-: In this lesson, I'm going to demonstrate how to conduct 2 2
an initialization vector attack 3 3
on a WEP-protected access point. 4 4
As I said before, WEP is extremely insecure 5 5
because it only uses a 24-bit initialization vector. 6 6
Regardless of what key you choose, 7 7
this attack is going to work every single time. 8 8
This is the reason that I say 9 9
you never ever want to use WEP in your networks. 10 10
If you find a network using WEP in your organization, 11 11
you should immediately work to update it to WPA2, instead. 12 12
Let's jump into the lab 13 13
and I'll show you exactly how this works. 14 14
So, the first thing we're going to do 15 15
is we're going to start with airodump-ng 16 16
and then the card that we have which is wlan0mon 17 17
and notice it's starting to scan 18 18
for that particular network that we're looking for. 19 19
In our case, we already found it. 20 20
It is WirelessHacking, this WEP network right here. 21 21
And this is the BSSID or the MAC address for that network. 22 22
So, for us to attack it, 23 23
we are going to use airodump-ng again 24 24
and in this case, we are going to specifically tell it 25 25
which channel we want to go after, which is channel 1 26 26
right here from the WirelessHacking network. 27 27
We want to go after the BSSID 28 28
that was provided for that network. 29 29
And we want to go ahead and write that data to a file 30 30
which is going to be WirelessHackingDump 31 31
it's what we're going to call that file. 32 32
And then, we're going to give it the card itself 33 33
which is wlan0mon and hit Enter 34 34
and off it goes starting to scan the network 35 35
which is helpful but we're not quite there yet. 36 36
Notice, the data packets are climbing 37 37
but we haven't yet associated ourself to that network 38 38
to be able to start doing things like packet injection 39 39
and capturing those initialization vectors. 40 40
So, I'm going to go ahead and put this up here 41 41
to make some extra room 42 42
and we'll just bring that right across the top 43 43
and let it continue to run. 44 44
We're going to open up a new terminal 45 45
and I'm going to bring that down here to the bottom. 46 46
Now, in the new terminal, 47 47
what I need to do is I need to start doing 48 48
authentication to the network using fake authentication, 49 49
which is our first step in the hack. 50 50
So, that first step in the hack 51 51
is that we are going to do a program called aireplay 52 52
and in aireplay-ng, 53 53
we are going to use fakeauth as our command, 54 54
0 for infinite attempts, 55 55
dash a, and the MAC address that we're going after, 56 56
which again, we still have pasted right there. 57 57
And then, we're going to use the MAC address 58 58
that we're coming from 59 59
which we have to find ourself 60 60
so we are going to open up another terminal. 61 61
You can see how you start getting quite a few terminals 62 62
and just type in something like ifconfig. 63 63
When you do that, 64 64
you're going to get the MAC address for wlan0mon 65 65
and the first 12 digits here is that MAC address 66 66
for our network card. 67 67
So, I'm just going to copy that 68 68
and then, we can paste that in. 69 69
Now, this uses dashes but for this particular command, 70 70
you have to use colons 71 71
so, I'm going to arrow through and change those to colons 72 72
as you can see 73 73
and the command's not done yet 74 74
cause what's the one thing we haven't told it? 75 75
We haven't told it which card to use. 76 76
So, we have to use wlan0mon. 77 77
And then, we will hit Enter 78 78
and off it goes sending a authentication. 79 79
We now have an authentication made with this network. 80 80
So, we can move into the second phase of our attack 81 81
which is going to be the packet injection. 82 82
So, for the packet injection, 83 83
we are going to still use the aireplay command 84 84
and most of it is going to be the same. 85 85
So, what I'm going to do instead of typing it all 86 86
is hit the up arrow 87 87
which will bring back the last command I used. 88 88
The big differences here is 89 89
we are not going to use fake authentication anymore. 90 90
Instead, we want to use an arpreplay 91 91
so that we can create additional traffic on this network. 92 92
Instead of a for the access point, 93 93
