Hello everybody, and welcome to this tutorial.
Today I will show you how to circumvent that problem when the router locks.
And is unable to receive any requests for PIN authentication.
Now there are two scenarios that could happen here.
One of them is that a router locks out for a certain period of time,
let's say for five minutes, an hour, or a day.
Or you have routers,
which after too many unsuccessful attempts at PIN authentication, just disable VPS.
That can be very problematic.
That is probably the worst part of it all.
Because you don't really have any legit ways of resetting the router remotely.
There are some tools out there that claim they can do this.
I think MDK3.
You can use it to effectively
reset router lock outs, but remotely.
However, that only works on really old routers.
And I've basically searched through the forums and
searched again just to be certain of this.
It's not very likely to work on any of the newer routers.
But, you can just think of it in a logical fashion.
If the router somewhere out there locks you out, and you are unable to attempt any
more PIN authentication per a unit of time.
You can actually DoS it so nobody else is able to connect to it.
And then, more likely than not, the owner of the router, or
whoever is in control of the router.
Will reset it in order to see if that will fix it.
Once the router is reset, the PIN lockout will disappear,
and you will be able to try it again.
I will show you how to DoS routers a bit later on, wireless routers especially, and
some other things as well.
But for the time being, I have a simpler solution for you.
Solution that is generally applied is that you limit river
to attempt a certain amount of PINs in a certain amount of time.
So let's say two PINs in 60 seconds.
Or five PINs in 60 seconds or something like that.
You can even tell it, just do one after another.
But that's bound to fail.
Without further ado, let's just go ahead and try it, and see will it actually work.
But, before we do, I have made a small script for myself, here.
To enable monitor mode on my wireless card.
You can have a look at it, and copy it if you like.
But it's just a list of commands that I have used before.
Let's go less monitor.sh.
And this is my script, basically it's a batch script.
And I have four commands in it.
It's ifconfig wlps2s0 down, to bring my wireless interface down.
And then iwconfig wlps2s0 to enable the monitor mode on it.
Bring it back up, and I want it to report back to me.
And tell me that and confirm that the monitor mode is actually running.
So let's just go ahead and do that.
./monitor.sh.
Excellent.
So you see, it says here, Mode:Monitor.
And I know that probably my network manager is going to interfere with this.
So I'm just going to do service NetworkManager stop.
So that's gone.
And then I clear the screen.
Now what I need to do is, well I can either do wash.
wash -i wlp2s0 and see if that will work.
No, it will not, why?
Just go ahead and see.
I have fig.
Its not up for some strange reason.
Give us just, Let's see if I can do that again.
And I'm going to clear the screen.
Do wash-i wlp2s0.
Press enter, there we go.
Probably, the interface went down with the network manager for some strange reason.
But doesn't really matter now.
Anyway, wash -i, as I said before,
it tells you which wireless access points in the neighborhood are vulnerable.
We have this one, so I'm just going to cancel it here and close it.
You can also check the signal.
I've showed you how to do that in a previous tutorial.
But let's just go ahead and try to do this.
And attempt to bypass this limiting
rate VPS bin authentication.
So, reaver -i wlp2s0, which is my wireless interface, space -b 4.
At the BSSID here, let's just go ahead and copy it, paste it here.
And what I need next is actually recursive attempts, -r,
Here I can specify the amount of tries.
So let's say I want to have two tries colon.
Per 60 seconds.
Fairly simple, no problems there.
Just by adding this command here you can bypass pretty much the lock out problems.
But if you get locked out with this.
Try decreasing the amount of tries, or increasing the amount of time.
Eventually it has to work.
Because every router out there has a limitation on these things.
They have basically say if you have that many tries in that amount of time,
then lock out.
It's an if statement basically.
If that act like this.
If not, act like this.
They have to have a limit here.
They can't just say, they cannot put infinite values here.
They have to say basically,
if you get that many tries in that amount of time, lock out.
And as long as you can be above that, the router will not lock out.
It will work well for you.
If you're wondering how to get the individual lockout timers for routers.
Well there is no simple answer for this.
You've got to go on the net and search.
Sometimes you will find it, sometimes you won't.
It depends people have reversed engineered some of the firm ware on the routers.
And have figured these things out, but not on all of them.
However, the fool proof method is just simply to try a couple of times, and
see if it works.
And see when it works when you do not get it.
When you don't get the error message, and you're good to go after that.
After that you can just leave your computer running, and
its bound to break it.
However, the problem here is that this will increase the amount of time
required to crack the pin, exponentially.
It might take you up to three weeks to break it.
I think that was the longest.
But still, if you just think about it, three weeks is not a huge amount of time.
It is still within the realm of possible.
Especially if you are trying to pen test something somewhere.
Or, If you have access to a position where you can actually transmit
this sort of signal in order to attempt these authentication.
In order to attempt the authentication via VPS, or something of the kind.
However, there was a downside to it especially
if you are functioning on a limited timetable.
And if you don't have that much time It can be very problematic.
There are some other methods, which I'm gonna show to you in a moment.
Which can bypass, restore previous session?
Nah, I don't want to restore previous session.
Let's just go with this one.
Because I have reset my router in order to actually unlock it.
As I did lock it previously, and that was a problem.
So I have, while this is running, let's just.
Oh, I didn't specify the channel.
You don't actually need to specify the channel.
But if you want it to work,
you want to increase the speed of it, you definitely should.
So it's channel six.
Excellent.
Press enter.
No, don't restore.
Nothing.
Just go ahead, associate with it.
