1 1 00:00:00,230 --> 00:00:02,900 In this lesson, I'm going to demonstrate how to conduct 2 2 00:00:02,900 --> 00:00:04,750 an initialization vector attack 3 3 00:00:04,750 --> 00:00:07,020 on a WEP-protected access point. 4 4 00:00:07,020 --> 00:00:09,600 As I said before, WEP is extremely insecure 5 5 00:00:09,600 --> 00:00:12,930 because it only uses a 24-bit initialization vector. 6 6 00:00:12,930 --> 00:00:14,810 Regardless of what key you choose, 7 7 00:00:14,810 --> 00:00:17,840 this attack is going to work every single time. 8 8 00:00:17,840 --> 00:00:19,220 This is the reason that I say 9 9 00:00:19,220 --> 00:00:21,810 you never ever want to use WEP in your networks. 10 10 00:00:21,810 --> 00:00:24,400 If you find a network using WEP in your organization, 11 11 00:00:24,400 --> 00:00:27,990 you should immediately work to update it to WPA2, instead. 12 12 00:00:27,990 --> 00:00:28,900 Let's jump into the lab 13 13 00:00:28,900 --> 00:00:30,910 and I'll show you exactly how this works. 14 14 00:00:30,910 --> 00:00:31,990 So, the first thing we're going to do 15 15 00:00:31,990 --> 00:00:35,240 is we're going to start with airodump-ng 16 16 00:00:35,240 --> 00:00:37,890 and then the card that we have which is wlan0mon 17 17 00:00:38,950 --> 00:00:40,420 and notice it's starting to scan 18 18 00:00:40,420 --> 00:00:42,830 for that particular network that we're looking for. 19 19 00:00:42,830 --> 00:00:44,580 In our case, we already found it. 20 20 00:00:44,580 --> 00:00:48,410 It is WirelessHacking, this WEP network right here. 21 21 00:00:48,410 --> 00:00:53,410 And this is the BSSID or the MAC address for that network. 22 22 00:00:53,660 --> 00:00:55,360 So, for us to attack it, 23 23 00:00:55,360 --> 00:00:58,120 we are going to use airodump-ng again 24 24 00:00:58,120 --> 00:01:02,480 and in this case, we are going to specifically tell it 25 25 00:01:02,480 --> 00:01:06,200 which channel we want to go after, which is channel 1 26 26 00:01:06,200 --> 00:01:08,470 right here from the WirelessHacking network. 27 27 00:01:08,470 --> 00:01:10,290 We want to go after the BSSID 28 28 00:01:11,340 --> 00:01:13,780 that was provided for that network. 29 29 00:01:13,780 --> 00:01:18,300 And we want to go ahead and write that data to a file 30 30 00:01:18,300 --> 00:01:20,877 which is going to be WirelessHackingDump 31 31 00:01:23,180 --> 00:01:24,900 it's what we're going to call that file. 32 32 00:01:24,900 --> 00:01:26,630 And then, we're going to give it the card itself 33 33 00:01:26,630 --> 00:01:29,800 which is wlan0mon and hit Enter 34 34 00:01:29,800 --> 00:01:32,640 and off it goes starting to scan the network 35 35 00:01:32,640 --> 00:01:35,370 which is helpful but we're not quite there yet. 36 36 00:01:35,370 --> 00:01:37,230 Notice, the data packets are climbing 37 37 00:01:37,230 --> 00:01:40,540 but we haven't yet associated ourself to that network 38 38 00:01:40,540 --> 00:01:42,930 to be able to start doing things like packet injection 39 39 00:01:42,930 --> 00:01:45,210 and capturing those initialization vectors. 40 40 00:01:45,210 --> 00:01:47,470 So, I'm going to go ahead and put this up here 41 41 00:01:47,470 --> 00:01:48,990 to make some extra room 42 42 00:01:50,470 --> 00:01:52,460 and we'll just bring that right across the top 43 43 00:01:52,460 --> 00:01:53,920 and let it continue to run. 44 44 00:01:53,920 --> 00:01:56,500 We're going to open up a new terminal 45 45 00:01:56,500 --> 00:01:58,810 and I'm going to bring that down here to the bottom. 