Setting up the attack: hardware requirements
This is a crash course for the easiest, most streamlined and autonomous WiFi hacking method. I can always do others. However, if you're like me and you're mobile and don't have the convenience of dragging a laptop around or a tiny raspberry pi, the more autonomous you can run this attack, the less suspicious you're going to look, standing around, tapping out long, complicated commands on your phone or Pi. Let's begin!
*Disclaimer: You're responsible for breaking the law, not me. This is a handy skill to have, so don't abuse it.
You’re going to need a couple of prerequisites before you are ready to launch your penetration test.
Start with a wireless adapter that supports monitor mode and packet injection. This will allow you to sniff wireless traffic, capture data packets, see hidden networks, spoof, and manipulate network traffic via packet injection, even if you aren’t connected to that network.
Packet injection is an inalienable part of wireless attacks, which is why you must do your research in selecting the right wireless adapter. This gives the red team in attack position the ability to inject forged de-authentication frames that disconnect a target device’s connection to the wireless network.
Then, as the device attempts to reconnect to the wireless access point during the secured WPA/WPA2 4-way handshake, the reauthentication packets are captured and cracked by the red team, allowing them to authenticate on the wireless network.
You can find a listing of supporting WiFI adapters here.
![[Image: 8d86ad_966324b8c792481ab7072298e02c1b5e~mv2.png]](https://static.wixstatic.com/media/8d86ad_966324b8c792481ab7072298e02c1b5e~mv2.png "[Image: 8d86ad_966324b8c792481ab7072298e02c1b5e~mv2.png]")
However, my WiFi adapter of choice will always be the MK7AC which is available on Amazon on the developer’s website, Hak5.
![[Image: 8d86ad_15536f55a0024186b78781a580a0c537~mv2.png]](https://static.wixstatic.com/media/8d86ad_15536f55a0024186b78781a580a0c537~mv2.png "[Image: 8d86ad_15536f55a0024186b78781a580a0c537~mv2.png]")
You’ll obviously need a PC (preferably a laptop for mobility), but literally any laptop or PC that can run a live version of Kali Linux or your favorite flavor of Linux on a USB thumb drive will do the job. Kali is perfectly equipped with wireless penetration tools.
![[Image: 8d86ad_76c5a9bae7bf4c9bb8064e43115deead~mv2.png]](https://static.wixstatic.com/media/8d86ad_76c5a9bae7bf4c9bb8064e43115deead~mv2.png "[Image: 8d86ad_76c5a9bae7bf4c9bb8064e43115deead~mv2.png]")
Software: choose your poison
For the simplest approach to simulating a quick and effective wireless security audit, I recommend using Wifite2. This is because Wifite2 is a completely autonomous tool and requires little user input, which saves time by minimizing the number of steps taken by a manual approach.
The power behind Wifite2 is that it has over a dozen dependencies working the backend, which is why it cuts like butter through wireless security. Here’s an example of what’s happening behind the scenes:
Open a Linux terminal and run WIfite with the following command to kill any conflicting processes: sudo wifite –kill. Select your wireless interface and start the scanning process. Be sure to only select your wireless access point from the list of available networks to target, for legality purposes.
![[Image: 8d86ad_8d2817ea6c744aed928ed0e8989400c8~mv2.png]](https://static.wixstatic.com/media/8d86ad_8d2817ea6c744aed928ed0e8989400c8~mv2.png "[Image: 8d86ad_8d2817ea6c744aed928ed0e8989400c8~mv2.png]")
At first glance, Wifite2 displays detected wireless access points, which channel they are broadcasting on, the type of encryption it uses, its signal strength, whether or not it uses a WPS key, and how many clients are connected to the access point.
If a wireless access point does not have WPS (WiFi Protected Setup) enabled, the attack will automatically shift to brute-forcing the 4-way handshake keys using a dictionary attack. This could theoretically take a long time, depending on the complexity of the password and whether the password in question is in fact in the dictionary list itself.
To maximize your success at cracking the WPA password, you can modify the dictionary file in Wifite2 and add or replace it with a more updated version, based on a list of the most commonly used WPA/WPA2
passwords.
However, if an access point has WPS enabled, the attack could finish in a matter of seconds. It is, by all definitions, a wireless router’s greatest vulnerability, and disabling it is an absolute must.
When you culminate all the information I have detailed herein, this is by far the easiest approach to wireless security auditing.
