In this lesson,
we're going to talk about Kismet,
which is a powerful wireless network detection
and monitoring tool.
Kismet is an open-source sniffer,
wireless intrusion detection system, wardriver,
and packet capturing tool for Wi-Fi, Bluetooth, BTLE
(so Bluetooth low energy), wireless thermometers, airplanes,
power meters, Zigbee, and more.
It's often used during the reconnaissance phase
of a penetration test when you want to gather
as much information as possible
about the wireless environment.
Let's start with what Kismet actually does.
At its core, Kismet is a wireless network detector
and packet sniffer.
It listens to Wi-Fi signals in the area
and collects details about nearby wireless access points,
clients, and their communications.
Unlike some other tools, Kismet works in passive mode,
meaning it doesn't interact with the networks,
it just listens.
This makes it a great tool for reconnaissance
because you're not sending any packets
that could alert the target to your presence.
Now, when you run Kismet,
it will show you a list of wireless networks,
even those that are set to "hidden."
Hidden SSIDs try to obscure their presence,
but Kismet can still identify the fact
that these networks exist
and capture traffic from clients connecting to them.
This can be really useful for detecting networks
that aren't meant to be found easily,
such as rogue access points or private corporate networks.
Let's go through an example of how you might use Kismet.
Imagine you're conducting a wireless assessment
for a client in a corporate office building.
You can set up Kismet to monitor
all of the Wi-Fi traffic in the area.
It will show you information like SSIDs of networks,
their signal strength, encryption types like WPA2 or WEP,
and also the MAC addresses of both the access points
and connected devices.
From there, you can start to build a picture of
how the wireless infrastructure is set up
and identify any potential weak points.
As mentioned before, one of the great things about Kismet
is that it can detect hidden networks.
Even though these networks don't broadcast their SSID,
Kismet can still pick up the beacons
and packets exchanged between clients and access points.
Once a client connects to the hidden network,
Kismet captures the SSID, revealing it to you.
For example, if a company is using a hidden Wi-Fi network
and a client device connects, Kismet will capture the SSID
during the handshake process
and display it in the interface.
This can be particularly useful
when you're performing a security audit and need
to know about all wireless networks in the environment,
even those that are not easily visible.
Now, Kismet also has the ability
to log the traffic it captures, meaning you can analyze
it later using tools like Wireshark.
This is useful if you're trying
to perform deeper analysis on the data such as looking
for unencrypted information being transmitted,
or trying to crack WEP or WPA2 encryption
using tools like Aircrack-ng
in combination with Kismet's captured packets.
Also, as mentioned before, it's important to note
that Kismet isn't just limited to 802.11 Wi-Fi networks.
It can also detect Bluetooth devices, Zigbee networks,
and other wireless protocols,
which makes it a versatile tool for wireless analysis
beyond just Wi-Fi.
This capability can help you find IoT devices
that may be using different communication protocols,
making it easier to assess the full range
of wireless vulnerabilities in an environment.
So remember, Kismet is your go-to tool
for passive wireless network discovery.
It helps you gather critical information
during the reconnaissance phase of a penetration test
without actively interacting with the network.
This makes it invaluable for stealthy operations,
detecting hidden networks,
and capturing data for later analysis.