Speeding Up WEP Hacking In Kali

Now if you have followed the basic WEP hacking tutorial, and have also read the basic troubleshooting guide, then you are ready to proceed to the stage where you follow an intermediate level hacking tutorial. In this tutorial, we will look at the intricate details of what is happening and approach the complicated methods and concepts.




To start with, I'll address a common question which was asked on my previous posts.

14 March 2014 19:28

i couldn't find any wlan when i write ifconfig in terminal

1. 
   
   
   
   
   Are you using Kali Linux on a virtual machine. Please note that a wireless adapter can only be used by only one machine at a time. Your host machine has access to the wireless adapter, not the virtual machine. This question has been discussed at length on superuser forums. The conclusion is that you can't directly connect internal wifi card using any Virtual machine software-
   "Unfortunately no virtualization software allows for direct access to hardware devices like that.
   
   Compare VirtualBox with VMware Fusion and Parallels for Mac. All 3 of those programs behave the same way. The only devices that can be directly accessed are usb devices. Everything else is abstracted though the virtualization engine. (Though you could argue that the vm has lower level access to cd rom's and storage devices).
   
   I wish I could give you a better answer, than simply to buy a usb wireless card."
   Basically you have to buy an external wireless card. They aren't very expensive. I personally use two of them myself. If you want to see what I use, take a look here, http://beginnnerhacking.blogspot.in/2014/02/creating-dummy-wifi-for-hacking.html

So basically you have 2 choices. First, you can buy a new external wireless adapter (no referral links here). Secondly, you can side install Kali with Windows or run it via a USB. A virtual machine can only use computer hardware if it is externally connected via USB. Now there is another catch here. The internal adapters, almost all of them, don't support injection. This is extremely important for speeding up wireless hacking. So if you really want to go in depth of wireless hacking, then its time to buy an external adapter or two (the more the better). If that's not a possibility, you might want to spend hours trying to get a driver which might make your internal adapter support injection (I don't know anyone who succeeded in this, but it might be possible).

Kali Linux

I don't know why it needs mention here, but still, if you don't have Kali Linux (or Backtrack) installed yet, you will have to install it before you can start this tutorial. Here is the tutorial on Kali Linux hacking.

Check Injection Support

Aircrack-ng has a comprehensive article related to checking injection support. You might check their website out for it. I am just providing the commands which will be enough to find out whether injection is working or not. 

airmon-ng start wlan0  [or wlan1]

(Puts your wireless adapter in monitor mode. From now we'll refer to wlan0/wlan1 as mon0

airserv-ng -d mon0

 aireplay-ng -9 127.0.0.1:666

This basically sets up a temporary server sort of thing that is waiting for you to test your injection capabilities. The second command actually tries to inject the server, and succeeds. 127.0.0.1 is the IP which is reserved for loopback. It is always used when you are carrying out some command on yourself. 666 is the port we are using. Most of the time, what follows an IP and a colon is the port. The general form is somewhat like IP:port. So finally you have checked your injection capabilities, and the last line - "Injection is working!" should bring a smile to your face. If not, you'll have to buy a card which supports injection, or see some forum posts which will help you figure something out.

Check Signal Strength

While the basic hacking methods from the previous post don't have any real strength restriction, you need to be physically close to the access point in order to inject packets. There is information regarding the same in the same aircrack-ng tutorial. Again, I'm gonna summarize what you have to do here.

First, we will use airodump-ng mon0 to see the list of networks in range. See the one you want to hack.

Airodump-ng lists the networks in range.

Now we will hack the digisol network. Make a note of the BSSID of the network you want to hack.  A good practice is to store all the information gathered in any text editor. We should, at this stage, take a note of following:-

• ESSID -  DIGISOL
• BSSID - 00:17:7C:22:CB:80
• CH (channel) - 2
• Mac address of genuine users connected to the network:
• Interface : wlan1 - referred to as mon0

You should gather the equivalent information for the network you will be working on. Then just change the values whenever I use them in any of the commands

Note : We need at least one user (wired or wireless) connected to the network and using it actively. The reason is that this tutorial depends on receiving at least one ARP request packet and if there are no active clients then there will never be any ARP request packets.

Now, to check whether the signal strength will be sufficient, we will simply execute the following code-

airodump-ng [interface] -c [channel]

airodump-ng mon0 -c 2

This will make the wireless card only read packets in the channel no. 2, on which our target network is.

Now to test the network, type the following code-

aireplay-ng --test -e DIGISOL -a 00:17:7C:22:CB:80 mon0 

 The last time we checked whether the wireless card had the capability to inject packets. We tested it on our own computer. This time, we actually injected packets into the target computer. If this worked, then it's pretty good news, and it means that you are most probably going to be able to hack this network. The last line 30/30 : 100% determines how good the strength of the signal is. A very high percentage is a good sign, and 100 is ideal.

