Today, WEP and WPA have been considered deprecated due to numerous flaws in their security, and it’s recommended to upgrade or replace hardware utilizing these older protocols. Most networks today use WPA 2, with slow adoption to the newer WPA 3 standard. <\/p>\n\n\n\n
With WPA 2 being the commodity protocol for securing wireless networks for so long, there are many ways to attack WPA 2 networks, one being an attack on the authentication process itself. <\/p>\n\n\n\n
WPA 2<\/h2>\n\n\n\n
Before discussing how to attack WPA 2 authentication, this protocol must first be briefly understood. WPA 2 was developed by Wi-Fi Alliance in 2004 as a more robust replacement for WEP and WPA networks. Unlike WEP and WPA, WPA 2 utilizes AES encryption, and the encryption can easily be broken if the network’s password is weak. <\/p>\n\n\n\n
Although WPA 2 is stronger in encryption than its preceding WPA, the authentication process is still the same, using what’s called a four-way handshake. <\/p>\n\n\n\n
Four-way handshake<\/h2>\n\n\n\n
At a high level, an access point (authenticator) and a client device (supplicant) exchange four different messages containing various keys and random numbers to generate encryption keys to secure communication. This is known as the four-way handshake. <\/p>\n\n\n\n
The authenticator device, usually an access point, knows the network password, referred to as a Pre-Shared Key (PSK). When a supplicant device, or a client, wants to connect to the network using the password, they do not forward the password over the network but rather invoke different methods of cryptography to verify the client knows the password. If the hash forwarded by the supplicant matches what the authenticator expects, it has been proven the supplicant knows the PSK. <\/p>\n\n\n\n
From the nature of wireless networks, this handshake is broadcast for any device to listen to. If an attacker can capture the entire handshake process, they now have access to all of the components to generate a hash, and all they need is the PSK. An attacker can then turn around and brute force various passwords to generate different hashes, and if they find one that matches what they’ve captured, they can now gain access to the network. <\/p>\n\n\n\n
Penetration Testing Wi-Fi\/WPA2<\/h1>\n\n\n\nLegalities<\/h2>\n\n\n\n
The following demonstration is only intended for educational use. Before continuing with the example, it must be emphasized that this is a form of cyber attack, and engaging in these actions upon a network with which you do not have authorization to manipulate is illegal. If you were to follow along, only proceed with full certainty the network and devices are yours. <\/strong> <\/p>\n\n\n\n To perform an attack on the handshake process, there are a few tools required: <\/p>\n\n\n\n To discover the victim network, we must first set up the antenna. For demo purposes, I am using an Alfa AWUS036ACS using aircrack-ng’s open-source drivers<\/a>. The installation guide I used to install can be found here<\/a>. <\/p>\n\n\n\n After verifying the antenna is working as expected, we need to place the antenna into monitor mode. By default, most network devices are set to managed mode, where it will only process traffic specified to it. <\/p>\n\n\n\n By setting the device into monitor mode, the network device will process all traffic in its proximity on all supported channels. We can use the following commands to kill all processes using the network device and set it to monitor mode: <\/p>\n\n\n\n In my case: <\/p>\n\n\n\n If following along, replace the interface with your system’s wireless interface. Do note if a device’s primary network adapter is set to monitor mode, all internet connections will cease until set back to managed mode. This is why I am using an external antenna. <\/p>\n\n\n With the network device set to monitor mode, use the following command to display all traffic showing in our proximity and locate the target network: <\/p>\n\n\n\n In my case:<\/p>\n\n\n\n When the target network’s broadcasted name, or ESSID, is discovered, hit the spacebar to pause the output, and take note of the network’s MAC address, or BSSID, and channel (CH). In this case, our network is on channel 6 with the BSSID 94:83:C4:30:FD:E0. Use ctrl+C<\/strong> to kill the process. <\/p>\n\n\n\n To specifically listen to this network, use