46 46 00:01:58,810 --> 00:02:00,840 Now, in the new terminal, 47 47 00:02:00,840 --> 00:02:04,320 what I need to do is I need to start doing 48 48 00:02:04,320 --> 00:02:07,900 authentication to the network using fake authentication, 49 49 00:02:07,900 --> 00:02:10,520 which is our first step in the hack. 50 50 00:02:10,520 --> 00:02:12,630 So, that first step in the hack 51 51 00:02:12,630 --> 00:02:16,780 is that we are going to do a program called aireplay 52 52 00:02:16,780 --> 00:02:20,000 and in aireplay-ng, 53 53 00:02:21,250 --> 00:02:23,560 we are going to use fakeauth as our command, 54 54 00:02:23,560 --> 00:02:25,720 0 for infinite attempts, 55 55 00:02:25,720 --> 00:02:29,260 dash a, and the MAC address that we're going after, 56 56 00:02:29,260 --> 00:02:31,763 which again, we still have pasted right there. 57 57 00:02:32,660 --> 00:02:35,240 And then, we're going to use the MAC address 58 58 00:02:35,240 --> 00:02:36,600 that we're coming from 59 59 00:02:37,500 --> 00:02:39,230 which we have to find ourself 60 60 00:02:39,230 --> 00:02:42,280 so we are going to open up another terminal. 61 61 00:02:42,280 --> 00:02:44,290 You can see how you start getting quite a few terminals 62 62 00:02:44,290 --> 00:02:47,010 and just type in something like ifconfig. 63 63 00:02:47,010 --> 00:02:47,940 When you do that, 64 64 00:02:47,940 --> 00:02:50,350 you're going to get the MAC address for wlan0mon 65 65 00:02:51,269 --> 00:02:56,160 and the first 12 digits here is that MAC address 66 66 00:02:56,160 --> 00:02:57,370 for our network card. 67 67 00:02:57,370 --> 00:02:58,720 So, I'm just going to copy that 68 68 00:02:59,910 --> 00:03:01,890 and then, we can paste that in. 69 69 00:03:01,890 --> 00:03:05,480 Now, this uses dashes but for this particular command, 70 70 00:03:05,480 --> 00:03:06,610 you have to use colons 71 71 00:03:06,610 --> 00:03:10,960 so, I'm going to arrow through and change those to colons 72 72 00:03:10,960 --> 00:03:11,890 as you can see 73 73 00:03:13,240 --> 00:03:14,690 and the command's not done yet 74 74 00:03:14,690 --> 00:03:16,770 cause what's the one thing we haven't told it? 75 75 00:03:16,770 --> 00:03:18,930 We haven't told it which card to use. 76 76 00:03:18,930 --> 00:03:20,813 So, we have to use wlan0mon. 77 77 00:03:22,480 --> 00:03:24,440 And then, we will hit Enter 78 78 00:03:24,440 --> 00:03:27,290 and off it goes sending a authentication. 79 79 00:03:27,290 --> 00:03:29,720 We now have an authentication made with this network. 80 80 00:03:29,720 --> 00:03:32,400 So, we can move into the second phase of our attack 81 81 00:03:32,400 --> 00:03:35,690 which is going to be the packet injection. 82 82 00:03:35,690 --> 00:03:37,490 So, for the packet injection, 83 83 00:03:37,490 --> 00:03:39,780 we are going to still use the aireplay command 84 84 00:03:39,780 --> 00:03:41,170 and most of it is going to be the same. 85 85 00:03:41,170 --> 00:03:42,700 So, what I'm going to do instead of typing it all 86 86 00:03:42,700 --> 00:03:43,950 is hit the up arrow 87 87 00:03:43,950 --> 00:03:46,510 which will bring back the last command I used. 88 88 00:03:46,510 --> 00:03:47,700 The big differences here is 89 89 00:03:47,700 --> 00:03:50,240 we are not going to use fake authentication anymore. 90 90 00:03:50,240 --> 00:03:53,180 Instead, we want to use an arpreplay 91 91 00:03:53,180 --> 00:03:57,490 so that we can create additional traffic on this network. 