Hacking with theft over Wi-Fi

[Jollier]

Background.
An average city, let's call it N, was hosting a crypto conference. Let's call the location "MyTarget". So, there were several Wi-Fi access points, vulnerable access points, which was simply a sin not to use. Armed with a laptop with Linux on board, a Wi-Fi adapter (for range), I went in the direction of MyTarget in order to refill my pockets with evergreen.

Stage 1. Preparatory.
I went to a small cafe that was in close proximity to MyTarget. There were no cameras, which undoubtedly played into my hands. I plug in the adapter, go into the system, start AirGeddon.

I choose an adapter, put it into monitor mode, and look for a target (access point). The most interesting. Pixie-Dust Attack!

It allows you to get a password from Wi-Fi using WPS. We launch the attack:

After a short period of time, I received a WPS pin, and thanks to it and Airgeddon, I got the Wi-Fi password.

Conclusion: WPS is vulnerable, so disable it in the router settings, do not make it easier for a hacker.

Stage 2. Main.
Having gained access to the local network, it was necessary to understand who was sitting on it. To do this, I entered the command in the terminal:

netdiscover

Thus, I found out who is on the local network. The most interesting ones turned out to be a laptop with Windows on board, as well as a couple of android smartphones. I decided to stay on a laptop with Windows, then I realized that I was not mistaken.
In addition, I found out the address of the router, which allowed me to go to the admin panel of the router. Everything is standard - admin; admin. I have access to the router. Here came the great idea of infecting the computer by spoofing a DNS request and a 0-day vulnerability in the browser.
I had my own DNS server in Estonia, which I used for exactly this purpose. Instructions on how to set up your DNS server on a VPS and an example DNS spoofing attack:
Before spoofing DNS on the router, I flooded other devices besides the laptop on Windows, so as not to confuse other users and not infect them (this could cause a stir). Excellent! 92% of all work completed.

Conclusion: do not use standard passwords, always change them.

Stage 3. Final.
Then there was little to do - to wait until the victim entered somewhere and his PC was already infected with my Trojan. Success! Using a vulnerability in older versions of the browser, it was possible to infect the victim!
Then I received logs, wallet.dat from wallets, all text files from the desktop into my admin panel. It remains only to work them out and get a profit.
I went through all well-known crypto-exchanges, leaked balances from there. Surprisingly, 2FA is only installed on 1 of them. Moreover, it was installed on the mail to which I had access (the Trojan was stealing cookies). Thus, I only withdrew $ 12,000 from the exchanges in ether, bitcoin and other altos. There were many coins from all sorts of ICOs, which I also successfully merged.
I checked all payment systems, reached PayPal, the balance of which was about $ 1800.
It remains to process only the cold wallet files. On one of the well-known shadow forums, I found a person who leaked all the money for 40%, I got about $ 3500. And there was also the data of the bank account in the textbook, the man turned out to be a rich foreigner, who very quickly became impoverished. I leaked the data to a friend in exchange for some software (top secret).

Conclusion: set complex passwords, as well as update the software, because if it were not for the vulnerability in the browser, I would hardly have taken so much) And clean the cookies! Don't connect to public hotspots without using DNS-Crypt and VPN.

 

[Hacker]

Hacking wi-fi. WPS.
Everyone wanted to know how to hack a neighbor's wi-fi? Here!)
This method selects passwords only for WPS networks. You can now say that this is pointless, because WPS is now no longer relevant and does not use it. But. I hasten to disappoint you, a huge number of networks are still with WPS, including zabugorom. So the method is quite working.
Today I decided to write an ordinary guide on choosing a password for a Wi-Fi network thanks to the wifislex software.

What we need:
- Smooth handles, because without them anywhere
- Flash memory (min. 2GB)
- Our working software wifislax
- Software to cut the image (ultra iso lovers pass by, as the image will not stand up, and there is no need to cry)
- Ability to drink tea, eat cookies and watch TV shows.

The process itself:
1. Download the wifislax disk image from the off-site www.wifislax.com
2. Roll up the image on a flash drive.
Penguins (linuxoids) know for themselves what to do and how to do it.
3. Boot from the flash drive from under bios-a, first do not forget to set the download.
4. Search for the pixie script tool in the Wps section.
5. We remember about our main skill and go to drink tea, eat yummy food, and watch TBV or Sherlock.
At the output, in conjunction with the nanostash antenna (it is possible to use a biquadrate, but the result will be different), I got 4 hacked points in ~65 minutes. But you can put the process on overnight, let it work, and forget about it.
This script saves all the data to the folder of the same name.

