Hello everybody and welcome to this tutorial.
Today I will be talking about DoS attacks and how you can actually deny wireless access
to pretty much anybody within the range of your wireless card.
Now your current range of you wireless card is not your permanent range
and probably it's not your maximum range
because you can boost signal as well
but of that, I shall speak of it later on.
For the time being, I wish to focus only on the actual DoS attack, as that can...
Well, not only can you deny the service, but as I stated in a previous tutorial
you are actually able to trick the user into resetting the router
primarily because if you can't connect to your wireless, what is one of the first things that you do?
Basically just reset the router.
Even if you call the ISP provider, one of the first things that they will tell you is reset the router
and these sort of attacks, unless they're going over an extended period of time or something like that
they don't raise a lot of suspicion.
I mean, most people when they can't connect wireless in their houses or something like that
well, oh well...reset the router.
If it works out, great
If it doesn't, oh well
Call the ISP, then they try to fix it
but you're not gonna be running the DoS attack probably for that long.
Your idea is to force a reset, however you can run actually permanent DoS attacks
and in such a way deny service to a certain user or company or something of a kind.
There is no known way to actually stop this
There are, as I've stated in previous tutorials as well
you can use some paint that doesn't signals to pass through
or you can use some tin foil, or something like that, on the walls
but you are effectively limiting what you can do with your own wireless in such a way
and that's not really the best of solutions.
Anyway, there are certain things that a user can do in the other side to mediate this sort of an attack
such as change the channel of their wireless access point, change the MAC address
but none of those things are actually stopping the DoS attacks
All of those things that they are doing is simply hiding and biding for time.
All you need to do is simply follow up on the changes.
For example, do a scan again
If you see that there is something wrong
and that's it
You will find a new MAC address, you will find a new channel
and you will see the new ESSID as well.
So anyway, without further ado
let's just go ahead and perform this sort of attack, see what happens, and how can we actually confirm it.
Anyway, the first thing that we need to do is set our wireless network card into monitor mode.
I have a small script that I have written for myself here.
I have explained it in the previous tutorials.
If you're just wondering why I am not doing this by airmon -ng
"airmon -ng start wlp2s0"
Well, I've discovered that on Fedora, the distribution that I am using at the moment
the one I am using for the demonstration of this tutorial
well, it just presents problems.
I mean, it creates virtual interfaces
and I don't know, you get an error like name not unique on the network
and there's a way to fix that or work around
or something like that
but I've just returned my own script and then I'm going to use it.
You can use it as well. I've shown it in the previous tutorial.
All it does is bring the wireless interface down, change the mode to monitor mode
and then change the state back up again.
Here we can just see it one more time quickly.
Excellent
Perhaps I should add a MAC change here as well.
That would be actually a good idea, but for the time being I'm not going to do that
primarily because there is no need to hide, as I'm doing this to my own wireless system.
However, if you're doing this outside
definitely use "macchanger -r wlp2s0"
You can only change the MAC Address when the interface is down.
You cannot change the MAC address of the interface that is up.
How to do this I have shown in the previous tutorials as well.
Anyway, let's just go ahead and clear the screen.
I usually run this command "airmon -ng check wlp2s0"
I use this not to set in monitor mode
but rather instead, to perform a check up to see if there are any programs
any processes out there, within my computer, that might cause problems or interference.
Apparently there are none.
If there were, once you run this command
it would give you the PIDs of the processes and you would kill them easily, no problems there.
Let's just go ahead and clear the screen
and tool that we need to use, as part of the aircrack package here, is aireplay.
So before we actually start doing that
we will of course need to perform a scan with a tool that we have used previously.
So "airdump -ng wlp2s0", press ENTER
Oops, it's "airodump"
So apparently, I have some open access points here as well
and I have noticed a very strange thing.
When I perform these scans during different times of day, the signal strength varies
and the amount of wireless access points also changes
I'm just gonna stop this because there are too many of them now.
The amount of wireless access points changes
and the signal strength changes.
What I've noticed that people are doing
is that they actually turned their WiFis off during certain times of the day
when there are enough there or when they are not using it or something of a kind
and that is a very wise precaution.
I mean, that's a very intelligent thing to do
because if there is nobody your house, if there is nobody using WiFi
there is literally no reason for you to leave it online.
Just pull the plug. Simple as that.
