Original subtitles

1

Now in this video I'd like to cover a configuration that might be used on the target router that could

2

make a crack in it a little bit different.

3

Now as we know WEP is very rare to see now anyway and this configuration is actually really really rare.

4

And most routers don't even supported it is a bit different to crack it though.

5

And usually people get confused when they see it and won't even know what to do.

6

But it's actually kind of easier to crack this type of configuration than the normal web configuration.

7

What I want to talk about is if the target router does not use open authentication.

8

So we've seen in all the previous videos the first step was to do a fake authentication attack.

9

We changed the oath and arrow don't ngi to open in this case the router can be configured to use a shared

10

key authentication.

11

So I have my router settings page here and you can see that I changed the setting here required and

12

what this basically does is it prevents anybody from even associate with the router if they don't know

13

the key.

14

So usually routers use open authentication which basically means anybody can associate with the router.

15

And then the router will check if you have the right password if you have the right key.

16

If you do they let you connect.

17

If you don't they won't let you to connect.

18

So they actually allow you to associate and they'll communicate with you if a shared key is used then

19

the router will not even allow you to associate unless you encrypt a challenge for it and send it to

20

it.

21

You won't even be able to associate with the router if you don't have this shared key.

22

Let me show you an example here.

23

So I'm just going to do first of all Aradigm engineman Zero to see all the networks around us

24

and you can see that I have this network which I configured for this class and it's called S-K a test

25

AP.

26

So it's right on channel 1 and I'm going to copy its MAC address and we're going to run aero dump and

27

G against this network only We're going to give the SS ID the channel

28

and we're going to store the data to our file and we'll call the file as a test and then I'm going to

29

put my wireless card in monitor mode which is Monsey.

30

So it's the same command that we've always been do and don't Bengie the B side.

31

SS idea of the target the channel and we're right in a file.

32

We're going to hit enter and this is going to run against our target only.

33

And now I'm just going to come in and do a fake authentication just to show you what happens in S-K

34

networks.

35

So we're going to do a fake authentication exactly like we did it before.

36

So it's going to be airplay N.G. fake Auth. and we're going to put zero and then we're going to do minus

37

a put the mac address of the router and then I'm going to do minus each and put my own MAC address which

38

is now i'm doing all this real quick because you should know all of this by now because we covered it

39

in previous lectures my own MAC address is ZERO ZERO ZERO see a 2 8 2 9 8.

40

Then we're going to put our wireless card in monitor mode which is more than zero.

41

So again same commando we always use for the fake authentication we're going to do play N-G fake of

42

zero target MAC address my MAC address.

43

I'm going to hit enter

44

so I'm going to Control-C this so you can see that we have S-K here under the auth instead of open.

45

And that means we can't really do all the attacks that we did previously.

46

The three methods the three injection methods that we spoke about previously the way to fake authenticate

47

yourself with S-K networks is you'll have to be authenticate one of the connected clients in here.

48

So you actually need.

49

You have to have a client connect to the network you're going to have to deal authenticated once you

50

do that.

51

Ngi will capture and.

52

You can see that I have a broken S-K here.

53

But if you do that properly you will get a normal Eskay and then you'll use that file with the minus

54

y option to fake authenticate yourself to associate with the network.

55

And then you can do all the attacks that we spoke about in the previous lectures the three methods.

56

The thing is that's a bit too complicated and there is two better methods to do that because as I said

57

if you want to associate and the target network uses as K.A. the network has to have a connected client

58

has to have at least one connected client.

59

So based on that fact there's actually better ways to crack that network and I'm going to show you the

60

first method right now and that is use in an AARP replay attack.

61

So let me close this first.

62

And I'm going to clear this and I'm actually going to stop this and clear it and run the attack again

63

because I want to show you that you actually don't even need to run a fake authentication for this.

64

So we're just going to name something else we're going to call it as a test to and we're going to launch

65

or don't punji.

66

And as you can see right here you don't have authentication or anything on this network right now.

67

And what I'm going to do is I'm going to do an hour peer or play attack.

68

So we spoke about that and we actually did it in a previous lecture.

69

The only difference is when we did it we did a fake authentication and we associated with the network

70

and then we use the replay attack based on our mac address so we would play packets from our computer

71

and injected them in the router and this lecture because we actually have a client when we did it in

72

previous lectures there was no clients connected.

73

So we had to associate our client showed up in here and then we use our client Mac address to replay

74

one of the ERP packets and we managed to increase the number of data rapidly that way.

75

What we're going to do today is because we already have a connected client.

76

We're going to use this connect to the client in our replay attack and this method will work against

77

both normal networks and against the network the web networks that use as a.

78

So this attack is going to be exactly the same as the RPO play attack that we did.

79

The difference is we're going to use the MAC address of a connected client instead of my own MAC address.

80

So the command is going to be air and you AARP or play then we're going to do minus Beith and we're

81

going to give it the MAC address of the target network then we're going to do minor stage.

82

And instead of giving it my own MAC address like we did in previous videos I'm going to use the MAC

83

address of one of the connected clients which is this one

84

then I'm going to put my wireless card in monitor mode which is my 0 and we're ready to go.

85

So again we're using airplay and we were doing an hour pure play attack exactly like we did before we're

86

specifying the target network after the minus bit.

87

And then we were specifying the MAC address of a connected client this time instead of specify in my

88

own MAC address so I'm going to hit enter and all this is going to do is it's going to wait for appropriate

89

packet and once it captures one of them it's going to injected into traffic more and when it's going

90

to do that it's actually relying on disconnected the client and it's injecting it as if this packet

91

is coming from this connected client.

92

And as you can see the number of data is increasing very very fast right now and I can just run our

93

ngi on the side and I should be able to crack the password.

94

So again I'm going to run this like we did before and we named the file S.K. test.

95

And we named it to and we have to append the minus zero 1 because the arrow dump.

96

Does that automatically and that's going to be a dot com but we're going to hit enter

97

now I'm going to stop this.

98

As you can see we managed to get the key.

99

Now we can use this we just remove these dots from it and connect to the target network and we'll be

100

able to connect to it.

101

So again this method works on both normal web networks and the ones that use shared key authentication

102

or Eskay.

103

The only thing that it requires is an existing connected client to the network.

104

So it's not a client list cracking method.