Carding
Professional
- Messages
- 2,871
- Reaction score
- 2,308
- Points
- 113
Everything brilliant is simple. And before you start brute – forcing hashes and sorting through WPS passwords, it's best to start with a simple one.
Everything brilliant is simple. And before you start brute – forcing hashes and sorting through WPS passwords, it's best to start with a simple one. The attack that we will discuss today is effective in the immediate vicinity of the attacked point. The more powerful your signal – the more effective the attack. The effect directly depends on the area covered by the attacked access point. For example, if you are located in an office building and the access point is located in one office, the client is in another, and you and your laptop managed to fit in the corridor between them – this is a direct profit. We will talk about how to implement such an attack and how to achieve maximum power from your Wi-Fi adapter in this article.
What is a fake access point?
A fake or fraudulent access point is one that behaves exactly like the real one and forces the end user to connect to it. In our aircrack-ng Suite, there is a tool called airbase-ng that you can use to turn your wireless adapter into an access point. This is a powerful client-side hack that allows you to see all traffic and conduct an intermediary attack.
What shall we do
In this scenario, we will assume the role of a private investigator. A client has asked us to investigate the possibility that his neighbor is downloading and selling child pornography. We need to find out if this is really the case, and then gather evidence against him.
Step 1: Launch Airmon-Ng
First, we need to check if our wireless card is working.
As you can see, our wireless card is quite functional and is called wlan0. The next step is to switch the wireless card to monitoring mode, also called mixed mode. To do this, run the following command:
Airmon-ng switched our card to monitoring mode and changed its name to mon0. Now our card is able to accept any wireless traffic.
Step 2: Run Airdump-Ng
Next, we need to start intercepting traffic using our wireless card. To do this, enter:
We see all wireless access points within their scope, as well as their important statistics. A neighbor suspected of downloading and selling child pornography uses an access point with the SSID "Elroy".
If we do everything right, we can clone his access point and force him to connect to our rogue wireless access point. After that, we will be able to monitor all his traffic and insert our own packets/messages/code into his computer.
Step 3: Wait for the suspect to connect to the access point
Now all we have to do is wait for the suspect to connect to his access point. Once this happens, you will see a corresponding message at the bottom of the airodump-ng screen.
Step 4: Create a new access point with the same SSID and MAC address
After the suspect connects to their access point, we can use airbase-ng to create a fake access point. Open a new terminal window and type:
Create a new access point with the same SSID and MAC address
Where 00: 09: 5B: 6F: 64: 1E is the BSSID, Elroy is the SSID, and -c 11 is the suspect's hotspot channel.
Step 5: Deauthenticate or disconnect from the access point
Now we need to disconnect the "neighbor" from its access point. In the 802.11 standard, there is a special frame called deauthentication, which, as you might expect, throws everyone out of the access point. When his computer tries to log in again, he will connect to the access point with the ESSID "Elroy", which has the strongest signal.
To do this, we can use aireplay-ng with the deauth package:
Note that we reused its BSSID in the aireplay-ng command. If our signal is stronger than that of their own access point, the suspect will automatically connect to our fake network !
Step 6: Increase the fake point power
One of the most important aspects of hacking using this method is that the fake access point signal must be stronger than the original access point signal. If there is no physical access, this can become a critical vulnerability. In airports and other public places, there is no problem, but in this scenario, we do not have physical access and it is very likely that his point is closer and transmits a more powerful signal than ours. But don't despair!
First, we can increase the capacity of our own access point. This may work because most access points automatically reduce their signal strength to a minimum value that is sufficient to maintain client connections. To increase the power of your point to the maximum, enter:
After executing this command, the power of our access point will come very close to the legal limit in the United States of 27 dBm or 500 milliwatts.
In some cases, even increasing the capacity to 500 mW may not be enough. If we try to raise the signal strength of our Alfa wireless card to the maximum possible 1000 mW or 30 dBm, we will get an error message, which you can see in the screenshot below (some of the new cards are capable of transmitting a signal of up to 2000 mW, which is four times higher than the limit allowed in the United States).
Increasing the capacity of the access point
Each country has its own laws governing Wi-Fi. Some States allow the use of more channels and signals of higher power than the United States. For example, Bolivia allows you to use 12 channels and 1000 mW of power. To switch our card to the Bolivian restrictions, just enter:
Being in the regulatory domain of Bolivia, we can increase the power of our signal to the maximum by using the following command:
Check the output power with the command:
Increase the capacity of your own access point
Judging by the end of the second line, the power of our signal is now 30 dBm or 1000 mW. This is enough to overcome any local access point, even at a distance of several houses!
Fake access point works
Now that a neighbor has connected to our access point, we can analyze their activities.
For example, we can use an application like Ettercap to perform an intermediary attack. Thanks to this, we will be able to intercept and analyze his traffic and even send our own traffic to his computer. In other words, because it connected to our access point, we got full control over all incoming and outgoing data. If they actually upload child porn, we'll see.
In addition, we can intercept emails and passwords to other applications and networks. If you want, we can even implement meterpreter or another wiretapping application in its system if you want to get more information.