Capture Packets

Now we have already run airodump-ng a couple of times. However, this time we will pass the -w command which will instruct airodump-ng to save the output to a file.

airodump-ng -c [channel] --bssid [bssid]-w [file_name] [interface]

airodump-ng -c 2 --bssid 00:17:7C:22:CB:80 -w dump mon0

 Now the output will be saved in a file  dump-01.cap
Now we can keep this terminal running and it will keep saving the packets.  [In the previous tutorial we did only 2 things, capture the packet, i.e this step, and crack it, i.e. the step we are going to do last. While it makes our work easier to just follow two steps, it also makes the process much more time consuming, since we are simply a passive packet listener, who is not doing anything]

Speeding Things Up

Fake Authentication

Now to speed things up, we will inject the network. We will thus obtain ARP packets. These packets will fill up the data column of our airodump-ng capture, and data is what will help us obtain the password. As soon as we have 10000 data packets, we can start attempting to get the password using aircrack-ng.

Now to make the AP pay attention to your injected packets, you either have to be a connected client, or have to pretend to be one. You can either mask your mac address to one of the already connected clients, or use the fake authentication feature. We will do the latter. (If you see an error like the AP is on channel x and mon0 is on channel y then go to the bottom of the post for troubleshooting)

aireplay-ng -1 0 -e DIGISOL -a  00:17:7C:22:CB:80 mon0

Authenticated and capturing packets

 ARP request replay mode

ARP packets are your best bet at getting a lot of IVs or data. Without IVs you can't hack a network. Enter the following code to make aireplay-ng listen to the AP for ARP packets, and inject them as soon as they find one. This will create a lot of data very fast. This is the real speeding step. 

aireplay-ng -3 -b [BSSID] mon0

This is what the final code will look like-

aireplay-ng -3 -b  00:17:7C:22:CB:80 mon0

This is what it'll look like in the beginning

 Now you'll have to wait for some time till it gets an ARP request. As soon as it gets one, the terminal will sort of explode. And the data packets will start filling in with Godspeed. Now this is the part where an active user on the network is absolutely necessary.

Slow start

Everything got fine after some time

After some time I had enough packets to crack almost any network

The data filled in VERY fast

The video shows how fast the IVs flowed in after ARP injection started.

Cracking the network

Cracking the network is as easy as typing the following into the console

aircrack-ng name_of_file-01.cap

In our case, the command will be

aircrack-ng dump-01.cap

 After pressing enter, you will have a list of networks and you'll be prompted to select which one of them to hack. In my case there was just one network, so I couldn't get that screen, or a screenshot. The password was cracked in less than a second.

I have blurred out the password and some random stuff.

So finally you have obtained the password of the network you were trying to hack.

Troubleshooting

A person commented on another wireless hacking post. This is the problem he faced.

whenever i try to use aireplay-ng, with the options, always fail saying that mon0 is in channel -1 and the target is in other channel. How can i fixed this? i looked a lot for a real answer but nobody know what is this.

This is a possible solution

Okay, try the following-
1) When you start the monitor mode, specify the channel - 
usage: airmon-ng [channel or frequency]
Your code : airmon-ng start wlan0 6
Substitute 6 with the required channel.
2) While starting airodump, specify the channel
airodump-ng mon0 -c 6

I was facing this problem when my mon0 kept hopping from one channel to the other, and the second step alone solved my problem. If your airmon-ng assigns itself a fixed channel on its own will, without you even specifying it, then the problem might be more complicated. If the above steps don't solve the problem, take a look here - http://ubuntuforums.org/showthread.php?t=1598930

Read full post »

Creating A dummy wifi for hacking

What you'll need

At least 2 wireless adapters. I've got three. First one is the internal adapter which came with my laptop. The other 2 are DLink adapters.
This is what it looks like.

My Dlink Adapter

This is what it looks like on my Windows machine ( I blurred the names a bit. Its a sort of convention I guess)

What now

Now since we have multiple adapters, we can use one of them to create a wireless network on Windows and then practice hacking it on a virtual Kali Linux machine. Now here's a detailed guide on how to create a wireless ad-hoc network. I'll just post a screenshot of me doing it right now.

This is our newly created network. Now we can turn on our Kali machine and see if it is discovered there.

So it showed up pretty fine. We can use netsh to modify the security parameters as necessary (WEP, WPA, etc. and practice our hacking skills on our dummy wifi network)

Important Update : I couldn't figure out how to create a WEP network using command line. So if you wanna practice WEP hacking, then this will not help.



Read full post »

Create A Wireless Ad-Hoc Network on Windows 8 Using command line

For the hackers

This method works with all versions of Windows. This article is relevant and important here since the best way to start with hacking is to practice on yourself. You are going to need two adapters for this task. One on Windows which will create the network, and another on Kali Linux which will hack the network. This article concentrates only on the former part of the exercise, and we'll only create an ad-hoc network here. So non-hackers too can follow from here on.

