How to Hack Wi-Fi: Breaking a WPS PIN to Get the Password with Bully « Null Byte :: WonderHowTo

Welcome back, my nascent hackers!Like anything in life, there are multiple ways of getting a hack done. In fact, good hackers usually have many tricks up their sleeve to hack into a system. If they didn't, they would not usually be successful. No hack works on every system and no hack works all of the time.I have demonstratedmany ways to hack Wi-Fihere on Null Byte, including crackingWEPandWPA2passwords and creating anEvil TwinandRogue AP.A few years back, Alex Long demonstratedhow to use Reaverto hack the WPS PIN on those systems with old firmware and WPS enabled. Recently, a new WPS-hacking tool has appeared on the market and is included in ourKali hacking distribution. It's name, appropriately, isBully.Why WPS Is So VulnerableWPS stands for Wi-Fi Protected Setup and was designed to make setting a secure AP simpler for the average homeowner. First introduced in 2006, by 2011 it was discovered that it had a serious design flaw. The WPS PIN could be brute-forced rather simply.With only 7 unknown digits in the PIN, there are just 9,999,999 possibilities, and most systems can attempt that many combinations in a few hours. Once the WPS PIN is discovered, the user can use that PIN to find the WPA2 preshared key (password). Since a brute-force attack against a WPA2 protected AP can take hours to days, if this feature is enabled on the AP and not upgraded, it can be a much faster route to getting the PSK.The Keys to SuccessIt's important to note, though, that new APs no longer have this vulnerability. This attack will only work on APs sold during that window of 2006 and early 2012. Since many families keep their APs for many years, there are still many of these vulnerable ones around.Need a wireless network adapter?Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2017For this to work, we'll need to use a compatible wireless network adapter. Check out our 2017 list of Kali Linux and Backtrack compatible wireless network adapters in the link above, or you can grabour most popular adapter for beginners here.Wi-Fi hacking setup with wireless network adapter.Image by SADMIN/Null ByteIf you aren't familiar with wireless hacking, I strongly suggest that you read myintroduction on the Aircrack-ng suite of tools. If you're looking for a cheap, handy platform to get started, check out our Kali Linux Raspberry Pi build usingthe $35 Raspberry Pi.Get Started Hacking Today:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxStep 1: Fire Up KaliLet's start by firing our favorite hackingLinuxdistribution, Kali. Then open a terminal that looks like this:To make certain we have some wireless connections and their designation, we can type:kali > iwconfigAs we can see, this system has a wireless connection designated wlan0. Yours may be different, so make certain to check.Step 2: Put Your Wi-Fi Adapter in Monitor ModeThe next step is to put your Wi-Fi adapter in monitor mode. This is similar to promiscuous mode on a wired connection. In other words, it enables us to see all the packets passing through the air past our wireless adapter. We can use one of the tools from the Aircrack-ng suite, Airmon-ng, to accomplish this task.kali > airmon-ng start wlan0Next, we need to use Airodump-ng to see the info on the wireless AP around us.kali > airodump-ng mon0As you can see, there are several APs visible to us. I'm interested in the first one: "Mandela2." We will need its BSSID (MAC address), its channel, and its SSID to be able to crack its WPS PIN.Step 3: Use Airodump-Ng to Get the Necessary InfoFinally, all we need to do is to put this info into our Bully command.kali > bully mon0 -b 00:25:9C:97:4F:48 -e Mandela2 -c 9Let's break down that command to see what's happening.mon0is the name of the wireless adapter in monitor mode.--b 00:25:9C:97:4F:48is the BSSID of the vulnerable AP.-e Mandela2is the SSID of the AP.-c 9is the channel the AP is broadcasting on.All of this information is available in the screen above with Airodump-ng.Step 4: Start BullyWhen we hit enter, Bully will start to try to crack the WPS PIN.Now, if this AP is vulnerable to this attack, bully will spit out the WPS PIN and the AP password within 3 to 5 hours.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via Shutterstock (1,2)RelatedHow To:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust Attack Using AirgeddonHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Automate Wi-Fi Hacking with Wifite2How To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Recover a Lost WiFi Password from Any DeviceHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:Share Any Password from Your iPhone to Other Apple DevicesHow To:Hack Wi-Fi Networks with BettercapHow To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHow To:Stop Handing Out Your Wi-Fi Password by Enabling "Guest Mode" on Your ChromecastHow To:Share Your Wi-Fi Password with a QR Code in Android 10How To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow To:Hack Wi-Fi & Networks More Easily with Lazy ScriptHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow To:Hack WiFi Using a WPS Pixie Dust AttackHow To:Easily Share Your Complicated Wi-Fi Password Using Your Nexus 5How To:Crack WPS with WifiteHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Back Up & Restore Your iPhone Without iTunesAndroid Basics:How to Connect to a Wi-Fi NetworkHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow To:Hack Wi-Fi Using Wifite in Kali