's actually a good thing that I haven't managed to login just yet as route.
Because I have my router opened here which I set up for
the testing purposes of this particular tutorial.
And you can see the current PIN, I mean these PINs can be generated,
these PINS are generated at random.
So you can see the length of the PIN and
you can see the PIN here I can say generate new PIN let's see what happens.
The change for this config will not take, yeah.
Okay. So it will not take effect until
the device reboots.
But here you can see the length of the PIN.
So it's like one, two, three, four, five, six, seven, eight, only eight digits.
And if I do it again it's gonna be eight again.
So one, two, three, five, six, seven.
Oops, sorry, not eight.
It's gonna be nine.
Is it nine?
One, two, three, four, five, six, seven, eight.
Sorry, no, it's gonna be eight again.
It's always going to be eight, so no problems there.
You know the length of the PIN,
which dramatically decreases the amount of possible combinations as well.
Depending on what sort of a router you have,
the PIN can be at different places in the router.
I can't explain it for every individual router,
but you can find it in the manual or something like that.
Just open up a web interface for your router by typing in the IP address.
If you want to know what the IP address of your router is on a Linux system,
that is very easy to do.
You can just type in route, press enter and this might take a bit of time.
I'm not exactly sure why is it taking so long.
Primarily because I'm not connected to the network.
Okay, so I have config this another way.
But here, it would say Gateway, and where it says Gateway,
that would be the default address of your router.
However, that is the default Gateway.
That does not necessarily need to be the IP address of the router you
are connected to.
So, type in ifconfig.
This is a foolproof way of getting the IP address of the router,
much better than the previous one.
And I want to get the IP address of the router to which my wireless access point
is associated with.
So wlp2s0, press Enter, and there we go.
I have an IP address here.
Okay, let's just clear this up a bit.
[SOUND] Clear.
I want to get a bit of a better picture, grab iNet.
Excellent.
So I have iNet here, and this is the Internet address.
But this is my local address.
It's not to be used for external purposes at all.
It's 192.168.0.102, and the difference between your wired and
wireless connection is usually this digit here.
For wired it's one and for wireless it's zero and
then you have a list of hosts which are here.
Anyway, my IP address in my local area
network that my wireless interface has is 192.168.0.102.
The lowest possible IP address within this
range with only the last octet changing is .0.
So, from zero to 255, and the lowest one would be zero.
But you cannot use zero because that is the network address.
So what you do is find the lowest one here, which is zero.
Plus one and that's gonna give you the IP address of your router, very simple.
And you can see that is exactly what I've typed in here.
It's 192.168.0.1.
So just find the lowest one which is zero of course then add one which is
going to be the IP address of the router.
Anyway, now that that is out of the way,
I've showed you how you can check it out here, the PIN code.
But, this interface will differ from one router to another,
please keep that in mind.
So, this is not a general explanation for all of the routers out there.
But, it's fairly simple to find a PIN code on your own home router without
any bigger difficulties.
Just go ahead and login to it via web interface as I said,
just type in the address here, you will be prompted for login credentials.
Usually it's adminadmin if you haven't changed anything.
If it's not, go ahead and contact your ISP provider and
ask them to provide the username and password for you.
Assuming that it's not locked, if it's locked, you've gotta break it,
but I will show you how you can break routers in the tutorials to come.
In any case, let's just go back to the subject here.
Now I am root.
Let's take down my wireless interface.
IfConfig, vlp2s0 down.
And now I need ivconfig wlp2s0 mode monitor.
Excellent, so ifconfig wlp2s0 up.
There we go.
You can make a neat short script.
The best script which has these commands listed and
that could be a fantastic way to do this.
You would effectively save yourselves a lot of time there.
Go ahead and clear the screen.
And you see it says connection to something, it has been deactivated.
Because my wireless interface has now been brought down and up and
on top of that, it's in monitor mode.
Now, there was a program which I've used in the previous tutorial,
which is a part of the air crack packaged It's called Airmon.
Airmon-ng and I want to check vlp2s0 for
any possible problems.
I have explained this in the previous tutorial,
why am I doing this and how is this done.
So airmon-ng check vlp2s0, of course your wireless interface
name will probably not be the same if you're not using the same OS as I am.
But just substitute it with whatever it is.
No problems there.
In the previous tutorials I've also stated that.
Here we have a list of problems, as I like to call them.
These are lists of primary problems as a network manager because its
generating a lot of the other things up here.
So we'll just go ahead and kill them, 13133, I gotta kill them one
by one because they are spawning one another and
that can be problematic.
So, kill 2498, even if you are root they can give you
a ton load of problems primarily because as I said they are spawning one another.
That can be just such an unbelievable drag.
Excellent. Now I have,
let me just clear the screen again.
Now I have ran the check once again to make sure that I don't have any problems.
If you are afraid that you will kill something that
you don't want to kill in terms of networking, don't worry.
Anything from that list will auto generate pretty much,
the moment you re-initiate your network manager.
You can just type in the service NetworkManager restart.
And all those processes will be generated.
If you don't wanna do this you can just reboot the machine and
you will have pretty much the same effect, no problems.
Let's go ahead and clear the screen.
Before I actually start using reaver, which we have installed previously.
I do need to check for wireless connections within my area and
I do need to check whether they are vulnerable, very important thing to do.
And that I will do in the follow up tutorial.
We will use the wash command in order to find these wireless access points.
Until then, farewell, and I hope to see you there.