How to Hack Wi-Fi: Getting Started with Terms & Technologies « Null Byte :: WonderHowTo

Welcome back, my hacker trainees!A score of my readers have been begging for tutorials onhow to hack Wi-Fi, so with this article, I'm initiatinga new seriesdedicated to Wi-Fi hacks. This will probably be around 6-9 articles, starting with the basics of the technologies.Image viaShutterstockI can hear you all groan, but you need to know the basics before you get into more advanced hacking. Then hopefully, developing your own hacks.Afterward, the following guides will cover wardriving, DOS attacks, password hacking (WEP, WPA, WPA2, WPS, and WPA-enterprise), rogue APs, evil twins, Wi-Fi MitM, and Wi-Fi snooping. Lastly, we'll examine how to hack Bluetooth (yes, I know, technically it's not Wi-Fi, but I think you'll find it interesting).So, come along for this frequent and amplified ride of Wi-Fi hacking!Step 1: TerminologyTo really understand how to hack Wi-Fi, we need to dispense with basic terms and technology. First, let's address some terminology.To begin, the access point that sends out the radio frequency (RF) signal is known as the AP. These APs are capable of sending out signals (between 2.4 and 5 Ghz) that comply with a number of different standards. These standards are known as 802.11a, 802.11b, 802.11g, and 802.11n. In the very near future, we'll see a new standard that's tentatively named 802.11ac.The table below summarizes the key features of these Wi-Fi standards.These standards are generally backwardly compatible, so that a wireless n adapter will also be able to pick up g and b signals. We will focus upon the most widely used of these standards— b, g, and n.Step 2: Security TechnologyFrom the perspective of the hacker, wireless security technologies are among the most pertinent features. Multiple security technologies have been deployed in Wi-Fi to make an inherently insecure technology secure. Our attack approach will depend upon which of these security technologies is being deployed.So, let's take a quick look at them here.WEPWEP, or wired equivalent privacy, was the first wireless security scheme employed. As it name implies, it was designed to provide security to the end-user that was essentially equivalent to the privacy that was enjoyed in a wired environment. Unfortunately, it failed miserably.For a number of reasons, WEP is extraordinarily easy to crack because of a flawed implementation of the RC4 encryption algorithm. It's not unusual to be able to crack WEP in less than 5 minutes. This is because WEP used a very small (24-bit) initialization vector (IV) that could be captured in the datastream, and this IV could then be used to discover the password using statistical techniques.Despite this, I still find it being used in household and small business implementations, but seldom in an enterprise environment.WPAWPA was the response by the industry to the revealed weaknesses of WEP. It's often referred to as WPA1 to distinguish it from WPA2.WPA used Temporal Key Integrity Protocol (TKIP) to improve the security of WEP without requiring new hardware. It still uses WEP for encryption, but it makes the statistical attacks used to crack WEP much more difficult and time-consuming.WPA2-PSKWPA2-PSK is the implementation of WPA2 for the home or small business user. As the name implies, it's the WPA2 implementation that uses a pre-shared key (PSK). It's this security standard that is used by most households today, and although it's far more secure, it's still vulnerable to various attacks.A feature that was added in 2007 called Wi-Fi Protected Setup, or WPS, allows us to bypass the security in WP2-PSK . We'll look at a few attacks on WPA2-PSK in coming weeks.WPA2-AESWPA2-AES is the enterprise implementation of WPA2. It uses the Advanced Encryption Standard or AES to encrypt data and is the most secure. It's often coupled with a RADIUS server that is dedicated for authentication.Although cracking it is possible, it significantly more difficult.Step 3: ChannelsLike our radio, wireless has multiple channels so that various communication streams don't interfere with each other. The 802.11 standard allows for channels ranging from 1 thru 14.In the U.S., the FCC regulates wireless communication and devices for use in the states are only enabled to use channels 1 thru 11. Europe uses channels 1 thru 13 and Japan 1 thru 14. Other nations may also use the full range.For the hacker, this can be useful information as a rogue AP using channel 12 thru 14 would be invisible to U.S.