we're going to use b for the access point, 94 94
which tells us that that's the base station. 95 95
We're still going to use the card that we're coming from 96 96
and the network card wlan0mon. 97 97
When we hit Enter, off it goes 98 98
and notice that we have a couple of ARP packets here 99 99
and our data is going to start going up. 100 100
We have a lot of frame loss. 101 101
Once you have a couple of ARP requests 102 102
that have been successful, 103 103
you can hit Control + C and stop that. 104 104
Now, with this attack, 105 105
it does help if this is a busy network. 106 106
Right now as we're doing this, 107 107
you can see the data packets are going up. 108 108
The reason those data packets are going up 109 109
is because I'm streaming YouTube on the device, 110 110
this base station here, 111 111
this client which is my iPhone 112 112
is talking to this access point and streaming YouTube 113 113
which is collecting a lot of data. 114 114
Now, the next thing you want to do is start cracking 115 115
and every 5,000 data packets that go up, 116 116
it will start trying to do another attempt 117 117
and it's really easy. 118 118
You just use aircrack-ng 119 119
and then the filename of what you're going to be using. 120 120
So, let me clear the screen here 121 121
and the file that I'm going to be using is 122 122
WirelessHackingDump.02.cap. 123 123
And the reason it's the second one 124 124
is because I've run this attempt once before showing you. 125 125
So, all we're going to use is aircrack-ng 126 126
and then the filename that you're going after and hit Enter 127 127
and off it goes, starting to crack away. 128 128
Right now, it already has 129 129
14,000 initialization vectors collected 130 130
and you could see that here from that data 131 131
but that wasn't enough. 132 132
So, when this hits 15,000, 133 133
you're going to see this kick off again 134 134
without me doing anything 135 135
and we'll see if we can crack that key. 136 136
So, here it goes again. 137 137
It's going off and testing the different keys 138 138
and it didn't find it so it'll try again at 20,000. 139 139
Generally, it's going to find it 140 140
somewhere between 10,000 and 25,000. 141 141
It really depends on where that particular key is 142 142
inside the key space, 143 143
depending on what that hexadecimal password was 144 144
that we used. 145 145
So, again, you can see the data packets climbing up 146 146
as I'm streaming different YouTube videos. 147 147
Every time I start another video, 148 148
it starts downloading all that data. 149 149
All those frames have an initialization vector in there 150 150
and they're able to be captured 151 151
so that we can start seeing that information. 152 152
So now, we have over 20,000. 153 153
It's going to try again. 154 154
And there it is. 155 155
It found our key 17:25:83:AE:FA. 156 156
So, we now have a key. 157 157
What are we going to do with it? 158 158
Well, the next thing we want to do 159 159
is we want to see if that key actually works 160 160
and be able to get onto a network. 161 161
We can do that through Kali 162 162
or we can do it through your Windows machine 163 163
or your Mac machine. 164 164
It depends on where your ultimate goal is. 165 165
For this example, I'm going to show you 166 166
how to use it inside your Macintosh machine. 167 167
You can do the same thing in Windows and again in Kali. 168 168
So, if we can cancel this capturing at this point, 169 169
so we hit Control + C, 170 170
and we're going to switch back to our client machine, 171 171
in my case Macintosh, 172 172
so, now that we're back on our Windows 173 173
or our Macintosh machine, 174 174
you'll connect to that wireless network, 175 175
just like you normally do. 176 176
So, we're going to go down to WirelessHacking 177 177
and it's going to ask us for the passcode. 178 178
My passcode that we just cracked was 17:25:83:AE:FA. 179 179
And if I go ahead and join, 180 180
we should see if I can pull an IP address from this network. 181 181
And if we look at it, 182 182
you can see here we did pull an IP address from this network 183 183
and we are connected to that access point 184 184
starting with c8.a7, that BSSID, 185 185
which is the one for WirelessHacking. 186 186
So, our hack did work and it was successful.