You increase the safety of your home network exponentially
primarily because, not only are you permanently invisible during certain period of time
but you are also effectively limiting windows of opportunity for anybody to attack you
and that can cause a ridiculous amount of problems to an attacker.
Anyway, so over here I have my wireless interface.
It's called "Something"
It's on channel 6 and its power is relatively good
but look at my neighbors.
I conducted this scan last night and my own wireless was about 50 something
and my neighbors was 59, which was ridiculous.
I'm guessing this guy is right next to me or right below me
with an antenna attached to the ceiling or something of a kind.
I have no idea, but he's getting a really strong wireless signal.
I have to ask around to see who this is, just to see what the signal strength is on this router
but anyway, it doesn't really matter.
Let's just use the aireplay.
However, I didn't find a way to actually specify a channel in aireplay.
Perhaps there is an option there or something of a kind, but it doesn't really matter.
I didn't try too hard.
What I want to show you is that you can actually change the channel
of your wireless internet network card manually.
So just type in "iw..."
Wait, before we actually do that, let's just try random scan and see what happens.
So "aireplay -ng"
and here we're gonna need to specify "-0"
So "-0" is from the list of arguments
that I do believe that I showed previously, but it doesn't really matter.
So you see in help menu it says "--deauth"
You can use "-0" instead of that.
"--fake identification" you can use "-1" instead of that, and so on and so forth.
You don't actually to type in the whole command.
Rather instead, they've numerated them
so it's a lot easier to actually use.
Anyway, "-0" ad space
It says "count"
So how many deauthentication requests do you want to send?
You can specify a number
It can be very large number here
or you can just say "1" for single deauthentication, for capturing wpa2 handshakes.
Well, you're probably gonna need more than one, but doesn't really matter I usually have a
I usually have the tendency to place a 0 here.
0 tells it simply to do it continuously.
So you can just do it until you feel satisfied or until you achieve your purpose
and then CTRL C to actually cancel it, no big deal there.
Anyway, after that, we need to specify a "-a" option, which is the BSSID
and then in addition to that, we need to specify an interface that we are going to be using.
Press ENTER, and there we go.
So it says here on channel 3, but I know for a fact
and you can scroll up, you can see here it says "Something", it says "Channel 6"
So this is not gonna work.
It says "No such BSSID available"
"Please specify an ESSID"
So perhaps the name of the network.
That is due to this channel problem
So this is Channel 3
and my wireless access point is actually functioning on Channel 6
while my wireless network card is functioning on Channel 3 in my laptop.
What we need to do is manually configure the channel of our network card.
So "iwconfig wlp2s0 channel 6"
So it's very simple
It's like English language
You have a command, so "iwconfig"
The name of your wireless interface.
Just type in the argument that you want to change, which is "channel"
Same thing with mode, so just type in mod here and change it to whatever you want
but in this case, we're changing the channels
So just type in "channel", space, and then just type in the number of the channel you wish to change it to.
Anyway, now our wireless network card is operating on Channel 6
and if we repeat the command that I have previously shown
you will see immediately it actually passes.
Okay, so there is this message that we're being displayed here.
This is not an error message, this is just a note of a sort.
We can also deauthenticate individual clients on the network.
You see, this attack that I am performing now
this will deauthenticate everyone on that wireless access point.
Everybody will be deauthenticated.
I mean, you can confirm this by using your smartphone or tablet
or another PC that is connected to your home wireless network
and it might show the status that it is still connected
but try browsing the net.
Try opening a website or something of a kind.
You will never be able to do it, like not in a million years.
Also, there are some MAC filtering options that routers attempt to impose, but it doesn't matter
I have shown you how you can change a MAC address
and you can also set a script, which will rotate your MAC addresses periodically
so that can be a nightmare.
Also, the routers have the option to adjust a certain range of MAC addresses, which can access it
but again, you will be able to see the deauthenticated clients on that network
and just use their MAC addresses instead and pass through.
As I said, this is ridiculously difficult to stop
and it's really painful when you're being DoS'ed, in terms of wireless
There is very little that you can do.
I honestly don't know of any known method to actually completely stop this
but we'll see.
There are some enterprise type routers that are actually able to fight this off to an extent
but we'll see what the future brings.
Anyway, I will be doing more of this in the follow-up tutorial
and I will show you how you can deauthenticate a single client.
Plus, you'll be writing down some bash scripts
and see how that works out to improve our attack.
In any case, I bid you farewell
and I hope to see you in the next tutorial.