Showing posts with label Wireless hacking. Show all posts
Showing posts with label Wireless hacking. Show all posts
WLAN Security Megaprimer
Download The Latest Wifi Hacking Tutorials
By Vivek Ramachandran
These Are The Best Wifi Hacking Tutorials
According To The Members of Starthack.com
Download It Here :
Hack Wireless With Backtrack
Introduction
With the popularity of wireless networks and mobile computing, an overall understanding of common security issues has become not only relevant, but very necessary for both home/SOHO users and IT professionals alike. This article is aimed at illustrating current security flaws in WEP/WPA/WPA2.Successfully cracking a wireless network assumes some basic familiarity with networking principles and terminology, as well as working with command-line tools. A basic familiarity with Linux can be helpful as well.
Disclaimer: Attempting to access a network other than your own, or one you have permission to use is illegal insome U.S. jurisdictions. Speed Guide, Inc. are not to be held liable for any damages resulting from the use or misuse of the information in this article.
To successfully crack WEP/WPA, you first need to be able to set your wireless network card in “monitor” mode to passively capture packets without being associated with a network. This NIC mode is driver-dependent, and only a relatively small number of network cards support this mode under Windows.
One of the best free utilities for monitoring wireless traffic and cracking WEP/WPA-PSK keys is the aircrack-ngsuite, which we will use throughout this article. It has both Linux and Windows versions (provided your network card is supported under Windows). The aircrack-ng site has a comprehensive list of supported network cards available here: NIC chipset compatability list.
If your network card is not supported under Windows, one can use a free Linux Live CD to boot the system. BackTrack 3 is probably the most commonly used distribution, since it runs from a Live CD, and has aircrack-ng and a number of related tools already installed.
For this article, I am using aircrack-ng version 1.0 on a Linux partition (Fedora Core 10, 2.6 32-bit kernel) on my Sony Vaio SZ-680 laptop, using the built-in Intel 4965agn network card. If you’re using the BackTrack 3 CD aircrack-ng is already installed, with my version of linux it was as simple as finding it with:
Code:
yum search aircrack-ng
yum install aircrack-ngThe aircrack-ng suite is a collection of command-line programs aimed at WEP and WPA-PSK key cracking. The ones we will be using are:
airmon-ng – script used for switching the wireless network card to monitor mode
airodump-ng – for WLAN monitoring and capturing network packets
aireplay-ng – used to generate additional traffic on the wireless network
aircrack-ng – used to recover the WEP key, or launch a dictionary attack on WPA-PSK using the captured data.
airodump-ng – for WLAN monitoring and capturing network packets
aireplay-ng – used to generate additional traffic on the wireless network
aircrack-ng – used to recover the WEP key, or launch a dictionary attack on WPA-PSK using the captured data.
1. Setup (airmon-ng)
As mentioned above, to capture network traffic wihtout being associated with an access point, we need to set the wireless network card in monitor mode. To do that under linux, in a terminal window (logged in as root), type:
iwconfig (to find all wireless network interfaces and their status)
airmon-ng start wlan0 (to set in monitor mode, you may have to substitute wlan0 for your own interface name)
airmon-ng start wlan0 (to set in monitor mode, you may have to substitute wlan0 for your own interface name)
Note: You can use the su command to switch to a root account.
Other related Linux commands:
ifconfig (to list available network interfaces, my network card is listed as wlan0)
ifconfig wlan0 down (to stop the specified network card)
ifconfig wlan0 hw ether 00:11:22:33:44:55 (change the MAC address of a NIC – can even simulate the MAC of an associated client. NIC should be stopped before chaning MAC address)
iwconfig wlan0 mode monitor (to set the network card in monitor mode)
ifconfig wlan0 up (to start the network card)
iwconfig – similar to ifconfig, but dedicated to the wireless interfaces.
ifconfig wlan0 down (to stop the specified network card)
ifconfig wlan0 hw ether 00:11:22:33:44:55 (change the MAC address of a NIC – can even simulate the MAC of an associated client. NIC should be stopped before chaning MAC address)
iwconfig wlan0 mode monitor (to set the network card in monitor mode)
ifconfig wlan0 up (to start the network card)
iwconfig – similar to ifconfig, but dedicated to the wireless interfaces.
2. Recon Stage (airodump-ng)
This step assumes you’ve already set your wireless network interface in monitor mode. It can be checked by executing the iwconfig command. Next step is finding available wireless networks, and choosing your target:
airodump-ng mon0 – monitors all channels, listing available access points and associated clients within range. It is best to select a target network with strong signal (PWR column), more traffic (Beacons/Data columns) and associated clients (listed below all access points). Once you’ve selected a target, note its Channel and BSSID (MAC address). Also note any STATION associated with the same BSSID (client MAC addresses).
running airodump-ng displays all wireless access points and associated clients in range, as well as MAC addresses, SSIDs, signal levels and other information about them.