the following command: <\/p>\n\n\n\n In my case:<\/p>\n\n\n\n Here, the -w<\/strong> flag writes the traffic to a file where you can specify the filename, the -c<\/strong> and –bssid<\/strong> flags are used to specify the channel and BSSID previously captured, and the final argument is the network interface in use. <\/p>\n\n\n At this stage, we can either wait for a client device to join the wireless network, or we can be more aggressive. The latter is more fun and loud (more likely to be noticed or detected), so let’s do that instead! <\/p>\n\n\n\n Keeping the previous command active, we can open a second terminal window to perform what’s known as a deauthentication attack. Before executing this attack, it’s nice to understand how it works. <\/p>\n\n\n\n Our mobile devices, such as our laptops and phones, are not very mobile from a wireless connectivity standpoint. If we have a device in one room next to a particular access point, or AP, and moved that connected device into another room with a different AP, our mobile device will tunnel vision and continue attempting to connect to its source regardless that a stronger connection exists. <\/p>\n\n\n\n Often, networks with multiple APs can measure the connection strength of client devices to each AP in the network. From this, the network can decide if there’s a different AP a client can connect to for the best connectivity. If this is the case, the network will send a deauthentication frame, which boots the client device from the network, forcing it to reconnect and look around for a new connection. The client will then discover the AP closest to it and reestablish a connection with the strongest link. <\/p>\n\n\n\n The problem here is, deauthentication frames do not have any signing. Meaning, any device in the network can send one. Sending a stream, or multiple deauthentication frames is known as a deauthentication attack. This extremely loud attack can knock out an entire network, but we will use it for something else. In terms of attacking the WPA2 handshake, we are sending a deauthentication frame to the router to briefly restart and force the handshake process with the clients again. <\/p>\n\n\n\n In the second terminal window, we can execute a deauthentication attack to the router by typing: <\/p>\n\n\n\n In my case:<\/p>\n\n\n\n The key argument in this command is <\/em>—deauth 0<\/strong>. The 0<\/strong> flag in the –deauth<\/strong> argument indicates there is no limit to how many frames are sent, which creates a deauthentication attack. We also need to specify what the victim BSSID is, in our case the router, and the interface used to send the frames. <\/p>\n\n\n This may take some time, but eventually, a victim device (D2:7E:D2:DE:E2:8F) will connect and handshake with the victim router. In the first terminal window, airodump-ng has indicated it has successfully captured the handshake, and a “WPA handshake: <BSSID>” message will appear. <\/p>\n\n\n After receiving the success message, use ctrl+C<\/strong> on both terminal windows to stop all processes. Next, search for the filename specified in previous steps, in our case, “capture,” and locate the .cap file. <\/p>\n\n\n Use the following command to open the capture file in Wireshark: <\/p>\n\n\n\n In my case:<\/p>\n\n\n\n Once opened, search for “eapol” to filter the packets in the four-way handshake. Notice there are at least four packets! <\/p>\n\n\n After verifying these packets are present, close Wireshark and set the network device back into monitor mode: <\/p>\n\n\n\n In my case:<\/p>\n\n\n\n Now, let’s crack some passwords! To specify the captured file and the wordlist you want to use, use the following command: <\/p>\n\n\n\n In my case:<\/p>\n\n\n\n Rockyou.txt is a great resource with millions of passwords found throughout various breaches. If you are using Kali Linux, rockyou.txt is pre-installed in \/usr\/share\/wordlists\/rockyou.txt<\/strong>, but since I am on Ubuntu, I had to download mine from the internet, so change the path accordingly. <\/p>\n\n\n If a victim network’s password exists in the wordlist, profit!