Original subtitles

1

Previously we've seen how we can use river to crack the WPX spin and from it get the WPA key.

2

We've seen the basic usage against a router that's not very secure.

3

Now like I said that router was given to me by the Internet provider with these default settings so

4

most people will actually leave it at the settings and it'll be as easy as that to exploit all the networks

5

that use these routers unless the user went and manually changed the settings.

6

Now with this lecture I want to show you another example of a more secure router.

7

So this is another matter that I have in here and I want to run very very against it and we will see

8

how we can crack it spin and get the password.

9

So first of all we're going to have to run wash to see all the WPX enabled routers against me.

10

So we're going to do wash I mean zero.

11

So this is exactly the same command that we were running before my 0 is my wireless adapter in monitor

12

mode.

13

I'm going to hit enter

14

and as you can see I have all the WPX enabled routers around me.

15

Now my target in this video is going to be this one which is called Test AP 2 and it has this MAC address.

16

So like we did before.

17

I'm going to first copy this and I'm going to run the basic griever command that we used previously.

18

So it's just going to be reversed.

19

B.S. ID then divide the channel which is 11 and then we'll give it my wireless adapter in monitor mode

20

which is 1 0.

21

So a very basic command that we've seen before we're just doing River.

22

We're given a society of the target network then we're giving it the channel of that network as well.

23

And then we are given that my wireless card in monitor mode.

24

I'm going to enter now I've actually executed this command before.

25

So it's asking me do I want to continue from where I left in the last time do I want to restart my session.

26

I'm going to say no because I want you to see what's going to happen.

27

So we're assuming that we're starting from scratch.

28

And as you can see it keeps saying failed to associate with my mac address and this message will keep

29

continuing to show in here.

30

So it will be it will basically just be stuck in here and we're just not going to get any results at

31

all.

32

So I'm going to first Control-C out of this now to fix this issue we're going to manually associate

33

with this access point.

34

So I actually covered before in a full lecture how to run a fake authentication attack.

35

This is exactly what they mean here by association.

36

So what we're going to do we're going to manually associate with the target use an airplay ngi and then

37

we'll run river again and tell it not to associate because we're going to do that manually.

38

So we'll just revert to do the rest of the things that we usually do but don't associate this time because

39

I'm going to do that manually so I'm going to split the screen

40

and I'm going to run airplay ngi here to associate with my target.

41

So I'm going to do airplanes you I'm going to do dash dash fake Auth. to associate with the target to

42

do a fake authentication attack then I'm going to have to give the delay.

43

And previously we used to give this at zero because we don't do this for a long period of time so we

44

usually don't need to stay associated with the target for a long period of time.

45

And this example we want to be associated with the target for as long as the time when River is working.

46

So I'm going to send this to 100.

47

And what this is going to do it'll basically set a delay of 500 seconds between the association attempts

48

between the time when airplay and you send the fake authentication packets next.

49

I'm going to have to give the Mac address of the target access point.

50

So we're going to do a dash 8 and give the Mac address then I'm going to have to give the Mac address

51

of my own wireless card and we'll do that using the dash Hage option and to get my mac address.

52

I'm going to have to split the screen again.

53

And do ifconfig 1 0.

54

So we're doing ifconfig followed by the name of your wireless adapter in monitor mode.

55

I'm going to her and turn and under the UN spec this is your MAC address.

56

So it's the first 12 digits of the unspayed field.

57

So in here to type it this is going to be 0 0 0 see a 8 2 8 2 9 8.

58

Finally we'll type the name of my wireless adapter in monitor mode which is zero.

59

So I'm going to close this here.

60

And I'm just going to go over the command one more time.

61

So the whole idea of doing this command is so that I can manually associate with my target because as

62

you can see here river is failing to associate it can't associate with my target therefore it can't

63

go and start brute forcing the pin.

64

So we're going to do this manually here.

65

We're doing it use an airplay and you were told on G that I want you to do a fake authentication attack

66

to associate with my target.

67

I want you to use a delay of a hundred seconds between the association attempts.

68

I want the MAC address of the target access point to be this one and my own MAC address is this one.

69

And this is my wireless adapter and monitor mode.

70

Now this is all good.

71

Now we need to go back to River and whenever we're going to run river we're going to use the exact same

72

command that we were on previously.

73

The only thing is I'm going to do a dash till a.

74

Now I didn't discover this myself if you just do reverse dash dash help.

75

You'll see all the options that you can use with the river including the dash 8.

76

And you'll see a description that you can use this to tell the lever not to associate with the target.

77

So we're run river like that now.

78

And this is asking me if I want to restart my session I'm going to say no.

79

And then as soon as I hit Enter I'm going to go down here and start the fake authentication process.

80

So I'm going to hit enter here go down here hit enter and let's see what's going to happen.

81

And perfect.

82

Now we managed to bypass this issue.

83

We managed to bypass the association issue because as you can see it seemed that it's associated and

84

it looks like it's trying to get trying to get it.

85

But for some reason we're not moving ahead.

86

We're still stuck at zero point zero zero percent.

87

So for now we actually bypassed the association problem and in the next lecture I'll show you how to

88

debug and tackle the other problem that we're facing.