WEP is much easier to crack than WPA-PSK, as it only requires data capturing (between 20k and 40k packets), while WPA-PSK needs a dictionary attack on a captured handshake between the access point and an associated client which may or may not work.
3. Capture Data (airodump-ng)
To capture data into a file, we use the airodump-ng tool again, with some additional switches to target a specific AP and channel. Most importantly, you should restrict monitoring to a single channel to speed up data collection, otherwise the wireless card has to alternate between all channels. Assuming our wireless card is mon0, and we want to capture packets on channel 6 into a text file called data:
airodump-ng -c 6 bssid 00:0F:CC:7D:5A:74 -w data mon0 (-c6 switch would capture data on channel 6, bssid 00:0F:CC:7D:5A:74 is the MAC address of our target access point, -w data specifies that we want to save captured packets into a file called “data” in the current directory, mon0 is our wireless network adapter)
Running airodump-ng on a single channel targeting a specific access point
Notes:
Notes:
You typically need between 20,000 and 40,000 data packets to successfully recover a WEP key.
One can also use the “–ivs” switch with the airodump-ng command to capture only IVs, instead of whole packets, reducing the required disk space. However, this switch can only be used if targeting a WEP network, and renders some types of attacks useless.
4. Increase Traffic (aireplay-ng) – optional step for WEP cracking
An active network can usually be penetrated within a few minutes. However, slow networks can take hours, even days to collect enough data for recovering the WEPkey.
This optional step allows a compatible network interface to inject/generate packets to increase traffic on the wireless network, therefore greatly reducing the time required for capturing data. The aireplay-ng command should be executed in a separate terminal window, concurrent to airodump-ng. It requires a compatible network card and driver that allows for injection mode.
Assuming your network card is capable of injecting packets, in a separate terminal window try:
aireplay-ng -3 -b 00:0F:CC:7D:5A:74 -h 00:14:A5:2F:A7E -x 50 wlan0
-3 –> this specifies the type of attack, in our case ARP-request replay
-b .. –> MAC address of access point
-h .. –> MAC address of associated client from airodump
-x 50 –> limit to sending 50 packets per second
wlan0 –> our wireless network interface
-3 –> this specifies the type of attack, in our case ARP-request replay
-b .. –> MAC address of access point
-h .. –> MAC address of associated client from airodump
-x 50 –> limit to sending 50 packets per second
wlan0 –> our wireless network interface
aireplay-ng allows for injecting packets to greatly reduce the time required to recover a WEP key
Notes:
To test whether your nic is able to inject packets, you may want to try: aireplay-ng -9 wlan0. You may also want to read the information available -here-.
To see all available replay attacks, type just: aireplay-ng
To see all available replay attacks, type just: aireplay-ng
5. Crack WEP (aircrack-ng)
WEP cracking is a simple process, only requiring collection of enough data to then extract the key and connect to the network. You can crack the WEP key while capturing data. In fact, aircrack-ng will re-attempt cracking the key after every 5000 packets.
To attempt recovering the WEP key, in a new terminal window, type:
aircrack-ng data*.cap (assuming your capture file is called data…cap, and is located in the same directory)
aircrack-ng can successfully recover a WEP key with 10-40k captured packets. The retreived key is in hexadecimal, and can be entered directly into a wireless client omitting the “:” separators
Notes:
If your data file contains ivs/packets from different access points, you may be presented with a list to choose which one to recover.
Usually, between 20k and 40k packets are needed to successfully crack a WEP key. It may sometimes work with as few as 10,000 packets with short keys.
Notes:
If your data file contains ivs/packets from different access points, you may be presented with a list to choose which one to recover.
Usually, between 20k and 40k packets are needed to successfully crack a WEP key. It may sometimes work with as few as 10,000 packets with short keys.
6. Crack WPA or WPA2 PSK (aircrack-ng)
WPA, unlike WEP rotates the network key on a per-packet basis, rendering the WEP method of penetration useless. Cracking a WPA-PSK/WPA2-PSK key requires a dictionary attack on a handshake between an access point and a client. What this means is, you need to wait until a wireless client associates with the network (or deassociate an already connected client so they automatically reconnect). All that needs to be captured is the initial “four-way-handshake” association between the access point and a client. Essentially, the weakness of WPA-PSK comes down to the passphrase. A short/weak passphrase makes it vulnerable to dictionary attacks.