Everything brilliant is simple. And before you start brute – forcing hashes and sorting through WPS passwords, it's best to start with a simple one. The attack that we will discuss today is effective in the immediate vicinity of the attacked point. The more powerful your signal – the more effective the attack. The effect directly depends on the area covered by the attacked access point. For example, if you are located in an office building and the access point is located in one office, the client is in another, and you and your laptop managed to fit in the corridor between them – this is a direct profit. We will talk about how to implement such an attack and how to achieve maximum power from your Wi-Fi adapter in this article.
What is a fake access point?
A fake or fraudulent access point is one that behaves exactly like the real one and forces the end user to connect to it. In our aircrack-ng Suite, there is a tool called airbase-ng that you can use to turn your wireless adapter into an access point. This is a powerful client-side hack that allows you to see all traffic and conduct an intermediary attack.
What shall we do
In this scenario, we will assume the role of a private investigator. A client has asked us to investigate the possibility that his neighbor is downloading and selling child pornography. We need to find out if this is really the case, and then gather evidence against him.
Step 1: Launch Airmon-Ng
First, we need to check if our wireless card is working.
Code:
bt > iwconfig
Launch Airmon-NgAs you can see, our wireless card is quite functional and is called wlan0. The next step is to switch the wireless card to monitoring mode, also called mixed mode. To do this, run the following command:
Code:
bt >airmon-ng start wlan0
airmon-ng start wlan0Airmon-ng switched our card to monitoring mode and changed its name to mon0. Now our card is able to accept any wireless traffic.
Step 2: Run Airdump-Ng
Next, we need to start intercepting traffic using our wireless card. To do this, enter:
Code:
bt > airodump-ng mon0
Run Airdump-NgWe see all wireless access points within their scope, as well as their important statistics. A neighbor suspected of downloading and selling child pornography uses an access point with the SSID "Elroy".
If we do everything right, we can clone his access point and force him to connect to our rogue wireless access point. After that, we will be able to monitor all his traffic and insert our own packets/messages/code into his computer.
Step 3: Wait for the suspect to connect to the access point
Now all we have to do is wait for the suspect to connect to his access point. Once this happens, you will see a corresponding message at the bottom of the airodump-ng screen.
Step 4: Create a new access point with the same SSID and MAC address
After the suspect connects to their access point, we can use airbase-ng to create a fake access point. Open a new terminal window and type:
Code:
bt > airbase-ng -a 00:09:5B:6F:64:1E --essid "Elroy" -c 11 mon0Create a new access point with the same SSID and MAC address
Where 00: 09: 5B: 6F: 64: 1E is the BSSID, Elroy is the SSID, and -c 11 is the suspect's hotspot channel.
Step 5: Deauthenticate or disconnect from the access point
Now we need to disconnect the "neighbor" from its access point. In the 802.11 standard, there is a special frame called deauthentication, which, as you might expect, throws everyone out of the access point. When his computer tries to log in again, he will connect to the access point with the ESSID "Elroy", which has the strongest signal.
To do this, we can use aireplay-ng with the deauth package:
Code:
bt > aireplay-ng --deauth 0 -a 00:09:5B:6F:1ENote that we reused its BSSID in the aireplay-ng command. If our signal is stronger than that of their own access point, the suspect will automatically connect to our fake network !
Step 6: Increase the fake point power
One of the most important aspects of hacking using this method is that the fake access point signal must be stronger than the original access point signal. If there is no physical access, this can become a critical vulnerability. In airports and other public places, there is no problem, but in this scenario, we do not have physical access and it is very likely that his point is closer and transmits a more powerful signal than ours. But don't despair!
First, we can increase the capacity of our own access point. This may work because most access points automatically reduce their signal strength to a minimum value that is sufficient to maintain client connections. To increase the power of your point to the maximum, enter:
Code:
iwconfig wlan0 txpower 27After executing this command, the power of our access point will come very close to the legal limit in the United States of 27 dBm or 500 milliwatts.
In some cases, even increasing the capacity to 500 mW may not be enough. If we try to raise the signal strength of our Alfa wireless card to the maximum possible 1000 mW or 30 dBm, we will get an error message, which you can see in the screenshot below (some of the new cards are capable of transmitting a signal of up to 2000 mW, which is four times higher than the limit allowed in the United States).
Code:
iwconfig wlan0 txpower 30Increasing the capacity of the access point
Each country has its own laws governing Wi-Fi. Some States allow the use of more channels and signals of higher power than the United States. For example, Bolivia allows you to use 12 channels and 1000 mW of power. To switch our card to the Bolivian restrictions, just enter:
Code:
iw reg set BOBeing in the regulatory domain of Bolivia, we can increase the power of our signal to the maximum by using the following command:
Code:
iwconfig wlan0 txpower 30
iwconfig wlan0 txpower 30Check the output power with the command:
Code:
iwconfigIncrease the capacity of your own access point
Judging by the end of the second line, the power of our signal is now 30 dBm or 1000 mW. This is enough to overcome any local access point, even at a distance of several houses!
Fake access point works
Now that a neighbor has connected to our access point, we can analyze their activities.
For example, we can use an application like Ettercap to perform an intermediary attack. Thanks to this, we will be able to intercept and analyze his traffic and even send our own traffic to his computer. In other words, because it connected to our access point, we got full control over all incoming and outgoing data. If they actually upload child porn, we'll see.
In addition, we can intercept emails and passwords to other applications and networks. If you want, we can even implement meterpreter or another wiretapping application in its system if you want to get more information.