And attempt these pin combinations.
Anyway, you will see that nothing is really happening.
Because I have told it two attempts every 60 seconds.
And it's going to take a while before you see anything here.
Meanwhile, let's just go over to Kali Linux.
I have downloaded a script from the net here.
Let's just zoom it in.
So, this script will work for dealing routers.
Now, there are various scripts on the net that will help you figure out what the pin
is, before you even begin the pin authentication.
Now here's the catch.
Every router out there needs to have an algorithm
with which it can generate these PINs.
Since people have reverse-engineered these functions, which generate PINs.
You can predict what PINs which routers will have.
For example, D-Link routers generate their PINs based upon their MAC addresses.
Which anybody can see.
So generally their PINs based
on the first part of their MAC addresses, which is terrible.
For example, this script exact does the reverse.
Reverses the process.
Actually, duplicates the process.
You just feed it the mac address, and that's it.
Here, let me just show it to you.
The script, you can actually see it on the browser behind.
But I'm just going to nano pinGen.py.
Excellent. So I have some coloring options here.
And let's just zoom it in one more time so you can see it better.
So here's the code.
And you don't need to understand the code to the fullest of extents.
If you wish you can exploit a bit further.
The code is fairly simple,
it is written in Python, which is a programming language.
All it does is takes the MAC address, splits it in two.
Uses that to feed the function.
And then that function, based upon the variables that were passed to it,
can generate the default pin of the router.
That can be very helpful especially for dealing with routers.
The first thing you can try, you can try the default pin for a specific router.
Because every router out there that has VPS enabled,
also has a default pin which is enabled by default.
And it is not likely that people will change this.
Therefore, you are able to do this.
Basically pinGen.py.
I've just downloaded this from the internet.
Here is the website that I have downloaded it from.
You can just type VPS algorithm reversed for D-Link routers.
But, I am reluctant to give you a link.
Primarily because It's not very likely that you will be using
this specific D-Link router that I am using to demonstrate here.
You'll probably have some other router with which you will want to try this.
And therefore, it is best, it is absolutely best, that you
just use the model of the router that you have, or that you wish to pen test.
And then search the VPS algorithm for that particular router, or
something equivalent to that.
You won't find the VPS algorithm always.
But it's worth a shot, why not.
Just type into your favorite search engine vps algorithm for, and
then the model number or just the name of the brand of the router.
Like TP-LINK or Wowway or something of a kind.
It doesn't really matter.
Anyway I have pinGen.py here.
And if I just pass in the MAC address
of any of these, it doesn't matter.
Just in case, I'm gonna stick to the one that belongs to me.
So I wouldn't reveal any information here,
not that anybody would be able to make any use of it.
I mean, you're too far away anyway.
So just paste the MAC address here, and feed that MAC address to this script.
Press enter and you will get the default pin.
Now obviously this is not the default pin of my router.
But because I don't have a D-Link router.
But for TP-Link route for D-Link routers it's gonna work.
It's gonna give you default pins.
And you will be able to authenticate from the first try.
Which is very nice.
It saves you a ton load of time.
These things are router specific, and you do need to search the net.
The internet is your best friend to find VPS
algorithm functions that generate it basically.
This is going very slow.
I have not asked it to double the vv option.
Excellent, so
you see we can actually change the values here in the command of the reaver.
And even though you've changed the value,
even though you changed the arguments here.
It will still tell you if you want to restore from the previous
session, with the updated arguments.
And, here we go.
I have triggered the AP rate limiting.
It says waiting 60 seconds before re-checking.
That can be problematic, as this doesn't seem to work.
Well you need to increase this to four, or five, or something like this.
But sorry, not this.
We need to decrease this, or leave it the same.
But increase the amount of time.
I've learned that on my particular router, a setting of 300 seconds we will do.
And if you do, I don't know, two tries per 300 seconds, or something of the kind.
It's not going to lock out.
But I have given a very small value here.
And that's why we have faced a lock out here.
However, If you play around with these values,
you will find that after a while you won't get any lock outs what so
ever if you set this number, the timer up higher a little bit.
Anyway, I will continue on this.
I will continue with this wireless cracking process in
the follow up tutorial.
As there are a few more things to cover here.
But don't be disencouraged if you fail at first.
If you get these error messages or something like that.
Just play around with the timers, and eventually you will get the hang of it.
Eventually you will no longer get AP rate limiting or anything of a kind.
In the following tutorial, what I am going to do is show you the authentication
methods, And how you can basically shut down all connections to that router,
in order to force the user to reset the router, or something of a kind.
Because there is no way that they can detect you.
Or it's highly unlikely that they will detect you.
That they will find your physical location.
That is while your performing a DoS attack.
Especially if you change the MAC address.
If you're doing this sort of thing, please remember to always change the MAC address.
So there's no way it can be traced back to you in a physical sense.
But you can't be located anyway.
I suppose through some complex methods,
your physical location could be discovered with a four meter discrepancy.
So, if you're in a bar or something like that.
There are five people using a laptop, or a pad, or something like that.
There's just no way.
There's too many people to go over.
And, I mean they would have to use directional antennas.
And it would basically be a manhunt, or something of a kind.
But you're not gonna get that far,
primarily because you will always have a permission to do these sort of things.
Anyway, I bid you farewell until the next tutorial.
Where we shall be dealing with the DoS attacks of wireless.
And forced restart of these routers in order, again,
to avoid this error detected AP rate limiting.
Anyway, I bid you farewell, and I hope to see you then.