In this lesson,
we're going to discuss Aircrack-ng,
which is a suite of tools
used for wireless network auditing and pen testing.
We'll also focus on
how it can be used for deauthentication attacks.
First, let's start with the Aircrack-ng suite.
It includes multiple utilities
with the primary tool being Aircrack-ng itself,
which is used to crack WEP, WPA, and WPA2-PSK keys
once enough data packets have been captured.
To make this possible,
you'll need to gather handshake packets
or Initialization Vectors (IVs) from the network.
Now, this is where deauthentication attacks come into play.
So, what is a deauthentication attack?
This is a type of denial-of-service attack,
or DOS attack, specifically targeted at wireless networks.
The goal is to forcibly disconnect a client
from the access point by sending
spoofed deauthentication frames,
which tricks the client
into believing it has been kicked off of the network.
Once the client reconnects, you can capture the handshake,
which is necessary to crack WPA and WPA2 encryption.
Now, let's walk through
how to use this tool in a specific scenario.
First, we would need
to put our wireless card into monitor mode.
This allows it to capture all wireless packets in the air,
including those not necessarily directed at your device.
You can do this with the following command:
airmon-ng start wlan0.
Now, again, this is assuming
that your wireless card is named wlan0,
so you have to make it specific to yours.
This command will enable monitor mode on the interface,
often renaming it to something like wlan0mon.
Next, you can use airodump-ng to scan for networks
and identify target.
This will show you a list of nearby wireless networks,
along with information like the BSSID,
which is the MAC address of the router,
the channel, and encryption type.
For example, you'll use
the command: airodump-ng wlan0mon.
Now, once you have identified
the network you want to attack,
note the BSSID and the channel.
So, let's say we want to target
a WPA2-encrypted network with a BSSID
of AA:BB:CC:DD:EE:FF
on channel six.
To focus your scan on that specific network,
you would use the following command:
airodump-ng --bssid,
then you have the MAC address,
you have the channel option, 6,
and then we're going to have the write option,
and we'll say capture wlan0mon.
This command will capture the traffic
from the network and save it to a file called "capture."
Now, to force a client to reconnect to the network,
we perform the deauthentication attack.
You need to identify an associated client's MAC address
using airodump-ng.
When a client is connected,
you'll see their MAC address under the "STATION" section.
Once you've got the target client,
use the following command to send deauth packets:
aireplay-ng,
then we have the deauth option, 10 -a,
then input the MAC address, -c,
and then the target MAC address.
Okay, so here, the -a specifies
the BSSID of the access point.
The -c specifies the MAC address of the client,
so the station, and then we have the --deauth 10,
which sends 10 deauthentication packets.
Now, this attack disrupts
the connection and when the client reconnects,
the WPA handshake is captured.
Once you've captured the handshake,
it's time to crack the key using Aircrack-ng.
This tool performs a dictionary attack
to guess the WPA or WPA2 passphrase.
You will need a wordlist,
such as the rockyou.txt,
which contains a list of common passwords.
Here's how you can attempt to crack the key:
You'll use a command, aircrack-ng -w,
then we have the path to the wordlist,
and you'll have the -b option with the MAC address,
then we have the capture-01.cap.
That's where we want to store this information at.
So, the w option specifies the path
to the wordlist and the b option specifies
the BSSID of the target access point.
Aircrack-ng will try each word
in the wordlist until it finds the matching passphrase.
Deauthentication attacks
are often used to set up more advanced wireless attacks.
For instance, by capturing
the WPA handshake after deauthentication,
you can attempt to crack
the WPA key and you also can combine deauthentication
with other techniques like Evil Twin attacks,
where you set up a rogue access point
to capture even more information
from users trying to reconnect.
So remember, Aircrack-ng is a powerful tool
for wireless auditing
and deauthentication attacks,
which are often used to obtain critical handshake data.
Together, they can be used to gain access
to protected networks,
provided you have legal authorization to do so.
Always ensure you conduct these tests
in a controlled environment
where you have permission to test,
as unauthorized attacks on networks are illegal.