Original subtitles

1 1

Now, if WPS is disabled 2

2

on your target network, 3

3

or if it's enabled, but configured 4

4

to use push button or PBC, 5

5

then the method that I showed you in the previous lecture 6

6

will not work. 7

7

Therefore, you will have to go 8

8

and crack the actual WPA or WPA2 encryption. 9

9

And like I said, when these encryptions were designed, 10

10

the developers knew about the weaknesses in WEP 11

11

and they made sure 12

12

that they properly fixed these weaknesses. 13

13

They actually did a pretty good job at this. 14

14

Therefore, we cannot use the same method used in WEP 15

15

to crack WPA and WPA2. 16

16

So in WPA2, the keys are unique, they're temporary, 17

17

they much longer than what they were in WEP. 18

18

Therefore, the packets sent 19

19

in the air contained no information 20

20

that is useful for us. 21

21

So it doesn't matter even if we capture one million packets, 22

22

we can't use them to crack the key. 23

23

The only packets that contain useful information 24

24

are the handshake packets. 25

25

These are four packets transferred between a client 26

26

and the router when the client connects to the network. 27

27

So in this lecture, 28

28

I'm gonna show you how to capture these packets 29

29

and in the next lectures, 30

30

we'll see how to use them to crack the WPA 31

31

or WPA2 key. 32

32

First of all, as usual, 33

33

you'd wanna run airodump-ng 34

34

against all the networks around you. 35

35

I've already done that 36

36

and as you can see, this is my target right here. 37

37

It's using WPA2. 38

38

And this is the MAC address. 39

39

I'm gonna copy it. 40

40

And the first thing we'll do is just run airodump-ng 41

41

on this network and store the data in a file, 42

42

exactly the wame way that we used to do with WEP. 43

43

So we're just gonna do airodump-ng --bssid 44

44

and give it the BSSID of my target. 45

45

-channel and give it the channel of my target 46

46

which is one. 47

47

-write to specify a file name 48

48

to store all the data that we're gonna capture in. 49

49

And let's call this wpa_handshake 50

50

because we're gonna capture the handshake. 51

51

And finally, we're gonna give it my wireless adapter 52

52

in monitor mode 53

53

which is mon0. 54

54

So a very simple command. 55

55

We've done this multiple times by now. 56

56

We're using airodump-ng. 57

57

We're giving it the MAC address of my target 58

58

after the BSSID, I'm giving it --channel 59

59

to specify the channel of my target. 60

60

I'm using --write to store all the data in a file. 61

61

This file will contain everything 62

62

that we capture so if we capture the handshake, 63

63

it'll be in this file. 64

64

And finally, I'm giving it the name of my wireless adapter 65

65

in monitor mode. 66

66

So now I'm gonna hit Enter 67

67

and as you can see, airodump-ng is working 68

68

against my target network 69

69

and right now, all we have to do 70

70

is literally sit down and wait 71

71

for the handshake to be captured. 72

72

Like I said, the handshake is sent 73

73

when a client connects to the network 74

74

so we'll literally have to sit down 75

75

and wait until a new client connect to the network. 76

76

Once a new client connects, 77

77

we will capture the handshake 78

78

and you will see in here airodump telling us 79

79

that the handshake has been captured. 80

80

Alternatively, we can use something 81

81

that we learned before 82

82

which is a deauthentication attack. 83

83

We know using that attack, 84

84

we can disconnect a client from the network 85

85

so we can do this for a very short period of time. 86

86

We can disconnect this client from the network. 87

87

He will automatically connect once we stop the attack. 88

88

Therefore, when he automatically connects, 89

89

the handshake will be sent in the air 90

90

and we will be able to capture it. 91

91

This way we will not have to sit down 92

92

and wait for someone to voluntarily connect 93

93

to the network. 94

94

So we've seen how to do this before 95

95

and it's gonna be exactly the same command 96

96

as we did it before. 97

97

We used aireplay-ng. 98

98

We did --deauth. 99

99

Then we specified a really large number of packets 100

100

to keep the client disconnected for a long period of time. 101

101

This time, I'm gonna set this to four 102

102

to only send four deauthentication packets. 103

103

This way, my client will be disconnected 104

104

for a very short period of time. 105

105

They won't even feel that they got disconnected 106

106

but this is enough for the handshake 107

107

to be sent because they will be disconnected, 108

108

they will automatically connect 109

109

and when they do that, 110

110

we will capture the handshake. 111

111

Now, the next argument we wanna set 112

112

is the MAC address of my target. 113

113

So we're gonna do -a followed by the MAC address 114

114

of my target. 115

115

Then we're gonna do -c followed by the MAC address 116

116

of the client that we want to disconnect. 117

117

So it's this client right here. 118

118

I'm gonna copy, paste it here 119

119

and finally, we're gonna give it the name 120

120

of my wireless adapter in monitor mode 121

121

which is mon0. 122

122

And we are done. 123

123

Again, I've spent a full lecture on this command 124

124

explaining what a deauthentication attack is 125

125

so if it's a bit confusing, 126

126

please go back and revise that lecture. 127

127

Basically all we're doing is we're using aireplay-ng 128

128

to run a deauthentication attack 129

129

to disconnect this device 130

130

for a very short period of time. 131

131

That's why I'm setting this to only number four. 132

132

Then I'm using -a to specify the MAC address of my target, 133

133

c to specify the MAC address of the client connected 134

134

to this network 135

135

and then I'm giving it my wireless adapter in monitor mode. 136

136

Now I'm gonna hit Enter 137

137

and keep an eye on this side right here. 138

138

You'll see the handshake will be captured in here. 139

139

So I'm gonna hit Enter. 140

140

Deauthentication packets are being sent 141

141

and perfect, as you can see, 142

142

once the client connected again, 143

143

we receive the handshake. 144

144

So now we can quit airodump-ng. 145

145

So Control + C because we have the handshake now. 146

146

It is stored in the file 147

147

that we set after the right option 148

148

which is called wpa_handshake 149

149

and in the next lecture, I'll show you how this handshake 150

150

can be used to get the key for the network.