To successfully crack a WPA-PSK network, you first need a capture file containing handshake data. This can be obtained using the same technique as with WEP in step 3 above, using airodump-ng.
You may also try to deauthenticate an associated client to speed up this process of capturing a handshake, using:
Code:
aireplay-ng --deauth 3 -a MAC_AP -c MAC_Client mon0
(where MAC_IP is the MAC address of the access point, MAC_Client is the MAC address of an associated client, mon0 is your wireless NIC).
Once you have captured a four-way handshake, you also need a large/relevant dictinary file (commonly known as wordlists) with common passphrases. See related links below for some wordlist links.
You can, then execute the following command in a linux terminal window (assuming both the dictionary file and captured data file are in the same directory):
aircrack-ng -w wordlist capture_file (where wordlist is your dictionary file, and capture_file is a .cap file with a valid WPA handshake)
Additional Notes:
Cracking WPA-PSK and WPA2-PSK only needs 4 packets of data from the network (a handshake). After that, an offline dictionary attack on that handshake takes much longer, and will only succeed with weak passphrases and good dictionary files. A good size wordlist should be 20+ Megabytes in size, cracking a strong passphrase will take hours and is CPU intensive.
Cracking WPA/WPA2 usually takes many hours, testing tens of millions of possible keys for the chance to stumble on a combination of common numerals or dictionary words. Still, a weak/short/common/human-readable passphrase can be broken within a few minutes using an offline dictionary attack. My record time was less than a minute on an all-caps 10-character passphrase using common words with less than 11,000 tested keys! A modern laptop can process over 10 Million possible keys in less than 3 hours.
WPA hashes the network key using the wireless access point’s SSID as salt. This prevents the statistical key-grabbing techniques that broke WEP, and makes hash precomputation more dificult because the specific SSID needs to be added as salt for the hash. There are some tools like coWPAtty that can use precomputed hash files to speed up dictionary attacks. Those hash files can be very effective (sicne they’re much less CPU intensive and therefore faster), but quite big in size. The Church of WiFi has computed hash tables for the 1000 most common SSIDs against a million common passphrases that are 7Gb and 33Gb in size…
What is SSL VPN Technology & How it Works: Basics of UTM & Corporate Security
It was an enjoyable session with emphasis on security awareness and discussing network security as a whole, and how we can protect them by deploying UTM devices and configuring them for maximum security. You can also read my previous posts on Unified Threat management Systems if you haven't read them already -
Corporate Security Issues and countering them using Unified Threat Management Systems and SSL VPNA while back I gave training on UTM devices and Security Issues with Amarjit Singh atTulip Telecom , here are the slides of the session. It was an enjoyable session with emphasis on security awareness and discussing network security as a whole, and how we can protect them by deploying UTM devices and configuring them for maximum security. You can also read my previous posts on Unified Threat management Systems if you haven't read them already -
Corporate Security Issues and countering them using Unified Threat Management Systems and SSL VPN
- Unified Threat Management Systems Explained
- Unified Threat Management Systems - Single User vs Multi User
- Comparison of Unified Threat Management Products
Corporate Security Issues and countering them using Unified Threat Management Systems and SSL VPNA while back I gave training on UTM devices and Security Issues with Amarjit Singh atTulip Telecom , here are the slides of the session. It was an enjoyable session with emphasis on security awareness and discussing network security as a whole, and how we can protect them by deploying UTM devices and configuring them for maximum security. You can also read my previous posts on Unified Threat management Systems if you haven't read them already -
- Unified Threat Management Systems Explained
- Unified Threat Management Systems - Single User vs Multi User
- Comparison of Unified Threat Management Products
Corporate Security Issues and countering them using Unified Threat Management Systems and SSL VPN
Corporate Security Issues and countering them using Unified Threat Management Systems and SSL VPN
View more presentations from Rishabh Dangwal
Beware of New Electronic Technology: Thieves have also got tech savvy now
A real incident, please check your mobile and GPS, if you have it in your car. Thieves have also got tech savvy now.
GPS
A couple of weeks ago a friend told me that someone she knew had their car broken into while they were at a football game. Their car was parked on the green which was adjacent to the football stadium and specially allotted to football fans. Things stolen from the car included a garage door remote control, some money and a GPS which had been prominently mounted on the dashboard.
When the victims got home, they found that their house had been ransacked and just about everything worth anything had been stolen. The thieves had used the GPS to guide them to the house. They then used the garage remote control to open the garage door and gain entry to the house. The thieves knew the owners were at the football game, they knew what time the game was scheduled to finish and so they knew how much time they had to clean out the house. It would appear that they had brought a truck to empty the house of its contents.
