Futaba _ Webs 🕸🕸🎃🕸🕸

🎃 Wifi Hacking with Aircrack-ng

Premise 🕸🕸🎃🕸🕸

So how does the process work? Well it depends on the type of Wireless security you are trying to crack. In this case since it’s WPA2, the end goal is to intercept the main handshake that occurs between the host and access point when it connects to the network.

Now you might be wondering, how do you get that information if host systems are already connected to AP? The handshake is complete so there’s no way to get that information right? Wait for them to reconnect? Why wait when you can just force them. What you essentially need to do in order to bypass the security, is “de-authenticate” them from the network, forcing them to reconnect.

In order to do this you need to tell the AP directly to de-authenticate them since it’s impossible to talk to the specific hosts on the network when you don’t have access to it.Think of the WAP as an HTTP web application server you can send requests and various HTTP headers to, to invoke various responses. In this process we are essentially doing the same thing, sending the right data packets in order to kick end users off the main access point and scan for the handshake in the process. All you NEED, is the right NIC card to perform passive recon for data packets.

The first step is to use airmon-ng in order to place your main NIC card into something that is called “monitor mode”. Monitor mode allows your NIC card to perform passive recon and sniff out any WAP’s, as well as host systems connected to them. It can also be used to check and kill any processes that might interfere with the scan such as the NetworkManager service for example. The next step is to use the airodump-ng command in order to scan RF channels to search for the SSID of the network AP you wish to target.

Once found, you can hone in on the AP and see any and all main systems that are connected to it as well, including any MAC addresses that could possibly allow you to bypass stuff like MAC filters that require you to have a trusted MAC address in order to connect to the network.

Next thing you want to do, while scanning the main AP with airodump-ng is pop open another shell session and then use the aireplay-ng command in order to send authentication packets to force end users to reconnect in order to secure the handshake. THIS PROCESS DOES TAKE TIME.

Now the question is, how to defend against this. Nowadays, AP’s are essentially “randomizing” the frequency channel to prevent people from scanning the access point.If you can’t scan it, then you can’t see the hosts that are on the network, as well as secure the main handshake. It’s something so simple that can stop hackers in their tracks.