Settings
Log out
To find the security level of a WiFi Access Point, we need to crack that WiFi connection like the same way a cracker do.
To do that we need certain info like the bssid, channel, handshake, wordlist that may have the password inthat list.
Here, we are going to crack a wifi, which means we need a wireless adapter which should have the promiscuous mode, which allow us to capture all the info about the available access points around us.
For this session, we'll need to use a compatible wireless network adapter.
This is similar to putting a wired adapter into promiscuous mode. It allows us to see all of the wireless traffic that passes by us in the air.
Let's open a terminal and type:
Note that airmon-ng has renamed your wlan0 adapter to Wlan0mon0.
Now that our wireless adapter is in monitor mode, we have the capability to see all the wireless traffic that passes by in the air. We can grab that traffic by simply using the airodump-ng command.
This command grabs all the traffic that your wireless adapter can see and displays critical information about it, including the BSSID (the MAC address of the AP), power, number of beacon frames, number of data frames, channel, speed, encryption (if any), and finally, the ESSID (what most of us refer to as the SSID). Let's do this by typing:
Note all of the visible APs are listed in the upper part of the screen and the clients are listed in the lower part of the screen.
Our next step is to focus our efforts on one AP, on one channel, and capture critical data from it. We need the BSSID and channel to do this. Let's open another terminal and type:
In order to capture the encrypted password, we need to have the client authenticate against the AP. If they're already authenticated, we can de-authenticate them and their system will automatically re-authenticate, whereby we can grab their encrypted password in the process. Let's open another terminal and type:
In the previous step, we bounced the user off their own AP, and now when they re-authenticate, airodump-ng will attempt to grab their password in the new 4-way handshake. Let's go back to our airodump-ng terminal and check to see whether or not we've been successful.
Notice in the top line to the far right, airodump-ng says "WPA handshake." This is the way it tells us we were successful in grabbing the encrypted password! That is the first step to success!
Now that we have the encrypted password in our file WPAcrack, we can run that file against aircrack-ng using a password file of our choice. Remember that this type of attack is only as good as your password file.
We'll now attempt to crack the password by opening another terminal and typing:
This process can be relatively slow and tedious. Depending upon the length of your password list, you could be waiting a few minutes to a few days.
When the password is found, it'll appear on your screen. Remember, the password file is critical. Try the default password file first and if it's not successful, advance to a larger, more complete password file such as one of these.