In this lesson,
we're going to talk about three tools
that are essential for wireless network reconnaissance
and enumeration and pen testing.
Aircrack-ng, InSSIDer and WiGLE.net.
Let's start with Aircrack-ng.
Aircrack-ng is a comprehensive suite of tools
designed for assessing the security of wireless network.
It includes tools for capturing packets, analyzing them,
and breaking WEP and WPA or WPA2-PSK keys.
Aircrack-ng is widely used by penetration testers
to evaluate the security of Wi-Fi networks
and identify vulnerabilities
that could be exploited by attackers.
When conducting reconnaissance,
Aircrack-ng allows you to capture traffic
from wireless networks and to analyze it
to identify weak points.
For example, you can use Aircrack-ng
to capture the four-way handshake process
that occurs when an device connects to a WPA
or a WAP2 secured network.
By capturing this handshake can then attempt to crack
the network key by using a dictionary tech
or other techniques.
Imagine you're tasked with testing the security
of a corporate Wi-Fi network.
By using Aircrack-ng, you can capture packets
and attempt to crack the Wi-Fi password.
This process involves setting your wireless adapter
to monitor mode, to capture all traffic in the air,
and then use Aircrack-ng to analyze
and attempt to decrypt the data.
Successfully cracking the password
would allow you to access the network
and assess its security posture more thoroughly.
Aircrack-ng also includes tools
for de-authentication attacks.
De-authentication attacks disconnect devices
from the network, forcing them to reconnect and potentially
allowing the handshake needed
for cracking the password to be captured.
This can be useful for testing the robustness
of the network security measures
and for demonstrating potential vulnerabilities
to the clients.
Next, let's discuss InSSIDer.
InSSIDer is a Wi-Fi scanner that helps you visualize
and analyze wireless networks around you.
It provides detailed information about the networks
it detects it, including signal strength, channel usage,
and security settings.
InSSIDer is particularly useful
for identifying signal overlap
and channel interference, which can impact the performance
and security of wireless networks.
InSSIDer helps you conduct a thorough analysis
of wireless landscapes in your target area.
For example, you can use InSSIDer
to identify all the Wi-Fi networks in a given location
and see how they are distributed across different channels.
This information is crucial
for understanding the network environment
and for identifying potential points of interference
or weak signal areas.
Consider scenario where you are conducting app pen test,
focusing on business wireless infrastructure.
Using InSSIDer, you start by scanning the area
and quickly identify all the access points within range.
Among the legitimate access points named
KellyInnovations_main and KellyInnovations_guest,
you also detect a suspicious access point named
KellyInnovations_freeWi-Fi.
This rogue AP which mimics the legitimate
networks naming convention could be set up by attacker
to lure employees into connecting,
thereby capturing sensitive information.
Then start looking at your InSSIDer application
and you notice that the rogue AP operates
on the same channel as the legitimate APs
causing interference and potential security risk.
You then use InSSIDer to map the signal strength
in coverage areas of the authorized APs
revealing that some areas suffer from poor signal quality
due to suboptimal AP placement.
By repositioning the legitimate APs
and adjusting their channel configurations,
you not only mitigate the security risk posed
by the rogue AP, but also enhance the overall
network performance, ensuring robust
and secure wireless connectivity for the business.
Finally, let's talk about WiGLE.net.
WiGLE.net is a website
and database that collects information about
wireless networks from all over the world.
Users can contribute data by mapping Wi-Fi networks
with their devices, and this information
is then made available through the WiGLE.net platform.
WiGLE.net allows you to search for Wi-Fi networks
by location, SSID, and other criteria.
This can be incredibly useful for reconnaissance
as it provides a way to gather information
about wireless networks in a specific area
without being physically present.
For example, you can use WiGLE.net to identify the presence
of specific Wi-Fi networks around a target location
and gather data about their security settings
and signal strength.
For example, if you're preparing for a pen test
on a remote office, you can use WiGLE.net
to gather information about their wireless networks
in the area before you even arrive on site.
This can help you plan your approach
and identify which networks to focus on
during your onsite assessment.
Additionally, WiGLE.net can help you identify patterns
in the deployment of wireless networks
such as common SSIDs or default configurations,
which might indicate vulnerabilities.
So remember, Aircrack-ng, InSSIDer, and WiGLE.net
are powerful tools for wireless network reconnaissance
and enumeration.
Aircrack-ng lets you capture and analyze wireless traffic
and attempt to crack network keys.
InSSIDer helps you visualize and optimize
the wireless landscape,
and WiGLE.net provides a global database
of wireless network information
for preliminary reconnaissance.
Using these tools together will enhance your ability
to gather comprehensive information about your targets
wireless infrastructure, setting the stage
for successful pen tests.