 

[Lord777]

Hacking the neighbor's Wi-Fi
Especially for beginners, I decided to write down a guide on hacking Wi-Fi using only an Android smartphone.

Foreword
We all know that wi-fi networks can be hacked, but the methods are sometimes difficult. Most do not want to steam and deal with Kali Linux, wareshark, aircrack and similar topics, despite the fact that there is plenty of information in the same clearnet.
Today's post is aimed at those who do not want to understand anything, but at the same time want free internet.
To "identify vulnerabilities" we will use regular android applications. The only thing that is required is ROOT rights, but I am sure there will be no problems with obtaining them (a lot of information on w3bsit3-dns.com).

Three applications are used:

1: WifAccess
2: Wps Wpa Tester
3: Wifi WPS Unlocker [Unlocked]

All three applications exploit the vulnerability of routers with "standard" WPS passwords. Specifically, I'll tell you about each below.

Step one (WifAccess)
After opening the application, we are immediately shown a list of available networks:

Those networks that cannot be hacked are marked in red.
The networks that we have already saved and to which we can connect are marked in blue.
Green color marked the networks that we can test for vulnerabilities.

Select the network and click on it:

Further "Automatic testing":

After that, there is an enumeration of possible WPS passwords. When the scan is over, it will show data about the compromised network, or, as in my case, that "PIN not found":

This concludes with this application.

Step two (Wps Wpa Tester)
There is already a more interesting application, with its help I managed to get passwords from several networks in different places. In essence, it is almost the same as the previous one, but, apparently, the database of possible PINs is larger. Let's start.

As soon as we go into the application, click "Accept" and then click on the round update button from above.
Now it shows us which networks are possible for testing:

Again, those networks are highlighted in green, which are more likely to be hacked, and those with a low chance are highlighted in yellow.

At the bottom right, there must be a check mark "Wps Only", because our "testing" is carried out just on routers that use wps.

I selected the Sagemcom network:

Нажимаем "Connect Automatic PIN".

If it didn't work the first time, change the checkboxes from "New Method" to "Old Method" on top and vice versa.

After several tries and different variations, here's what happened:

Now we have a password for the network, which is automatically saved to the phone, so it will not be necessary to enter it, but just in case it is better to screen it.

If you click on the floppy disk icon next to the "refresh" button in the main menu with a list of networks, the entire list of saved networks on your smartphone will appear:

By the way, the vulnerabilities DIR-615 and flat56 were detected by another application, which will be discussed below.

Step three (Wifi WPS Unlocker)
I consider it to be the most successful of these three in terms of the "number of possible pins" criterion.
Go. Having opened the application, immediately click on the "SCAN" button and a list of networks appears in front of us:

The checkboxes are, as you probably understood, on those networks to which we already have access.
The percentage you see is the signal strength of the network, or power, whichever is more convenient.

We select the network we need, click on it -> "Yes" and see the following:

"The router not included in list of vulnerable routers, but similar model is vulnerable". This means that such a router is not on the list of possible hacks, but there is a very close model similar to it. If it says in green "The router included in list ...", then it is in the list.

The automatic checkbox is on "Try All PINs" and I recommend not to touch it. Press "CONNECT" and wait for the result:

Unfortunately, our "cracker" could not find the correct pin for this router. But ... do you think that's all? But no, this is where the fun begins.

We have a cracked paid version, so there is an additional "paid" list of PINs.
We go back to the network we need, click "Yes" and then click "More PINs". Click on the connection:

Each of them will have to be tested manually. Click on "NO root", I personally test it this way, you can try with "root", but I always succeeded without it.

Next, you either get out a window with data, or a window with a failure, in which you click "ok" and then test each PIN in turn.

Thanks to this application, as I said, it turned out to find out the passwords flat56 and DIR-615. But now, when I wanted to show the work of this application, for some reason flat56 does not lend itself to. Maybe the neighbors changed the router, or maybe something else ...

Application links:
Wifi Access
Wps Wpa Tester
Wifi WPS Unlocker

All of them were found on w3bsit3-dns.com, so if someone is afraid to download, you can search for yourself.