Hello everybody and welcome to visit tutorial.
Today I will do as I promised in the previous one.
We will do a bit of scripting and we will see how that works to our advantage.
Now a client might try to hide
so if you wish to some sort of a long-term wireless denial of service attack
you will want to be vigilant.
You will need to monitor the status of the network
You will need to see when the MAC addresses are changed
when the ESSIDs are changed
when channels are changed, and so on and so forth.
Now these things, you can do to manually.
You can do them with scripts.
The choice is entirely yours.
I can't go into bash scripting here, because that would be a course for itself
but I will show you some of the basics and what you can do with bash scripts.
I mean, they're very powerful.
You can do a lot with them.
You can automate most of your tasks
and on top of that, we need to see how we can deauthenticate particular clients
on the network.
So I didn't change anything.
So I'm still in monitor mode, if I'm not mistaken.
So I'm just gonna go ahead from the previous tutorial, that is.
I'm just gonna go ahead and type in "airodump -ng wlp2s0"
and then I press this.
I have my network here, so I'm just gonna go ahead and take its MAC addresses
and I want to do a more precise scan
So here's what I will do --
I'll do "airodump -ng --BSSID"
which will be the MAC address of this of this access point
and I can also specify a channel with "--channel"
but I don't really want to do that.
I just want to scan for this MAC address and see.
That way I'll know if the channel changes.
The scan is now in progress.
At some point of time, I'm sure I'll get a client here or something of a kind.
Let me just deauthenticate it and deauthenticate it in my cell phone.
I'm just gonna turn wireless on and off and then I should get the signal
because there is no activity.
If I was browsing the net on my phone or something like that
It would show it immediately, but I have not doing anything
and there we go.
Simple authentication will show transition of packets
between the BSSID of 90:F6:52:C1:BB:18
and the station is basically a device
which is connected to that particular access point
Now I will go ahead and stop this here
and before I continue, you can see in the upper left corner
it says channel 6
and you have seen that these channels changed
I mean, it's been going from 1 to 14 if I'm not mistaken
and when these channels here change
your wireless network card is put into these functions
in accordance with these channels, and functions on these frequencies.
So that might disrupt it, and for a DoS attack
you might need to manually reconfigure your wireless network card.
As I've showed you before, just use iwconfig
and set it to whatever channel you want.
Anyway, client, as I said
can change the MAC address
it can change the BSSID
it can change even the encryption method
and can change the channel.
So how can you know for sure if somebody changes all three of these
if somebody changed the channel of the MAC address and the BSSID
how can you figure out what access point are you going to continue DoS'ing
because you might have like a hundred of them of something of a kind
that you captured with this airodump -ng packet
how will you figure it out?
Well, simple
Same clients will be authenticated with the same networks.
So even if the BSSID name changes
even if I can change it something 1,2,3,4,5 or whatever
all of these parameters change the clients
which are authenticated to that access point
will not change.
I suppose theoretically, somebody could go ahead
and change the MAC addresses of every single device
connected to that access point taxes point
but think of the following scenario --
You're a company or you're in a coffee shop or something like that
you cannot go around changing everybody's MAC addresses
on everybody's devices.
No way
So the first time around
see which clients are authenticated to a particular access point
and then do a general airodump-ng like this
Do a general sweep like this
and then you will see the authenticated clients down below.
You will be able to see down below
who are the clients that are authenticated to that particular network
and in such a way, you will figure out the new MAC address
and the new channel, the newest BSSID
and the DoS attack will be able to proceed.
So as I said before, there really is no stopping it
there is only hiding from it.
So just go ahead and clear
and I have a very nice bash script here, which I want to show you.
Well, it's not very nice but it does the job
So this is a bash script
and this is an infinite loop.
It will perform until I cancel it manually as a user.
So let's just go briefly over it it.
It says "aireplay -ng -0 5"
So I want to send five deauthentication signals...packets
and then "-a" to this MAC address from this interface.
Next up, Windows 5
the authentication packets have been sent.
I want you to bring the interface down.
So go ahead and bring the interface down.
Use MAC changer
Change the MAC address of the interface to random.
So randomly change MAC addresses of my wireless interface.
Just print out the "New Mac" so I know that something is happening
and then I want you to reconfigure the mode of the wireless interface
to monitor again.
Bring it back up
Tell me that the mode is monitor when you grep it, in order to confirm it.
Go ahead and sleep for three seconds.
While your sleeping, echo waiting
I don't know, I just wrote this down for some strange reason.
Anyway, what you can modify here
you can modify the sleep timer
so you can go to sleep for relatively larger shorter periods of time
depending on how you wish to perform this DoS attack.
Over here, you can read values from a file
where you have a list of access points
which to jam at particular time intervals.
That's a bit more of a complex bash scripting method
If you're interested, feel free to pose it in the question sections
but you do need to have a certain knowledge of bash in order to do that.
In any case, there are some of the things that I would like you to try
and play around with.
If you succeed, good
If not, feel free to post it in the question sections.
I will be more than happy to help you out.
Anyway, as I said, you can have a list of MAC addresses here
that is loaded from some file that you previously created
and you can jam particular wireless access points in certain time intervals.
When you do that, you will also need a command down below
in order to change to the appropriate channel
because you will also need to know the channels of those access points.
So "iwconfig wlp2s0 channel"
and then you will need to specify a channel name here, so 7 or 3 or 1
Excellent
So not a bad idea.
You can increase the effectiveness of your wireless jamming.
You can effectively basically jam your entire neighborhood
which I definitely do not recommend, as that is illegal
but people have been known to do it.
