Original subtitles

1 1

In the last lecture, 2

2

we've seen to use airodump-ng 3

3

to list all the networks around us 4

4

and display useful information about them. 5

5

Usually, we do this in order 6

6

to see our target network, 7

7

see the signal strength, see how far we are from it 8

8

and then start targeting this target network. 9

9

Now, in this example, 10

10

I'm gonna assume that my target network 11

11

is this one right here. 12

12

This is actually the network 13

13

that my host machine is connected to 14

14

and now that I have my target network, 15

15

and I have some basic information about it, 16

16

let's see how we can run airodump-ng 17

17

against this network only, 18

18

not against all networks. 19

19

And this way, we'll be able 20

20

to gather more information about it. 21

21

So to do this, first of all, 22

22

I'm gonna have to write the name of my program 23

23

which is airodump-ng. 24

24

Then I'm going to specify a specific BSSID 25

25

or a specific MAC address 26

26

for airodump-ng to sniff data from. 27

27

So my target network has a BSSID of this. 28

28

We can see it here under the BSSID. 29

29

So I'm gonna copy it 30

30

and then I'm gonna do --bssid 31

31

and I'm gonna give it the BSSID that I just copied. 32

32

Next, I'm gonna specify a channel 33

33

for airodump-ng to sniff. 34

34

Again, if we look under the Channel column in here, 35

35

we can see my target network 36

36

is on channel two. 37

37

So I'm gonna do --channel 2. 38

38

So now, we're telling airodump-ng 39

39

that I want you to sniff data on channel two 40

40

and only from a network that has this BSSID. 41

41

I'm also going to tell airodump-ng 42

42

that I want you to store all the data 43

43

that you're gonna gather for me in a file. 44

44

So I'm gonna say --write 45

45

and then I'm gonna type a file name 46

46

and let's call this test 47

47

and at the end, as usual, 48

48

I need to give it the name of my wireless adapter 49

49

in monitor mode 50

50

which is mon0 in my case. 51

51

So a very simple command. 52

52

Let's go over it one more time. 53

53

We're doing airodump-ng, 54

54

that's the name of the program that I wanna use. 55

55

I'm telling it that I only want you to sniff data 56

56

from a specific bssid. 57

57

Then I'm giving it the BSSID of my target. 58

58

Then I'm telling it I want you to only sniff data 59

59

from a specific channel 60

60

and I'm giving it the channel 61

61

that I want it to sniff data from, 62

62

again, we can get it from here, it's number two. 63

63

Finally, I'm telling it that I want you 64

64

to write all the data 65

65

that you're gonna capture in a file 66

66

that we're gonna call it test 67

67

and then I'm giving it my wireless adapter 68

68

in monitor mode which is mon0. 69

69

Now, I'm gonna hit Enter. 70

70

And as you can see, unlike the last time, 71

71

airodump-ng is only showing me one network in here. 72

72

This is the network that I wanted it to sniff data on. 73

73

And we can also see, 74

74

we have a completely new section right now. 75

75

So when I run airodump-ng in the previous lecture, 76

76

you've seen I only had the networks in here 77

77

and I had nothing here at the bottom. 78

78

But now, you can see we have more entries in here 79

79

at the second section of networks 80

80

and basically, anything that you see here 81

81

in the second section, 82

82

these are the clients or the devices connected 83

83

to this network. 84

84

So right now, we can see this network 85

85

has three devices connected to it 86

86

and you can see the MAC addresses of these devices 87

87

under the Station. 88

88

So you can see all of these devices 89

89

are connected to the same network. 90

90

So the BSSID is still the same, 91

91

this is the MAC address of the network 92

92

and under the Station, 93

93

we have the different clients or different devices connected 94

94

to this network. 95

95

We can also see the Power, so this is the signal strength 96

96

of each of these devices. 97

97

We can see the speed, 98

98

we can see the amount of data lost, 99

99

we can see the amount of frames or packets 100

100

that we have captured 101

101

and we can see if any of these devices 102

102

are still probing for networks. 103

103

So sometimes, when you run airodump-ng 104

104

against all networks, 105

105

you'd still see the section 106

106

and you'd see that some devices 107

107

are not connected and they're literally trying 108

108

or looking for networks. 109

109

So you'd see the name of the networks 110

110

that they're looking for under the Probe. 111

111

Now, if I hit Control + C, 112

112

airodump-ng will quit, it'll stop working 113

113

but I should have new files in my current working directory 114

114

that contain the data 115

115

that we just captured 'cause remember, 116

116

when we run the command, we use the write option in here 117

117

to store the data in a file called test. 118

118

So if I just do ls to list all the files 119

119

in my current working directory, 120

120

