How to Hack Wi-Fi: Selecting a Good Wi-Fi Hacking Strategy « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!So many readers come to Null Byte to learnhow to hack Wi-Fi networks(this is the most popular hacking area on Null Byte) that I thought I should write a "how-to" on selecting a good Wi-Fi hacking strategy.Many beginners come here looking to hack Wi-Fi, but have no idea where or how to start. Not every hack will work under every circumstance, so choosing the right strategy is more likely to lead to success and less wasted hours and frustration.Here, I will lay out the strategies based upon the simplest and most effective first, through the most complex and difficult last. In general, this same continuum will apply to the probability of success.Before You Begin Wi-Fi Password CrackingI strongly suggest that you readthis articleto become familiar with the terminology and basic technology of wireless hacking. In addition, to really be effective at Wi-Fi password cracking while usingAircrack-ng, the premier Wi-Fi cracking tool, you will need to have an Aircrack-ng compatible wireless adapter.Need a wireless network adapter?Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2017Check out our 2017 list of Kali Linux and Backtrack compatible wireless network adapters in the link above, or you can grabour most popular adapter for beginners here.A range of Kali Linux compatible wireless network adapters.Image by SADMIN/Null ByteIf you're looking for a cheap, handy platform to get started working with aircrack, check out our Kali Linux Raspberry Pi build usingthe $35 Raspberry Pi.Get Started Hacking Today:Set Up a Headless Raspberry Pi Hacking Platform Running Kali Linux1. Crack WEPWEP, or the Wireless Equivalent Privacy, was the first wireless encryption technology developed. It was quickly found to be flawed and easily cracked. Although you will not find any new WEP-encrypted wireless access points being sold, there are still many legacy WEP APs still around. (On a recent consulting gig with a major U.S. Department of Defense contractor, I found nearly 25% of their APs were using WEP, so it's still out there.)WEP can easily be cracked with Aircrack-ng using a statistical cracking method. It is nearly foolproof (don't prove me wrong on this). If you can collect enough packets (this is key), it's a simple process. This is one of the reasons you need an Aircrack-ng compatible wireless adapter. You must be able to inject packets simultaneously to capturing packets. Most off-the-shelf wireless cards are incapable of this.Don't Miss:How to Crack WEP Passwords with Aircrack-ngTo know whether an AP is using WEP, you can simply hover your mouse over the AP and it will display its encryption algorithm. Note that this approach only works if the AP is using WEP. It does not work on any of the other encryption schemes on wireless. If you are lucky enough to find a wireless AP with WEP, you can expect to crack its password within 10 minutes, although some claim to have done this task in less than 3 minutes.2. Crack WPSMany Wi-Fi APs were equipped with Wi-Fi Protected Setup, or WPS, to make it simpler for the average home user without knowledge of Wi-Fi security measures to set up their wireless AP. Fortunately for us, if we can crack that WPS PIN, we can then access the control panel of the AP.This PIN is relatively simple; just eight digits with one being a checksum, leaving just seven (7) digits, or 10,000,000 possibilities. A single CPU can usually exhaust those possibilities in a few days. Although this might seem slow, brute-forcing the PSK with many times the possibilities can take much longer.Don't Miss:How to Break a WPS PIN to Get the Password with ReaverDon't Miss:How to Break a WPS PIN to Get the Password with BullyIf the wireless AP has WPS enabled, this is the preferred method of cracking modern wireless APs with WPA2. You can use either the Reaver or Bully in conjunction with Aircrack-ng to break these WPS PINs.3. Crack WPA2After the disaster that was WEP, the wireless industry developed a new wireless security standard known as WPA2, or Wi-Fi Protected Access II. This standard is now built into nearly every new wireless AP. Although more difficult to hack, it is not impossible.When a client connects to the AP, there is a 4-way handshake where the pre-shared key (PSK) is transferred from the client machine to the AP. We can capture that PSK hash and then use a dictionary or brute-force attack against it. This can be time-consuming and is not always successful. Success is dependent upon the wordlist you use and the time you have to crack it.Don't Miss:How to Crack WPA2-PSK Passwords Using Aircrack-ngDon't Miss:How to Crack WPA2-PSK Passwords Using CowpattyOnce you have the hash of the PSK captured, you don't need to be connected to the