Something to consider if you have a GPS - don't put your home address in it. Put a nearby address (like a store or gas station) so you can still find your way home if you need to, but no one else would know where you live if your GPS were stolen.
MOBILE PHONES
I never thought of this.......
This lady has now changed her habit of how she lists her names on her mobile phone after her handbag was stolen. Her handbag, which contained her cell phone, credit card, wallet... Etc...was stolen. 20 minutes later when she called her hubby, from a pay phone telling him what had happened, hubby says 'I received your text asking about our Pin number and I've replied a little while ago.' When they rushed down to the bank, the bank staff told them all the money was already withdrawn. The thief had actually used the stolen cell phone to text 'hubby' in the contact list and got hold of the pin number. Within 20 minutes he had withdrawn all the money from their bank account.
Moral of the lesson:Do not disclose the relationship between you and the people in your contact list.
Avoid using names like Home, Honey, Hubby, Sweetheart, Dad, Mom, etc....
And very importantly, when sensitive info is being asked through texts, CONFIRM by calling back.
Also, when you're being text by friends or family to meet them somewhere, be sure to call back to confirm that the message came from them. If you don't reach them, be very careful about going places to meet 'family and friends' who text you.
PLEASE PASS THIS ON
I never thought about the above!
As of now, I no longer have 'home' listed on my cell phone.
This gives us something to think about with all our new electronic technology.
How to boost your WiFi signal with a beer can
I love a good hack, especially one that requires me to throw back a cold one before hand (or during). This simple wifi boost has actually been shown to increase signal strength by at least 2 to 4 bars. And, well, I will drink to that.
These instructions came to us via The Chive and we think they are most definitely worth checking out. But here is the most important question: what kind of beer will you use?
For this project you are going to need scissors, a utility knife, some adhesive putty and an empty beer can. More than one empty beer can is acceptable but don’t kid yourself, the router only needs the one.
The first step is to wash out your empty beer can, unless of course said beer is a can of Pabst Blue Ribbon. If it is PBR, promptly go drink a better beer. You really should be ashamed of yourself.
Once the can has dried, you will want to remove it’s pull tab.
Only perform this next step if you have not been drinking. Using the utility knife, saw off the bottom of the can. Chances are your can will not have a red dotted line. If you see one, put down the knife…you’ve had too much beer.
You’ll notice in the above step that the can’s pull tab has returned. Clearly, there are only two possible reasons for this. One, you are really drunk and you never removed the tab in the first place. Or–the more likely answer–beer cans can regenerate themselves.
It’s the home stretch! You just need to attach your modded beer can to the wifi router. Hopefully no other parts of the can have actually grown back. You now have beer-fi!
So, what kind of beer did you use?
Ubertooth One : A Bluetooth Network Hacking Tool
Ubertooth One is a cheap, open-source Bluetooth network sniffer. Unlike Wi-Fi, which has had a wide range of free network monitoring tools for years, Bluetooth has remained pretty closed. Michael Ossman is about to change this, with his Ubertooth Kickstarter project.
The Ubertooth One is a USB plug with an antenna, and a ARM Cortex-M3 processor-based board in-between. Plug it into your computer and you can use it with various wireless monitoring tools like Kismet. The Ubertooth allows you to use Bluetooth in monitoring mode. This “promiscuous” mode makes the radio pass everything that it picks up onto the host computer. Normally, wireless receivers will ignore anything not addressed to them. In promiscuous mode, you can sniff and gather data meant for other devices.
These tools can be used for testing network security, or for hacking. Kismet, for example (and derivatives like the Mac OS X version KisMac) can be used to crack Wi-Fi networks’ passwords.
Until now, Bluetooth monitoring hardware would cost upward of $1,000. Ossman’s device will cost just $100 and, because both the software and hardware are open-source, you can build your own.
Ossman demonstrated the Ubertooth One at the ShmooCon hackers convention on Friday. Future software updates will enable Bluetooth injection and expanded monitoring modes.
More Info:
Project Ubertooth [Sourceforge]
Project Ubertooth [Sourceforge]
Ubertooth One on Kickstarter [Michael Ossman’s blog
PacketFence – Open Source Network Access Control (NAC) System
PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) system.
Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices, integration with the Snort IDS and the Nessus vulnerability scanner; PacketFence can be used to effectively secure networks – from small to very large heterogeneous networks.
What you can do with PacketFence :
- Block iPods wireless access
- Forbid rogue access points
- Perform compliance checks
- Eliminate Peer-to-Peer traffic
- Provide guest access
- Simplify VLAN management
Download: packetfence-2.1.0.tar.gz
Save this Page