92 92 00:03:57,490 --> 00:03:59,100 Instead of a for the access point, 93 93 00:03:59,100 --> 00:04:01,110 we're going to use b for the access point, 94 94 00:04:01,110 --> 00:04:03,010 which tells us that that's the base station. 95 95 00:04:03,010 --> 00:04:04,860 We're still going to use the card that we're coming from 96 96 00:04:04,860 --> 00:04:07,520 and the network card wlan0mon. 97 97 00:04:07,520 --> 00:04:09,630 When we hit Enter, off it goes 98 98 00:04:09,630 --> 00:04:13,120 and notice that we have a couple of ARP packets here 99 99 00:04:13,120 --> 00:04:14,990 and our data is going to start going up. 100 100 00:04:14,990 --> 00:04:16,190 We have a lot of frame loss. 101 101 00:04:16,190 --> 00:04:17,680 Once you have a couple of ARP requests 102 102 00:04:17,680 --> 00:04:18,910 that have been successful, 103 103 00:04:18,910 --> 00:04:21,133 you can hit Control + C and stop that. 104 104 00:04:22,230 --> 00:04:23,450 Now, with this attack, 105 105 00:04:23,450 --> 00:04:26,020 it does help if this is a busy network. 106 106 00:04:26,020 --> 00:04:27,430 Right now as we're doing this, 107 107 00:04:27,430 --> 00:04:29,470 you can see the data packets are going up. 108 108 00:04:29,470 --> 00:04:31,050 The reason those data packets are going up 109 109 00:04:31,050 --> 00:04:34,070 is because I'm streaming YouTube on the device, 110 110 00:04:34,070 --> 00:04:35,373 this base station here, 111 111 00:04:36,560 --> 00:04:38,610 this client which is my iPhone 112 112 00:04:38,610 --> 00:04:42,130 is talking to this access point and streaming YouTube 113 113 00:04:42,130 --> 00:04:44,390 which is collecting a lot of data. 114 114 00:04:44,390 --> 00:04:46,960 Now, the next thing you want to do is start cracking 115 115 00:04:46,960 --> 00:04:49,570 and every 5,000 data packets that go up, 116 116 00:04:49,570 --> 00:04:52,030 it will start trying to do another attempt 117 117 00:04:52,030 --> 00:04:53,190 and it's really easy. 118 118 00:04:53,190 --> 00:04:55,550 You just use aircrack-ng 119 119 00:04:55,550 --> 00:04:58,433 and then the filename of what you're going to be using. 120 120 00:05:00,190 --> 00:05:01,740 So, let me clear the screen here 121 121 00:05:03,510 --> 00:05:05,850 and the file that I'm going to be using is 122 122 00:05:05,850 --> 00:05:09,060 WirelessHackingDump.02.cap. 123 123 00:05:09,060 --> 00:05:10,160 And the reason it's the second one 124 124 00:05:10,160 --> 00:05:12,610 is because I've run this attempt once before showing you. 125 125 00:05:12,610 --> 00:05:14,500 So, all we're going to use is aircrack-ng 126 126 00:05:15,440 --> 00:05:19,320 and then the filename that you're going after and hit Enter 127 127 00:05:19,320 --> 00:05:21,540 and off it goes, starting to crack away. 128 128 00:05:21,540 --> 00:05:22,920 Right now, it already has 129 129 00:05:22,920 --> 00:05:25,790 14,000 initialization vectors collected 130 130 00:05:25,790 --> 00:05:27,450 and you could see that here from that data 131 131 00:05:27,450 --> 00:05:28,770 but that wasn't enough. 132 132 00:05:28,770 --> 00:05:30,740 So, when this hits 15,000, 133 133 00:05:30,740 --> 00:05:32,380 you're going to see this kick off again 134 134 00:05:32,380 --> 00:05:33,780 without me doing anything 135 135 00:05:33,780 --> 00:05:36,410 and we'll see if we can crack that key. 136 136 00:05:36,410 --> 00:05:37,590 So, here it goes again. 137 137 00:05:37,590 --> 00:05:40,500 It's going off and testing the different keys 138 138 00:05:40,500 --> 00:05:43,620 and it didn't find it so it'll try again at 20,000. 139 139 00:05:43,620 --> 00:05:45,310 Generally, it's going to find it 140 140 00:05:45,310 --> 00:05:48,500 somewhere between 10,000 and 25,000. 