LAB 10 Notes

In order to break the WPA passphrase, you need the following items:

The SSID (Service Set Identifier), or name, of the wireless network A WPA handshake A dictionary file

Wireshark

-protocol analyzer that allows you to capture or analyze network traffic. -You can analyze plain text Wireless traffic within Wireshark and even decrypt wireless traffic, if you provide the WEP key or the WPA/WPA2 passphrase

Monitor Mode

Certain versions of wireless cards can be put into monitor mode and will be able to capture all of the wireless traffic in range of their card.

WPA

Wi-Fi Protected Access (WPA) and WPA2 are much better encryption schemes -If an attacker can obtain the passphrase, they will be able to decrypt the network traffic and read all of the plain text information.

WEP

Wired Equivalent Privacy (WEP) -encryption protocol that was designed to be about as secure as "using the wire", -has a weakness in the way it was implemented in that if a hacker generates enough Initiation Vectors, or IV's, they can break the 64-bit or 128-bit WEP key.

airodump-ng

command can be used to passively capture wireless traffic.

airdecap-ng lab10wpa.cap -e WPACEH -p blackmail

decrypt traffic with wpa key. SSID must be specified and passphrase.

aircrack-ng lab10wep.cap

decrypt wep key

aircrack-ng lab10wpa.cap -w /root/Wordlist.txt

decrypt wpa key.

iwconfig

determine if backtrack has wireless cards if so it displays the details of the interface.

Managed mode

normal mode of operation for wireless cards. The card can be put into monitor mode using iwconfig

Aircrack-ng

suite of tools that can be utilized for monitoring, exploiting, and decrypting wireless network traffic

airdecap-ng -w 1234567ABC lab10wep.cap

use wep key to decrypt traffic.

aireplay-ng.

used to perform replay attacks for WEP cracking or de-authentication attacks

airodump-ng --help

view the options of airodump