Hello everybody and welcome to this follow up tutorial.
Now, I have done some testing prior to actually beginning this tutorial and
I have realized that when I type in the command wash and
when I pass the interface VLP 2S0 which is my wireless interface.
Okay, it starts scanning it now and it seems to be working without any bigger
problems here however, let me just go ahead and cancel it.
It tends to issue out errors, and it doesn't say much.
It just says that it's unable to open the interface that you have specified.
And after I Googled it up a little bit,
I have found that the problem is a missing file.
In order to fix that, you just need to type in mkdir,
one of the basic Linux commands.
To make a directory, type in / etc / reaver.
Press Enter and there you go.
Now, this command will create this file in this folder.
It says cannot create directory because it already exists.
I have created it prior to this.
But if it gives you any trouble of what so ever try doing this.
Try creating this file.
Reaver can be problematic from time to time,
and there are forums dedicated to these things which you can, of course, use.
Just type in Reaver help, or whatever on the net,
then you'll be given 100 forums where you can go and turn to help.
But you can always ask me as well to help you out, no problems,
I'll be more than happy to do it.
Anyway, just go ahead, that's a small fix that you can do if you encounter any
problems, but if you don't, well, then good for you, and good for us all.
Type in, just go ahead and back and let's continue, and
let's start the scanning process itself to see what we can actually attack,
is what wireless access points are vulnerable and what we can actually do.
If you take a bit of a closer look, here you will see the BSSID,
which is basically the Mac address of the access point.
Here you can see the channel RSSI, that's not important for us.
VPS Version, that can be important.
And VPS Locked, this is what we are looking at.
This is the most important thing here that we need to pay attention to.
If it says no, good for you, you can actually do it.
If it says yes, it means that the VPS has been disabled on that
particular wireless access point, and this attack is rendered pointless.
You can't do anything with it.
It won't yield any results, in fact, you won't be able to try even a single bin.
So as long as the answer is no, the wireless access point is vulnerable and
you can perform this sort of attack, no problems.
I mean yeah, depending on the router of course and
depending on how well it was configured.
But out of the box, usually, it's not that good.
Anyway, this is the wireless access point that we will be attacking.
This is mine. It's called Something,
which I have set up for our tutorial today.
I think that this test router is like 20 bucks or
something like that, they're pretty cheap these days.
It's not the best one,
definitely, but it will serve our purpose for our learning sessions today.
Just go ahead and cancel this.
There is a, there is one more thing which we need to be certain of.
Here we can see which access points are vulnerable,
but other than that, we need to verify the signal strength, so
airodump-ng.
VOP2S0 go ahead and start.
Excellent.
So, I have used this command in the previous tutorials, and
here you can see the power output.
So, as long as it's, well, minus -80 is not a good thing.
It's definitely not a good thing for revert.
You want to have.
Let me just stop it here because I have the network that I want.
You see, something is -43, and I have this one which is -53,
these are all, well, good ranges, they have relatively good signal strength.
And somehow, even though my router is literally right next to my computer,
it's -43, which is not as good.
And I have these -80, it is probably my neighbor or something like that.
Anyway, I'm not gonna touch them, I'm not gonna mess with them.
I'm just gonna go ahead and focus on this one, which is mine.
But it does need to be at least- 60, at least below -60.
So -55, -40, something of a kind,
you will be able to actually perform it -75, and -80.
I have heard of these cases but, it is not easy.
I get breaks in the connection, get problems, errors, etc.
Not the best of things to do.
If you want to crack it, if you want to get close to it or something like that,
you don't need to stay there for the whole duration of the attack,
primarily because usually this sort of attacks you can start,
and continue at a later time from where you left off, no problem.
Reaver save this sort of information for you, and
you're able to re-use it or to restart it from where you left it off previously.
Now, I'm going to employ reaver, so type in reaver.
-a for our Mac address, so what we need is for
something, there we go, second one.
Let's go ahead and paste it and type in interface vlp2s0.
Sorry, my bad, it's not -a.
I want to pass the MAC address, and
the interface should go first, let's see if it's gonna work like this.
Yup, it's gonna work,
you don't need to use this specific order from the previous session.
No, but
I do want to do this double verbose output here, always a good idea to do.
Anyway, press Enter, no, I do not wish to restore it.
Just go ahead and continue and see what happens.
Okay, so you see what it's doing here?
It says switching to channel 1, channel 2, channel 3.
We don't want to do that, let's just go ahead and cancel it.
I want to save it a lot of time.
Let's see what channel I am using.
I am using channel 6.
That's just a frequency on which my wireless access point functions.
Let's just go ahead and type in -c 6.
Will it work like this, switching to channel six immediately?
Yes, it will.
No, I do not wish to continue from before.
Excellent.
So, it says here trying this pin, and it just keeps on going.
Guess it's going to tell me at a certain point of time,
what percentage of the task is done, but usually you can do this within a day.
I mean, provided of course, you don't get locked out, or something like that,
and the amount of tries you can actually do before you're
getting completely locked out.
So you see here's one pin, and where's the other one, here's yet
another pin, and here's a third pin, and so on, and so forth.
Of course we have all seen the pin that I have used at the very beginning.
That the router has generated automatically.
I have not saved it, I have actually just used the one that's already there.
But that's completely irrelevant, because pins vary from router to a router.
This is gonna take awhile.
You see it says 0.05% complete and
it gives you when it was done and if you remember at the beginning,
it actually asks me do I wish to continue from the last time I started doing this,
that's the beauty of it, you can go for it, start cracking it somewhere and
lets say you're passing by a certain place, you can sit at a bench for
an hour or something like that, have this run for
you, leave tomorrow again, pass by the same bench then sit on it, leave it for
an hour and a half, an hour something like that.
And there you go, eventually you will be able to crack it no problems,
of course if somebody is reviewing the router logs which is rarely done for.
For routers where pin out authentication is actually enabled,
than they will see that somebody is trying to do something and they might decide to
actually authentication altogether, however, other than that,
there isn't that much that they can do even if they set specific MAC addresses of
the computers within the network you will still be able to see those MAC addresses.
And, as I showed in the previous tutorial,
you will be prompted to, you will be able to change your MAC address to match
the corresponding MAC addresses which are allowed to pass.
And there we go.
After only 0.05% complete,
it says WARNING: Detected AP rate limiting.
Waiting 60 seconds before re-checking,
which means the router is now into lock down and you can't actually do anything.
There are, the good thing about the,
not a bad thing to do would be to actually see the router.
See the router's MAC address and then try to figure out which router it is, and
then search on the net to see what the AP rate
limiting is, and then you can time your reverb
in attempts in between so that the router doesn't get locked.
I will continue with this in the followup tutorial, but for
the time being, I am locked out and in the next tutorial, we will be
doing some work arounds around this lockout, and see how we can actually ply
past it because this is one of the most common problems that people encounter.
It's not the installation because it's relatively simple.
The usage is also relatively simple.
The set up is not a big deal or a big problem.
There's plenty of help on the net.
But here it says, Detected AP rate limiting,
waiting 60 seconds before re-checking.
That is one of the most hated lines as far as Reaver world is concerned.
In any case, I bid you farewell.
And I really hope to see you in a follow-up tutorial where
we will attempt to bypass this problem.