For everyone

1. Get access to an elevated command prompt (with administrator privileges). [On Windows 8 : Press Windows key + X or hover your mouse to the lowermost corner on the left part of the screen and right click. Then click "Command Prompt Admin"
   
2. Now type netsh wlan show drivers 
   
   
3. If the hosted network supported says yes, move on to the next step
4. Now type - netsh wlan set hostednetwork mode=allow ssid=<enter_network_name_here> key=<enter_password_here>
5. Finally type  netsh wlan start hostednetwork. Your ad-hoc network is ready.
   
   
   

Read full post »

The missing ingredient

It didn't work!

Followed that tutorial right from the first line to the last one. Did everything it said, but still didn't get what you were looking for? Believe me, it was supposed to be that way. Step by step code execution on the cli is not what it takes to be a hacker. Every wireless adapter, computer system, operating system, and wireless network is different. There is no fixed set of code which is bound to work with all wifi's on all machines. Hacking is like mathematics. Knowing the formula doesn't mean you can solve all the problems, and seeing the solution of one problem will definitely not help you with another one. So, when you are hacking a WEP wifi network, what are you actually doing?

What were you doing?

Firstly, you are capturing the packets that the wifi network is... like throwing away in the air. The sole purpose of those packets is to indicate its presence. Airodump just takes all the packets that come its way and collects them. These packets usually contain some useful information.Secondly, you are using a program to extract the password from the captured data packets.

How were you doing it?

Now, firstly, we do something not completely required. We turn on monitor mode. Its just like creating a virtual interface which you'll use solely for monitoring purpose. Now this task is achieved my using airmon-ng and the new interface is called mon0.
Secondly, we use airodump-ng to capture packets from mon0 and store them in a file. Finally, we use aircrack-ng to use the data in the dump file to extract the password.

What problems are you going to face?

Most of the time, I have seen beginners are unable to configure their machines properly to a state where they can execute the commands. For this, look at the other tutorials.I am assuming you have Kali completely setup and running fine and accepting your wireless cards. So the problems-

1. Not enough data packets.
2. Not WEP enrypted. (i.e. WPA or WPA-2)
3. Hidden

Now the last two problems will be dealt with in the tutorials to come. The first problem is very common and there is no straightforward way to deal with it. You can only try to speed up the data capture rate. There are a lot of ways to do that. A lot depends on how far you are from the network. I am writing a complete tutorial for this. But remember, hacking requires patience. You're gonna need it when you get to higher levels where you will bruteforce networks for the passwords.
For now, here is a great tutorial on getting data packets fast.

Speeding Up WEP Hacking

Read full post »

Wifi Hacking - WEP - Kali Linux Aircrack-ng suite

Alright, this post is written assuming you have Kali Linux up and running on your computer. If not, here is a post on hacking with kali linux. It will tell you about what Kali Linux is, and how to use it. It will guide you through installation process.
So if you are still following, then just follow these simple steps-

Firstly, create a wireless network to crack. Don't use this method on others. It is illegal. Then proceed with the steps below.

1. Find out the name of your wireless adapter.

Alright, now, your computer has many network adapters, so to scan one, you need to know its name. So there are basically the following things that you need to know-

• lo - loopback. Not important currently.
• eth - ethernet
• wlan - This is what we want. Note the suffix associated.

Now, to see all the adapters, type ifconfig on a terminal. See the result. Note down the wlan(0/1/2) adapter.

2. Enable Monitor mode

Now, we use a tool called airmon-ng to  create a virtual interface called mon. Just type 

airmon-ng start wlan0

 Your mon0 interface will be created.

3. Start capturing packets

Now, we'll use airodump-ng to capture the packets in the air. This tool gathers data from the wireless packets in the air. You'll see the name of the wifi you want to hack.

airodump-ng mon0

4. Store the captured packets in a file 

This can be achieved by giving some more parameters with the airodump command

airodump-ng mon0 --write name_of_file

Now the captured packets will be stored in name_of_file.cap
You have to wait till you have enough data (10000 minimum)

5. Crack the wifi

If all goes well ,then you'll be sitting in front of your pc, grinning, finally you've got 10000 packets (don't stop the packet capture yet). Now, you can use aircrack-ng to crack the password. (in a new terminal)

aircrack-ng name_of_file-01.cap 

The program will ask which wifi to crack, if there are multiple available. Choose the wifi. It'll do its job. If the password is weak enough, then you'll get it in front of you. If not, the program will tell you to get more packets. The program will retry again when there are 15000 packets, and so on.

Note : This will not work with WPA-2. Here is a tutorial on -
Hacking wpa/wpa-2 wps with reaver on kali linux


Troubleshooting : Check this link if you failed to hack the network. 

The missing ingredient

Here is a comparatively advanced tutorial which will require you to have gone through this tutorial as well as the missing ingredient one. After you have got the big picture, you can move on to complicated things like speeding up wifi hacking.
Speeding Up WEP Hacking

Read full post »