you can see I have four files, 121

121

all of them start with test. 122

122

But they all have different extensions. 123

123

So we have a CSV, we have a netxml, 124

124

we have a cap 125

125

and we have a Kismet.csv. 126

126

Now also notice that airodump-ng 127

127

automatically appended minus 01 128

128

to each of these files. 129

129

So in the future, when you go 130

130

and try to use the capture file, 131

131

make sure you append -01 132

132

to the file name that you specified in the command. 133

133

Now, the main file that we're gonna be using 134

134

is the cap file. 135

135

Again, this file contains the data 136

136

that we captured during the period 137

137

that airodump-ng was working on in here. 138

138

And basically this file should contain everything 139

139

that was sent to and from my target network. 140

140

So it should contain URLs, 141

141

chat messages, usernames, passwords 142

142

or anything that any of these devices did on the internet 143

143

because anything that they have to do 144

144

will have to be sent to the router 145

145

as we've seen before. 146

146

The only problem is if you look at the encryption in here, 147

147

you can see that my target network uses WPA2 encryption. 148

148

So all of the data sent between the router 149

149

and the clients is encrypted. 150

150

So let me show you what I mean. 151

151

I'm gonna use a tool called Wireshark 152

152

to analyze the data 153

153

and don't worry about how to use Wireshark. 154

154

We will talk about it in details later on. 155

155

Right now, I just want to make sure 156

156

that you understand the idea 157

157

that now we're able to capture all these packets, 158

158

the only problem is these packets are encrypted. 159

159

So I'm gonna do wireshark to run Wireshark. 160

160

And then I'm gonna open my capture file, 161

161

so I'm gonna go to File, Open 162

162

and it's already in my root directory, 163

163

so I'm just gonna scroll down 164

164

and select my test-01.cap. 165

165

I'm gonna open it 166

166

and I'll just put this in full screen 167

167

and as you can see, 168

168

if we click on any of these packets, 169

169

you see we really have no useful data. 170

170

You can see everything looks like gibberish 171

171

and we can't read anything 172

172

even though these packets might contain usernames, 173

173

passwords or URLs. 174

174

The only useful thing that we can see here 175

175

is the device manufacturer. 176

176

So we know one of the devices connected to the network 177

177

that has this specific MAC address, 178

178

so it's the one that ends with E8 179

179

and if we go up, we can see that it's this specific device, 180

180

we know now it is an Apple device. 181

181

So it could be an Apple computer, 182

182

it could be an iPhone or an iPad 183

183

and this is actually my MacBook computer 184

184

that is the host machine. 185

185

Again, we can see we also have a device 186

186

that's using a Huawei chip set 187

187

so this can be a phone or it could be the router. 188

188

And if you look at the MAC address here, 189

189

and compare it to the MAC addresses 190

190

that we have here, you can see 191

191

that this is actually under the BSSID 192

192

so this is the MAC address of the router. 193

193

So now we know that the brand 194

194

of my router is Huawei. 195

195

So we can gather more information 196

196

by opening this file in Wireshark 197

197

and we can kinda guess 198

198

what computers are there 199

199

and what operating systems they use 200

200

but this is not detailed enough 201

201

and the main problem with this 202

202

is the fact that the network is using encryption. 203

203

Now, in the next section, 204

204

we're gonna be talking about how to break this encryption 205

205

and once we do, you'll see how we can see the passwords, 206

206

the usernames in plain text 207

207

and you'll also see how we can map all 208

208

of the computers on the same network, 209

209

gather detailed information about them, 210

210

hack into them and do some really, really cool stuff. 211

211

Now, you should guess by everything that I said so far, 212

212

if this network was an open network, 213

213

if it was a network that does not use any passwords, 214

214

then you would have been able 215

215

to actually see all the URLs and everything 216

216

that they do in here. 217

217

But again, if you can't connect to the network 218

218

without a password, 219

219

then you'll automatically be at the post connection section 220

220

and in that section, like I said, 221

221

we're gonna talk about some really, really cool attacks 222

222

that you can do 223

223

once you have the password or once you can connect 224

224

to the network. 225

225

So don't worry about Wireshark for now. 226

226

I just wanted to make sure 227

227

that you understand why encryption is useful 228

228

and why it's used 229

229

and why we can't see much now 230

230

because we don't know the key. 231

231

We will talk about Wireshark and all of that later on 232

232

in the next section.