I mean, somebody somewhere figures out how to do it
and is genius enough to actually attempt it.
There's literally no gain in it.
It's just annoying to the neighbors, I suppose
but anyway, as I said, you can change the time intervals.
That's not a bad idea at all
Feel free to play around with this as much as you want
with this part here in the loop
and if you come up with any new ideas or something of a kind
feel free to post them in the discussion section.
I will be more than happy to take a look at it
and see what you have done on your own
because that is really one of the best ways you can learn something.
Anyway, let's just go ahead and apply the script and see what happens.
No, I do not wish to save any changes.
Anyway, before you can run a script
you need to do "chnod +x jam.sh"
and I'm just gonna type in "jam.sh"
and see, I am again on the wrong channel
"Waiting for beacon frame"
"on channel 7"
"wlp2s0 is on channel 7, but the AP uses channel 6"
Excellent
So this actually even tells you what channel is the wireless access points.
actually even tells you one what channel is D is the wireless access points.
So "iwconfig wlp2s0 channel 6"
and now we can begin the jamming process.
Excellent
So you see here, it send five of the deauthentication attempts.
The one that I have selected.
and then it changes the MAC address to something.
I don't know...unknown
and then it brings monitor mode back up again.
It says "Waiting"
When it says waiting, it's sleeping for three seconds
or something of a kind.
Whatever you write down
and you see the process is just going to repeat itself on end
pretty much until you shut the computer down
or until you terminate the process by killing the pid or just pressing CTRL C
Not a bad way to deauthenticate at all
but there is another thing that you can do.
So "airodump"
and you can use airodump in combination with airmon
but there is a trick to it.
You have to manually configure the channel for airodump -ng
so it doesn't change the channel.
If it changes the channel
your deauthentication attempts will not go through.
"Channel 6", press ENTER
Excellent
Now it's permanently scanning on channel 6
and you are able to monitor any and all changes that take place here.
So for example, if there are some changes that take place
you notice them and you can implement them elsewhere
and by that, I mean if you simply lose this wireless
if you no longer see it
perhaps the channel has been changed
or the BSSID has been changed...
Ha! Great. I even got the handshake here. Amazing
Oh no...I'm not actually not even performing the deauthentication.
I just got a handshake
It doesn't matter
Anyway, if you lose it
cancel it and do a general sweep without the BSSID specified
and without the channel specified
but you can also try just with the BSSID specified
and with the channel not specified
because somebody could have just changed the channel
and BSSID could have remained the same.
and I'm gonna use the jam.sh, which starts up aireplay
in conjunction with basically airodump.
So I can monitor the status
and what is going on here?
In addition to that, I can actually jam the signal as well
and even though it says that this station is actually deauthenticated with it
believe me, on my android phone or whatever this is
I would not be able to browse the internet.
There is no way
I would be continuously deauthenticated.
It would be impossible for me to even open up a basic website
That would be beyond the abilities of the device.
As I said before, you can actually use your own phones
you can use your own tablets or whatever other devices
in order to confirm this
but you can see that these tools can work parallel to each other
no problems
as long as you...
You cannot tell your wireless card to function on several channels at once.
At least I don't know how to do that.
Maybe you can somewhere on the net.
They definitely can be at the same time.
They can be modulated
but you cannot have them running at the same time.
So you do need to adjust the parameters a little bit
and then you can use several of these tools at once.
You can monitor the status, you can jam it
you can even get a wpl2 handshake or something like that
and it says here interface is down
because I have brought it down.
Anyway, thank you for watching
and I hope to see you in the next tutorial.
Until then, I bid you farewell
and I urge you to try to do things on your own as much as you can
as that is absolutely the best way to learn,
Okay, so let me just do a quick show here.
"clear" and "nano jam.sh"
Excellent
So instead of actually doing a general deauthentication here
you are also able to do this
So space "-c" for client
and I'm just gonna stop this right now.
I'm gonna take this client
So just take the MAC address of this client
where it says C paste it
CTRL O to save, CTRLX to exit
and I wish to run, jam
Excellent
It says "Sending 64 directed DeAuth."
blah blah blah whatever
This is all verbose output from the program.
That's all that it is
and it says which client in specific is it actually deauthenticating.
That can be
I'm gonna do airodump -ng channel 6
Okay, it says "interface wlp2s0 down"
Okay, so sometimes it's not gonna actually work out, as I said before
primarily because I'm bringing the interface down
but the scanning is actually in progress
and even though the station might show here as actually connected
or something of a kind
try browsing the net, as I said before.
Try doing anything with it on the internet.
You won't be able literally to move
because nothing will be able to pass through.
That's gonna be a pretty big problem.
As I said before, you can confirm this with any of your devices.
You won't be able to do anything with them.
I just wanted to show you can actually jam a particular client
You can also set the rotations here to, I don't know
jam a particular client for awhile
and then jam a different one for awhile
Again, you can have a list of clients here
and load them up from the files, so they can modulate.
You're jamming this client for five minutes
for the next five minutes, the next one
and so on and so
in such a way creating a bit of a chaotic situation.
Anyway, I strongly urge you to try.
You don't need to practice, but just try to do something on your own.
Try to alter the code
Try to jam something you have permission to jam
and try to do it in a bit of a different way.
Apply some other arguments
Play around with things
There really isn't much that you can break here
especially if you doing it on your own wireless
that you have a permission to do it on
and that is really the best possible way to learn
but in any case gonna be you farewell now
and I hope to see you in the next tutorial.