I haven’t even touched on some of the hardware I own that streamlines wireless penetration testing on a whole different level, like the WiFi Pineapple by Hak5, but introducing that wireless “super weapon” is better suited for its own article. However, it is a must-have for any serious red teamer interested in wireless security.
This is a crash course for the easiest, most streamlined and autonomous WiFi hacking method. I can always do others. However, if you're like me and you're mobile and don't have the convenience of dragging a laptop around or a tiny raspberry pi, the more autonomous you can run this attack, the less suspicious you're going to look, standing around, tapping out long, complicated commands on your phone or Pi. Let's begin!
*Disclaimer: You're responsible for breaking the law, not me. This is a handy skill to have, so don't abuse it.
You’re going to need a couple of prerequisites before you are ready to launch your penetration test.
Start with a wireless adapter that supports monitor mode and packet injection. This will allow you to sniff wireless traffic, capture data packets, see hidden networks, spoof, and manipulate network traffic via packet injection, even if you aren’t connected to that network.
Packet injection is an inalienable part of wireless attacks, which is why you must do your research in selecting the right wireless adapter. This gives the red team in attack position the ability to inject forged de-authentication frames that disconnect a target device’s connection to the wireless network.
Then, as the device attempts to reconnect to the wireless access point during the secured WPA/WPA2 4-way handshake, the reauthentication packets are captured and cracked by the red team, allowing them to authenticate on the wireless network.
You can find a listing of supporting WiFI adapters here.
However, my WiFi adapter of choice will always be the MK7AC which is available on Amazon on the developer’s website, Hak5.
You’ll obviously need a PC (preferably a laptop for mobility), but literally any laptop or PC that can run a live version of Kali Linux or your favorite flavor of Linux on a USB thumb drive will do the job. Kali is perfectly equipped with wireless penetration tools.
Software: choose your poison
For the simplest approach to simulating a quick and effective wireless security audit, I recommend using Wifite2. This is because Wifite2 is a completely autonomous tool and requires little user input, which saves time by minimizing the number of steps taken by a manual approach.
The power behind Wifite2 is that it has over a dozen dependencies working the backend, which is why it cuts like butter through wireless security. Here’s an example of what’s happening behind the scenes:
- Aircrack-ng - a complete suite of wireless security auditing tools.
- Macchanger - spoofing MAC address
- Bully - performs WPS Pixie-Dust & brute-force attacks
- Reaver - performs WPS Pixie-Dust & brute-force attacks
- Pyrit - used for detecting WPA/WPA2 4-way handshakes
- Hashcat - used for cracking PMKID hashes
- John - For CPU (OpenCL)/GPU cracking passwords
- Iproute2 - for controlling and monitoring different aspects of networking.
- Cowpatty - used for detecting WPA/WPA2 4-way handshakes
- Hcxdumptool - capturing PMKID hashes
- Tshark - used for detecting WPS networks and analyzing handshake captures.
- Hcxtools - used for converting PMKID packet captures into hashcat format for cracking.
- Wireshark-cli - used for detecting WPS-enabled networks and inspecting handshake captures.
Open a Linux terminal and run WIfite with the following command to kill any conflicting processes: sudo wifite –kill. Select your wireless interface and start the scanning process. Be sure to only select your wireless access point from the list of available networks to target, for legality purposes.
At first glance, Wifite2 displays detected wireless access points, which channel they are broadcasting on, the type of encryption it uses, its signal strength, whether or not it uses a WPS key, and how many clients are connected to the access point.
If a wireless access point does not have WPS (WiFi Protected Setup) enabled, the attack will automatically shift to brute-forcing the 4-way handshake keys using a dictionary attack. This could theoretically take a long time, depending on the complexity of the password and whether the password in question is in fact in the dictionary list itself.
To maximize your success at cracking the WPA password, you can modify the dictionary file in Wifite2 and add or replace it with a more updated version, based on a list of the most commonly used WPA/WPA2
passwords.
However, if an access point has WPS enabled, the attack could finish in a matter of seconds. It is, by all definitions, a wireless router’s greatest vulnerability, and disabling it is an absolute must.
When you culminate all the information I have detailed herein, this is by far the easiest approach to wireless security auditing.
I haven’t even touched on some of the hardware I own that streamlines wireless penetration testing on a whole different level, like the WiFi Pineapple by Hak5, but introducing that wireless “super weapon” is better suited for its own article. However, it is a must-have for any serious red teamer interested in wireless security.