141 141 00:05:48,500 --> 00:05:51,080 It really depends on where that particular key is 142 142 00:05:51,080 --> 00:05:52,560 inside the key space, 143 143 00:05:52,560 --> 00:05:55,250 depending on what that hexadecimal password was 144 144 00:05:55,250 --> 00:05:56,083 that we used. 145 145 00:06:01,730 --> 00:06:04,040 So, again, you can see the data packets climbing up 146 146 00:06:04,040 --> 00:06:06,120 as I'm streaming different YouTube videos. 147 147 00:06:06,120 --> 00:06:07,450 Every time I start another video, 148 148 00:06:07,450 --> 00:06:09,230 it starts downloading all that data. 149 149 00:06:09,230 --> 00:06:12,350 All those frames have an initialization vector in there 150 150 00:06:12,350 --> 00:06:13,630 and they're able to be captured 151 151 00:06:13,630 --> 00:06:15,880 so that we can start seeing that information. 152 152 00:06:15,880 --> 00:06:17,220 So now, we have over 20,000. 153 153 00:06:17,220 --> 00:06:18,600 It's going to try again. 154 154 00:06:18,600 --> 00:06:19,433 And there it is. 155 155 00:06:19,433 --> 00:06:24,350 It found our key 17:25:83:AE:FA. 156 156 00:06:24,350 --> 00:06:26,280 So, we now have a key. 157 157 00:06:26,280 --> 00:06:27,550 What are we going to do with it? 158 158 00:06:27,550 --> 00:06:29,260 Well, the next thing we want to do 159 159 00:06:29,260 --> 00:06:31,280 is we want to see if that key actually works 160 160 00:06:31,280 --> 00:06:33,300 and be able to get onto a network. 161 161 00:06:33,300 --> 00:06:34,460 We can do that through Kali 162 162 00:06:34,460 --> 00:06:36,100 or we can do it through your Windows machine 163 163 00:06:36,100 --> 00:06:37,590 or your Mac machine. 164 164 00:06:37,590 --> 00:06:39,890 It depends on where your ultimate goal is. 165 165 00:06:39,890 --> 00:06:41,400 For this example, I'm going to show you 166 166 00:06:41,400 --> 00:06:45,440 how to use it inside your Macintosh machine. 167 167 00:06:45,440 --> 00:06:48,620 You can do the same thing in Windows and again in Kali. 168 168 00:06:48,620 --> 00:06:52,130 So, if we can cancel this capturing at this point, 169 169 00:06:52,130 --> 00:06:53,750 so we hit Control + C, 170 170 00:06:53,750 --> 00:06:56,500 and we're going to switch back to our client machine, 171 171 00:06:56,500 --> 00:06:58,400 in my case Macintosh, 172 172 00:06:58,400 --> 00:07:01,390 so, now that we're back on our Windows 173 173 00:07:01,390 --> 00:07:02,730 or our Macintosh machine, 174 174 00:07:02,730 --> 00:07:04,210 you'll connect to that wireless network, 175 175 00:07:04,210 --> 00:07:05,610 just like you normally do. 176 176 00:07:05,610 --> 00:07:07,630 So, we're going to go down to WirelessHacking 177 177 00:07:07,630 --> 00:07:10,100 and it's going to ask us for the passcode. 178 178 00:07:10,100 --> 00:07:14,463 My passcode that we just cracked was 17:25:83:AE:FA. 179 179 00:07:16,760 --> 00:07:19,520 And if I go ahead and join, 180 180 00:07:19,520 --> 00:07:23,170 we should see if I can pull an IP address from this network. 181 181 00:07:23,170 --> 00:07:24,540 And if we look at it, 182 182 00:07:24,540 --> 00:07:27,800 you can see here we did pull an IP address from this network 183 183 00:07:27,800 --> 00:07:30,070 and we are connected to that access point 184 184 00:07:30,070 --> 00:07:33,960 starting with c8.a7, that BSSID, 185 185 00:07:33,960 --> 00:07:36,760 which is the one for WirelessHacking. 186 186 00:07:36,760 --> 00:07:40,427 So, our hack did work and it was successful.