Hello everybody and welcome to this tutorial.
Today, I will show you the evil twin method.
This will complement a lot of other things along the way, not only that which will
come later, but also it complements that which we've already done,
primarily because evil twin allows you to steal all sorts of traffic.
Now, you are effectively with this method what you are doing, you are cloning
the wireless access point and then all the clients that are authenticated to that
access can get deauthenticated and the next time they automatically reconnect,
it will reconnect back to you should your signal strength be stronger.
Now, the issue with signal strengths, you are able to boost the signal strength
on your own of you are using Linux and of you have proper drivers.
It wont work on all wireless network cards but you can always get an external
antenna for your laptop, a USB wireless antenna or something of a kind.
I do believe they cost maybe, you get a wireless network card that
goes over a USB and then that wireless network card has an antenna.
They, I think you can get one for 20 bucks, something like that.
They're pretty cheap.
Make sure that they're compatible in terms of drivers.
And your signal can be a lot stronger than anybody else that is nearby, or
you can simply come close to somewhere.
You can go, if you were in a bar or something like that,
your signal should always be stronger for people that are closer to you,
unless they have crazy good wi-fi system in a bar or something of a kind.
Also useful in companies or something like that while people.
This has been known, people have been doing this.
They go into a lobby.
And they're waiting for something.
And they have a laptop that's in their bag or something like that,
and that laptop is working while they're waiting for somebody.
So they're not suspicious at all or anything of a kind.
And especially if you have a hundred people in a huge lobby or
something of a kind, you will practically be invisible and
be able to take a lot of information that way.
However, you will face the problem of encryption once again.
But encryption is, we are not doing this for
the sake of perhaps cracking the GPA2 passkey because it can be
cracked in this way through a little bit of social engineering.
But you can also, what you can also do here is
play around with people's information.
So, play around with their URL, HTTP,
Get requests and you can modify their net queries.
Also, you are in control of what gets served to them.
So you can control the content that gets served to them primarily because you can
alter the DNS servers.
And if you alter DNS servers, you can have customized MX records, or
something of a kind.
What this allows you to do is say that
Facebook.com will be resolved through some other IP address than the official one.
So, to whatever server you want, you can redirect the traffic, which is fantastic.
Because you can clone a Facebook page.
I'm just specifying Facebook as an example here.
This can be done for any other site.
And this is practically a foolproof way or getting credentials for
any site at all by changing the DNS servers.
And if you configure the DNS servers in a router or on a PC somewhere or
on a network somewhere, you will be able to give them your own DNS servers.
And your own DNS servers will point the users in very specific directions.
They will point them to the cloned websites that you will clone, and
that you will host on your Apache web server.
And once they type their credentials in, they will be yours for
the taking, which can be extremely painful.
So let's say they make a query to a website,
they try to login, login will fail of course.
But you will get their credentials.
And as soon as you get their credentials, you can redirect traffic elsewhere, or
something like that, to a legit page.
There are limitless options here.
There is lot of things which you can do, that people tend to do in real life,
and lot of accounts get stolen this way.
However, DNS attacks, and all of that, we will do a little bit later.
For the time being, I just want to show you how you can control, how you can
clone a MAC, clone a wireless access point and redirect all traffic to yourself.
And there with have a good measure of control over it.
Anyway we're gonna be using one of Aircrack's tools that is Airbase.
I have the command listed down below.
Here let me just zoom it in.
So we're gonna need air base, which will be our tool use for cloning.
And down below I have air play- NG.
We have used that before for DL authentication.
Anyway, let's just go ahead and proceed with this.
The first thing that we need to do, of course,
is we'll scan to see where we are,
what's in our environment,
what sort of Mac addresses do we have,
what sort of access points do we have, and
in order to do that, we need monitoring mode,
as always, so I have config, wlp2s0 down
iwconfig wlp2s0 mode monitor airmon-ng
check wlp2s0, kill network manager,
we'll do that one first, 4734.
And then I need to kill, ooh, I have dhcclients.
Need to kill that, too, 30664, okay.
That one died already.
Let's see, 11, 2,8,9, excellent.
So let's perform a check now, okay I'm gonna leave these running
I'm pretty sure that they won't interfere.
Now the commands that I've typed in now I'm not gonna
explain them in detail they are explained in the previous tutorials.
Now we're gonna go ahead and do some scanning so,
airodump-ng and just oops, [NOISE] airodump-ng vlp2s0,
press enter and there we go there's a scan in progress.
I'm gonna wait, I'm not gonna hold the scan here.
This is my wireless access point something,
as before it's pretty strong here.
I'm gonna have to move it to the next room or
something like that in order to get a bit of a better signal.
I'm gonna connect a device to and down below we're gonna see a jump.
That doesn't really matter.
That's not what we are after.
We just need to clone it, but down below you have all of these
authenticated clients to the stations, and it zoomed this out to show them all.
There's quite a bit of them.
And there we go.
They seem to be authenticated.
I'm pretty sure this time that my device is one of these, doesn't really matter.
I just wanted to connect it.
Anyway, now that we have all this information from the scan,
we're going to go ahead and take the Mac address, just go ahead and
copy it, and type in the following.
Air, okay, let's just clear the screen.
Wait, I can't clear the screen, I need the information.
Let me just zoom it in.
So, air base dash NG
space dash A mac address base to mac address.
A good idea is to copy paste the mac addresses so
you ensure that you are not making any mistakes so whatsoever.
You need ESSID.
I'm pretty sure that you don't need to use quotation marks, but
if it's like a two part or something like that, then you will need to use
the quotation marks to make sure that the string is loaded properly.
Then we need a channel, of course.
What will be the channel?
Channel six, for those of you who have enabled your monitor mode,
via airmond dash NG, start VLP2S0.
It will create a virtual interface, which is mon zero.
I didn't do that, so I'm just gonna use VLP2S0, like this.
Press enter, and now that I have my fake wireless access point running.
I am going to deauthenticate pretty much everybody on the real
access point with the ESSID something.
Now, once I deauthenticate them, if they attempt to automatically reconnect,
they will all connect automatically back, to me.
For that I'm gonna need airplay dash NG dash 00A, and then this Mac address here.
This is simply the Mac address off the real wireless access point.
The one that we are faking here anyway, why don't we just go ahead and
press enter.
Now I'm sending the de-authentication packets and
you see immediately there is a client being re-associated with me.
I'm gonna go ahead and stop the de authentication packets but
I will leave this running.
And you see it says re-associated, unencrypted to ESSID, Something.
Now what we can do with this traffic, how can we.
I'm not gonna show you how to modify it now.
I've showed that in the part for fun, where you can do all sorts of trickery,
but we will do more serious stuff as well.
However, now, I would like to show you how you can actually monitor this traffic and
what you can extract, what sort of information can you extract from it.
Anyway, I bid you all farewell, and I hope to see you all in the next tutorial.