-: In this lesson, I'm going to demonstrate how to conduct an
initialization vector attack on a
WEP-protected access point.
As I said before, WEP is extremely insecure because
it only uses a 24-bit initialization vector.
Regardless of what key you choose, this attack is going to
work every single time.
This is the reason that I say you never, ever want to use
WEP in your networks.
If you find a network using WEP in your organization,
you should immediately work to upgrade it to WPA2, instead.
Let's jump into the lab and I'll show you exactly
how this works.
So, the first thing we're going to do is where you're going to
start with airodump-ng and then the card that we have,
which is wlan0mon.
And notice it's starting to scan for that particular
network that we're looking for.
In our case, we already found it, it is wireless hacking.
This WEP network right here.
And this is the BSSID, or the MAC address for that network.
So, for us to attack it, we are going to use airodump-ng again.
And in this case, we are going to specifically tell it
which channel we want to go after, which is channel one,
right here, from the wireless hacking network.
We want to go after the BSSID that was provided
for that network, and we want to go ahead
and write that data to a file which is going to be
wireless hacking dump, is what we're going to call that file.
And then we're going to give it the card itself,
which is wlan0mon, and hit enter, and off it goes
starting to scan the network, which is helpful.
But we're not quite there yet.
Notice the data packets are climbing, but we haven't yet
associated ourself to that network to be able to start
doing things like packet injection and capturing those
initialization vectors.
So, I'm going to go ahead and put this up here to make some
extra room and we'll just bring that right across the top
and let it continue to run.
We're going to open up a new terminal and I'm going to bring that
down here to the bottom.
Now, in the new terminal, what I need to do is I need to
start doing a authentication to the network using
fake authentication, which is our first step in the hack.
So, that first step in the hack is that we are going to do
a program called aireplay, and in aireplay-ng,
we are going to use fakeauth as our command,
zero for infinite attempts, dash a and the MAC address
that we are going after, which again we still
have pasted right there.
And then, we're going to use the MAC address that we are
coming from, which we have to find ourself.
So, we are going to open up another terminal,
as you can see how you start getting quite a few terminals,
and just type in something like ifconfig.
When you do that, you're going to get the MAC address
for wlan0mon, and the first 12 digits here is that
MAC address for our network card.
So, I'm just going to copy that and then we can paste that in.
Now, this use dashes, but for this particular command,
you have to use colons, so I'm going to arrow through
and change those to colons, as you can see.
And the command's not done yet because what's the one thing
we haven't told it?
We haven't told it which card to use.
So, we have to use wlan0mon, and then we will hit enter,
and off it goes sending a authentication.
We now have an authentication made with this network.
So, we can move into the second phase of our attack,
which is going to be the packet injection.
So, for the packet injection, we are going to still use
the aireplay command.
Most of it is going to be the same, so what I'm going to do
instead of typing it all is hit the up arrow,
which will bring back the last command I used.
The big differences here is we are not going to use
fake authentication anymore.
Instead, we want to use an arpreplay so that we can create
additional traffic on this network.
Instead of a for the access point, we're going to use b for the
access point, which tells it that's the base station.
We're still going to use the card that we're coming from
and the network card wlan0mon.
When we hit enter, off it goes, and notice that we have
a couple of arp packets here, and our data is
going to start going up.
We have a lot of frame loss.
Once you have a couple of arp requests that have
been successful, you can hit Control + c and stop that.
Now, with this attack, it does help if this
is a busy network.
Right now, as we're doing this, you can see the
data packets are going up.
The reason those data packets are going up is because
I'm streaming YouTube on the device, this base station here,
which this client, which is my iPhone, is talking to this
access point and streaming YouTube, which is collecting
a lot of data.
Now, the next thing you want to do is start cracking.
Every 5,000 data packets that go up, it will start trying
to do another attempt.
It's really easy, you just use aircrack-ng, and then the
file name of what you're going to be using.
Let me clear the screen here, and the file that I'm going to
be using is wirelesshackingdump-02.cap.
The reason it's the second one is because I've run this
attempt once before showing you.
So, all we're going to use is aircrack-ng and then the
file name that you're going after, and hit enter.
Off it goes, starting to crack away.
Right now, it already has 14,000 initialization vectors
collected, and you can see that here from the data,
but that wasn't enough.
So, when this hits 15,000, you're going to see this kick off
again without me doing anything, and we'll see if we
can crack that key.
So, here it goes again.
It's going off and testing the different keys.
And it didn't find it.
So, it'll try again at 20,000.
Generally, it's going to find it somewhere between
10,000 and 25,000.
It really depends on where that particular key is inside
the key space, depending on what that hexadecimal
password was that we used.
So, again, you can see the data packets climbing up
as I'm streaming different YouTube videos.
Every time I start another video, it starts
downloading all that data.
All those frames have an initialization vector in there,
and they're able to be captured so that we can
start seeing that information.
So now, we have over 20,000.
It's going to try again and there it is.
It found our key.
17, 25, 83, A-E-F-A.
So, we now have a key.
What are we going to do with it?
Well, the next thing we want to do is we want to see if that
key actually works and be able to get onto a network.
We can do that through Kali or we can do it
through your Windows machine or your Mac machine,
it depends on what you're ultimate goal is.
For this example, I'm going to show you how to use it
inside your Macintosh machine.
You can do the same thing in Windows, and again, in Kali.
If we can cancel this capturing at this point,
so we'll hit Control + c, and we're going to switch back
to our client machine, in my case Macintosh.
So, now that we're back on our Windows or our
Macintosh machine, you'll connect to that
wireless network just like you normally do.
So, we're going to go down to wireless hacking, and it's
going to ask us for the passcode.
My passcode that we just cracked was 17, 25, 83, A-E-F-A,
and if I go ahead and join, we should see if I can pull
an IP address from this network.
And if we look at it, you can see here we did pull an IP
address from this network, and we are connected to that
access point starting with c8 a7, that BSSID,
which is the one for wireless hacking.
So, our hack did work and it was successful.