<\/p>\n\n\n This attack, although powerful, has many disadvantages due to the prerequisites for a successful attack, making it impractical. <\/p>\n\n\n\n Although unlikely, it’s still recommended to adopt stronger security practices. <\/p>\n\n\n\n Strengthening the network’s password using random characters, words, and phrases, and increasing length can significantly decrease the likelihood that it appears in a wordlist like rockyou.txt. Remember, this attack is pivoted upon the assumption the unknown password is in a wordlist on top of the risks previously mentioned. However, regardless of the likelihood of this particular attack, it is always best practice to enforce strong network passwords. <\/p>\n\n\n\n If possible, also consider upgrading the entire network to WPA3. Because of WPA2’s age, there are many tested and working exploits that enable unauthorized network access that are mitigated with an updated security protocol. Based on the devices used, upgrading to WPA3 could require hardware replacements or is as simple as navigating to the device’s settings and enforcing WPA3 encryption only. <\/p>\n\n\n\n Wi-Fi Security Wi-Fi is a family of networking protocols that enable wireless communication and networking for devices. As a result of its popularity, wireless networks…<\/p>\nMaterials<\/h2>\n\n\n\n
\n
Monitor mode<\/h2>\n\n\n\n
sudo airmon-ng check kill\nsudo airmon-ng start <wireless-interface><\/code><\/pre>\n\n\n\nsudo airmon-ng start wlx00c0caaab527<\/code><\/pre>\n\n\n\n![\"Using](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/1.-kill-processes-start-monitor-mode.png\")
<\/figure><\/div>\n\n![\"Verifying](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/2.-verify-monitor-mode.png\")
<\/figure><\/div>\n\n\nDiscovering target network information (BSSID and channel)<\/strong> <\/h2>\n\n\n\n
sudo airodump-ng <wireless-interface><\/code><\/pre>\n\n\n\nsudo airodump-ng wlx00c0caaab527<\/code><\/pre>\n\n\n![\"Using](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/3.-scan-networks-around.png\")
<\/figure><\/div>\n\n![\"Airodump-ng](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/locate-target-network-blurred.png\")
<\/figure><\/div>\n\n\nTargeting the victim network<\/h2>\n\n\n\n
sudo airodump-ng -w <filename> -c <channel-number> --bssid <bssid> <interface><\/code><\/pre>\n\n\n\nsudo airodump-ng -w capture -c 6 --bssid 94:83:C4:30:FD:E0 wlx00c0caaab527<\/code><\/pre>\n\n\n\n![\"Focus](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/5.-focus-on-target-network-save-to-cap-file.png\")
<\/figure><\/div>\n\n![\"Airodump](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/6.-focus-on-target-network.png\")
<\/figure><\/div>\n\n\nPenetration testing the victim network<\/strong> <\/h2>\n\n\n\n
What is a deauthentication attack?<\/strong><\/h2>\n\n\n\n
Deauthentication attack<\/strong> <\/h2>\n\n\n\n
sudo aireplay-ng --deauth 0 -a <bssid> <wireless-interface><\/code><\/pre>\n\n\n\nsudo aireplay-ng --deauth 0 -a 94:83:C4:30:FD:E0 wlx00c0caaab527<\/code><\/pre>\n\n\n\n![\"Terminal](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/7.-deauth-attack.png\")
<\/figure><\/div>\n\n\nCapturing the handshake<\/strong> <\/h2>\n\n\n\n
![\"Terminal](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/8.-capture-handshake.png\")
<\/figure><\/div>\n\n\nCracking the handshake<\/strong><\/h2>\n\n\n\n
![\"Locating](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/9.-find-capture-file.png\")
<\/figure><\/div>\n\n\nwireshark <filename>.cap<\/code><\/pre>\n\n\n\nwireshark capture-01.cap<\/code><\/pre>\n\n\n\n![\"Finding](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/10.-open-in-wireshark-find-handshake-packets-1024x528.png\")
<\/figure><\/div>\n\n\nsudo airmon-ng stop <wireless-interface><\/code><\/pre>\n\n\n\nsudo airmon-ng stop wlx00c0caaab527<\/code><\/pre>\n\n\n![\"Stop](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/11.-stop-monitor-mode.png\")
<\/figure><\/div>\n\n![\"Verify](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/12.-verify-monitor-mode-stopped.png\")
<\/figure><\/div>\n\n\naircrack-ng <filename>.cap -w <wordlist-path><\/code><\/pre>\n\n\n\naircrack-ng capture-01.cap -w ~\/Downloads\/rockyou.txt<\/code><\/pre>\n\n\n\n![\"Using](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/13.-crack-wifi-password.png\")
<\/figure><\/div>\n\n\n![\"Profit!\"](\"https:\/\/blogs.dsu.edu\/digforce\/wp-content\/uploads\/sites\/6\/2023\/07\/14.-profit.png\")
<\/figure><\/div>\n\n\nProtecting Yourself<\/h1>\n\n\n\n
\n
Stronger passwords<\/h2>\n\n\n\n
WPA 3<\/h2>\n\n\n\n
Resources<\/h1>\n\n\n\n
\n