AP. With enough resources, you can brute-force any PSK.4. Evil TwinIf we can't crack the password on the AP, another strategy that can be successful is creating an Evil Twin—an AP with exactly the same SSID as the known AP, but controlled by us. The key is for the target to connect to our AP, rather than the authentic AP.Generally, computers will automatically connect to the AP with the strongest signal, so turning up the power on your AP can be a critical element of this hack. When the user connects to our AP, we can then capture all their traffic and view it, as well as capture any other credentials they present to other systems.Don't Miss:How to Create an Evil Twin AP to Eavesdrop on DataAn effective variation on the Evil Twin is to set up a system with the same SSID and then present the user with a logon screen. Many corporate offices, hotels, coffee shops, etc. employ this type of security. When the user presents their credentials in our fake logon screen, we capture the credentials and store them. We can then use those credentials on their authentic AP to gain their access.This process has been automated by a script called Airsnarf. Unfortunately, Airsnarf is out of date, but I have been working on updating it and will present the script and tutorial soon.5. ICMPTXIf all else fails and you absolutely MUST have Internet access, ICMPTX often works on wireless networks that require authentication via proxy. These include some schools and universities, hotels, coffee shops, libraries, restaurants, and other public Wi-Fi spots. It relies upon the fact that ICMP (the ping protocol) is usually enabled on the AP and passes through to the intended IP address or domain. Since it is not TCP, it does not engage the proxy, it simply passes through.Don't Miss:How to Evade an Authentication Proxy Using ICMPTXThis hack is complex and time consuming and is not for the beginner to hacking. It is slow, as ICMP can only carry a small amount of data in each packet, but in the circumstance where you actually MUST have Internet access and the amount of data is small, such as email, it works great.Other StrategiesThere are numerous strategies to owning a target system includingsocial engineeringand the manyMetasploitexploits. When you gain access to the target system, you can simply extract the wireless password from the target system by going to:C::\ProgramData\Microsoft\Wlansvc\Profiles\Interface\{Interface GUID}There, you will find a hex-encoded XML document with the wireless password.Gaining access to the wireless AP can be as simple as cracking the WEP key or as complex as using ICMPTX, but wireless accesscanbe broken. If all else fails, target one machine on the network, own it, and then recover the password as described above.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via Shutterstock (1,2)RelatedHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'Android Basics:How to Connect to a Wi-Fi NetworkHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiHow To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow To:Fix Cellular & Wi-Fi Issues on Your iPhone in iOS 12How To:Automate Wi-Fi Hacking with Wifite2How To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHow To:Your iPhone's Using More Data Than It Needs, but This Could Stop ItHow To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow To:Recover a Lost WiFi Password from Any DeviceHow To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherHow To:Share Your Wi-Fi Password with a QR Code in Android 10How To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:Fix the Wi-Fi Roaming Bug on Your Samsung Galaxy S3How To:Can't Log into Hotel Wi-Fi? Use This App to Fix Android's Captive Portal ProblemWiFi Prank:Use the iOS Exploit to Keep iPhone Users Off the InternetHow To:Google Photos Waiting for Wi-Fi? Here's the FixHow To:Hack Wi-Fi Networks with BettercapHacking Android:How to Create a Lab for Android Penetration TestingNews:iOS 11.2 Beta 3 Released, Includes Pop-Up Alerts for Wi-Fi & Bluetooth Controls, New Control Center BarHow To:Easily Share Your Complicated Wi-Fi Password Using Your Nexus 5How To:FaceTime Forcing LTE Instead of Wi-Fi? Here's How to Fix ItHow To:Hunt Down Wi-Fi Devices with a Directional AntennaHow To:Change YouTube's Default Quality to Get High-Resolution Videos Every TimeHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:PAIRS Is the Easy Way to Restore Wi-Fi & Bluetooth Connections After Wiping Your PhoneHow To:Find & Share Local Wi-Fi Passwords for Free Internet Everywhere You GoHow To:Get the Strongest Wi-Fi Connection on Your Android Every TimeHow To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Find Your Misplaced iPhone Using Your Apple WatchHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Adjust WiFi Video Quality on Your iPhone in iOS 10