Original subtitles

1 1

In the previous lecture, 2

2

we've seen how easy it is to crack WEP. 3

3

All we had to do is capture enough data 4

4

and then run aircrack-ng to crack the encryption 5

5

and give me the key. 6

6

Now, one problem that we could face 7

7

is if the network is not busy. 8

8

If it's not busy, 9

9

then the number of data 10

10

will be increasing very, very slowly. 11

11

Therefore, we're gonna have to wait 12

12

for a while before we have enough data 13

13

to crack the key. 14

14

So let me show you an example. 15

15

I'm just gonna run airodump-ng here 16

16

and list all the networks around me. 17

17

And you can see I have my test network, 18

18

my Test AP in here, it's using WEP. 19

19

And if you look under the Data, 20

20

you'll see that it's at zero 21

21

and it's not increasing 22

22

and even if it's gonna increase, 23

23

it's gonna increase very, very slowly 24

24

which means that I'm gonna have to be waiting 25

25

for hours before I can crack this network. 26

26

So a solution to this 27

27

is to force the AP to generate new packets with new IVs. 28

28

Now, before doing this, 29

29

we need to associate with this network. 30

30

So what I mean by associate 31

31

is we need to tell this network 32

32

that we want to communicate with it 33

33

because by default, 34

34

access points ignore any requests they get 35

35

unless the device has connected to this network 36

36

or associated with it. 37

37

So don't get this mixed up with connecting. 38

38

We're still unable to connect to the network 39

39

because we need the password to be able to connect 40

40

to the network 41

41

but what we're doing right now 42

42

is literally just telling the target network look, 43

43

I want to communicate with you. 44

44

Don't ignore my requests. 45

45

That's all we're doing. 46

46

So it's something similar to what happens 47

47

when you just click on the network when you want 48

48

to connect to it. 49

49

You still haven't put the password, 50

50

you just telling the target network 51

51

I want to communicate with you, 52

52

please don't ignore me. 53

53

So in this lecture, I'm gonna show you 54

54

how to associate with the target network 55

55

so we can communicate with it 56

56

and in the next lecture, 57

57

I'm gonna show you how once associated, 58

58

we can inject packets into the network 59

59

and force the number of data to increase very, very quickly. 60

60

First, I'm going to run airodump.ng 61

61

against my target network 62

62

which has this BSSID. 63

63

So I'm gonna copy it 64

64

and we're gonna use the exact same command 65

65

that we've been using so far. 66

66

So we're gonna do airodump.ng --bssid 67

67

followed by the MAC address of my target --channel 68

68

followed by the channel 69

69

which my target is running on which is six 70

70

and we're gonna store all of this. 71

71

So we're gonna do --write 72

72

and we'll call this file arpreplay 73

73

because that's the name of the attack. 74

74

And then I'm gonna put my wireless adapter 75

75

in monitor mode which is mon0. 76

76

So a very simple command that we've done before. 77

77

We're using airodump.ng to capture data 78

78

from a network with this MAC address, 79

79

running on this channel, 80

80

we're storing everything in a file called arpreplay. 81

81

I'm gonna hit Enter 82

82

and as you can see, it's running against my target 83

83

and notice the data is increasing really, really slow 84

84

or it's actually not increasing at all right now. 85

85

Now, to associate with this network, 86

86

we're going to use a program called aireplay-ng. 87

87

So we're gonna type aireplay-ng 88

88

followed by --fakeauth 89

89

because we want to do a fake authentication attack. 90

90

We're gonna put zero 91

91

because we only want to do this once. 92

92

We're gonna do -a to specify the MAC address 93

93

of the target network. 94

94

So I'm gonna paste it, I've already copied it. 95

95

Then we're gonna do -h 96

96

to specify the MAC address of my wireless adapter 97

97

and to get the MAC address of my wireless adapter, 98

98

I'm gonna do ifconfig. 99

99

And it's the first 12 digits of the unspec field. 100

100

Usually you'd see it after the ether 101

101

but when you enable monitor mode, 102

102

it'll show up like so. 103

103

So I'm gonna copy this. 104

104

And I'm gonna paste it here. 105

105

And I'm gonna replace the minuses with colons. 106

106

And that's it, it's done. 107

107

And finally, I'm just gonna give the name 108

108

of my wireless adapter in monitor mode. 109

109

So a very simple command. 110

110

We're using aireplay-ng 111

111

which is a tool that can be used 112

112

to run a number of attacks 113

113

and we've seen using this with the de-authentication attack. 114

114

We're telling it that we want 115

115

to run a fake authentication attack. 116

116

We wanna do this once. 117

117

We're giving it the MAC address of my target network 118

118

after the a. 119

119

Then I'm giving it the MAC address of my wireless adapter 120

120

after the h 121

121

an finally, I'm giving it my wireless adapter 122

122

in monitor mode. 123

123

Now before I run this, 124

124

notice in here under the AUTH, we have nothing. 125

125

And we don't have any clients showing up in here 126

126

at the bottom. 127

127

Now, if I hit Enter, 128

128

you can see under the AUTH, 129

129

it's showing up as OPN 130

130

and you can see we have a new client here associated 131

131

with the network. 132

132

If you look in here, 133

133

you'll see this is the MAC address of my target network 134

134

and right here is the MAC address 135

135

of my wireless adapter. 136

136

So right now, I am associated with the target network 137

137

and if I send it anything, 138

138

it's going to accept it 139

139

and it's gonna communicate with me. 140

140

Again, I am not connected to the network, 141

141

I still can't use the internet, 142

142

I'm literally just associated with the network 143

143

so I can communicate with it. 144

144

Now, in the next lecture, 145

145

I'm gonna show you how we can communicate 146

146

with this network in a way 147

147

to force it into generating new packets 148

148

with new IVs which will allow us 149

149

to crack the key very, very quickly.