Original subtitles

1

Okay now that we know the methods that we can use to gain access to WPA Enterprise Networks and this

2

lecture I want to show you the more advanced method the one where we create a fake WPA enterprise network.

3

So the first method.

4

Like I said it just uses a traditional fake access point.

5

And I covered this before in details I covered each aspect of learning this attack in details so that

6

you can adapt it to any scenario.

7

And this is a perfect example where you can use tools like Fluxion and wife fishier and you'll have

8

to do it manually.

9

And I covered how to do it manually before.

10

That's why I'm going to be covering the more advanced method in this lecture.

11

So I'm going to go to Cali and the first thing that I'm going to do is all need to install a modified

12

version of host APD.

13

So we use to host a PDA to generate the normal fake access point.

14

Now there is a modified version called Host APD WPB and that version of host a PDA is designed to run

15

a fake access point with WPA enterprise with free radius server.

16

So first of all I'm going to have to update my sources so I'm going to do apt get update now that my

17

sources are updated.

18

I'm going to do apt get install followed by the program that I want to install which is called Host.

19

AP The WP.

20

So we always use apt get.

21

We're just telling it to install on the package name or the program name it's called Host APD W.P..

22

I'm going to hit enter and that will automatically download the program all the needed packages and

23

configure it for me.

24

OK now that's all done.

25

So I'm going to clear the screen.

26

And the next thing that we want to do is very similar to what we used to do with host a PDA.

27

We want to modify its configuration so to do that we're going to do a live pod which is my text editor

28

and I'm going to put the location of the configuration file and that's stored in ATC host APD WP and

29

again host APD the blue dot com.

30

So we're doing Lafond which is our text editor and then we're given at the location of the configuration

31

file for host.

32

APD WPEC.

33

I'm going to hit enter and the main things that you want to make sure are set correctly is first of

34

all the interface.

35

This is your wireless adapter.

36

So in my case it's actually called Line 0.

37

If you don't then what it's called You have to do if config as you should know by now and then you can

38

get the name of it.

39

The next thing that I want to modify is the SS ID.

40

This is the name of the fake access point and it's set by default to be called Host APD WPEC.

41

Now my target is called company network.

42

So I'm going to call this company network as well because as you know this is an evil to an attack.

43

So you want your fake access point to have the exact same name as the target access point.

44

So call an IT company network you can also modify the channel and here if you want but I'm going to

45

keep that the same.

46

And I'm actually going to leave everything else here the same.

47

Now if you scroll down you'll actually see after this point and it says is it.

48

And it says it here and the comment everything that comes after here is literally just the normal host

49

APD configuration.

50

So like I said this is just a modified version of host APD which is modified so that it can use WPA

51

a enterprise with free radius server.

52

So I'm going to save this control apps and quit it.

53

Control.

54

Q OK.

55

Now we're done.

56

We're ready to run the attack.

57

But before we do that like we did with host APD we have to stop the network manager because it's managing

58

my wireless interface.

59

And if it stays running it won't let me use it to create a fake access point.

60

So I'm going to do service network manager stop this or stop the network manager for me.

61

And now I can run the fake access point with WPA enterprise to do that.

62

We're going to host a PDA WPEC followed by the location of the configuration file which is an ATC host

63

APD WPEC host AP DWP either or CANF.

64

So this command is actually very similar to the host APD command that we use to use.

65

You just put the name of the tool followed by the location of the configuration file.

66

I'm going to hit enter and as you can see right now it's still in me that the network is working its

67

broadcast and under the name company network.

68

And now you can just go ahead and run the authentication attack as I showed you before you can do authenticate

69

all clients or some clients.

70

Again as shown before clients will not be able to access their network they won't be able to use the

71

network.

72

So they'll think Oh maybe I can just connect to the other company network.

73

So let's go to a Windows machine and see what we have.

74

So I have my company network in here.

75

I'm going to connect to us.

76

And I'm going to put my user name as zayd and my password as one two three four A B C D.

77

I'm going to connect.

78

Now this is just a warning saying that if you expect to see this network then connect to it.

79

Otherwise don't.

80

Most people would just connect to it because like I said WPA enterprise is usually used in large organizations.

81

So people are used to see a number of routers and connecting to a number of routers and if you're on

82

the authentication attack and they can't connect to their own router then there is a very high chance

83

of them trying to connect to the other router or the other to the other access point that has the exact

84

same name that they're used to.

85

Therefore I'm going to click on Connect now saying it can't connect to this network because I actually

86

use the wrong username and password anyway.

87

But if we go to the Kalli machine you'll see that we captured the username we captured the challenge

88

and we captured the response.

89

Now I know this is not the password that I put so you still can't see one two three four a b c d and

90

that's because the password is encrypted.

91

That's why I said the basic evil twin method that we showed before has an advantage over this method

92

because the password will be sent in plain text overhasty TTP.

93

The problem with that method was the logon screen wasn't very convincing with this method.

94

You'll get a proper system log in box because we are implementing a proper WPA enterprise network.

95

So there's nothing fake about it.

96

The only problem is because this is a proper WPA a enterprise network the password will be sent.

97

Based on the authentication method used which is a challenge response method where there either sense

98

a challenge and then the client sends a response based on that.

99

Now in the next section I'm going to talk more about this and I'm going to show you how to crack the

100

response and get the key for the network.

101

But for now our attack is done.

102

We managed to capture the username and the hash for that password.

103

And in the next lecture I'm going to show you how to crack that password.