-made wireless devices and security professionals scanning for rogue access points.Each channel has a width of 22 Mhz around its central frequency. To avoid interference, an AP can use any of these channels, but to avoid any overlap, channels 1, 6, and 11 are most often utilized in the U.S. The other channels can be used, but because you need five channels between the working channels to not overlap signals, with three or more channels, only 1, 6, and 11 will work.Step 4: Datagrams and FramesAn understanding of the structure of wireless datagrams is critical for successful wireless hacking, but is beyond the scope of this introduction. I will introduce some of this information when necessary in future tutorials, but you may want to take some time to study wireless frames and datagrams from other sources.Step 5: Signal StrengthIn the U.S., the FCC regulates among other things, the strength of the wireless access point's signal. The FCC says that the access point's signal cannot exceed 27 dBm (500 milliwatts). Most access points have this limit built-in, but we can change and override this limitation, if the access point is capable of a stronger signal. This may be useful for the hacker in setting up evil twins and rogue access points where strength of signal is critical, among other techniques.Step 6: Aircrack-NgFor nearly all of our Wi-Fi hacking, we will be usingaircrack-ngwhich is included inBackTrack. Even in those hacks where we use other tools such cowpatty orreaver, we will use the aircrack-ng suite of tools for some part of the hack, so we need to become familiar with it.I'll probably do a dedicated tutorial on aircrack-ng suite in the very near future.Step 7: WiFi AdaptersOne of the crucial needs to becoming an effective Wi-Fi hacker is the Wi-Fi adapter. Generally, the Wi-Fi adapter on your laptop or desktop is insufficient for our purposes. The key capability we need is the ability toinjectpackets into the access point and most run-of-the-mill wireless adapters are incapable of packet injection. Aircrack-ng has alist of Wi-Fi adaptersthat can work with their suite of tools.That having been said, I highly recommend Alfa AWUS036NH USB wireless adapter. This is what I use. It's available from several locations for between $30 to $50.It does everything I need, is fast, has an external antenna, is recognized by BackTrack, and automatically loads its drivers. In addition, it come in 1000mw and 2000mw versions. That can be critical in rogue access point hacks, despite the fact that the FCC limits signal strength the 500mw.Step 8: AttennasAntennas come in two basic types, omni-directional and directional. Most APs and wireless adapters come with omni-directional antennas, meaning that they send and receive in all directions.The Alfa card that I recommend comes with an external antenna that is omni-directional, but has a gain of 5dBi (gain is a measure when applied to antennas, of how much the antenna can increase the signal). This means that it can increase the signal by focusing the signal similar to that of a reflector on a flashlight. In addition, it can change position to better receive particular signals as well as a cable and suction cup adapter for mounting on a wall or window.Directional antennas can also be useful for hacking when attempting to focus your exploits to a remote access point. The literature contains references to Wi-Fi signals that have been sent and received over 100 miles or about 160km using directional antennas. For most commercial directional antennas, you can expect to be able to pick up wireless communication up to 4km or 2.4 miles.These can be obtained from a variety of sources usually for under $100 with a gain of between 15dBi and 20dBi. A Yagi antenna is an example of a directional antenna that is often used in hacking wireless over significant distances.That's It... For NowSo, this begins our exciting journey into Wi-Fi hacking. Very soon, you will be able to hack nearly anyone's wireless internet, sokeep coming backto expand your knowledge and skills in Wi-Fi hacking.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Fix the Wi-Fi Roaming Bug on Your Samsung Galaxy S3How To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiHow To:Hack Wi-Fi Networks with BettercapHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow To:Fix Wi-Fi Performance Issues in iOS 8 & YosemiteHow To:Recover a Lost WiFi Password from Any DeviceHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Back Up & Restore Your iPhone Without iTunesWiFi Prank:Use the iOS Exploit to Keep iPhone Users Off the InternetNews:iOS 11.2 Beta 3 Released, Includes Pop-Up Alerts for Wi-Fi & Bluetooth Controls, New Control Center BarHow To:What All the Bluetooth & Wi-Fi Symbols Mean in iOS 11's New Control Center (Blue, Gray, or Crossed Out)How To:Share Your Wi-Fi Password with a QR Code in Android 10How To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How To:Fix Cellular & Wi-Fi Issues on Your iPhone in iOS 12How To:Share Any Password from Your iPhone to Other Apple DevicesHow To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToNews:MIT Tech Protects Your WiFi Without PasswordsHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Your iPhone's Using More Data Than It Needs, but This Could Stop ItHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Watch American Netflix from Other Regions on Your iOS DeviceHow To:9 Tips for Maximizing Your Laptop's Battery LifeHow To:Get Free Wi-Fi from Hotels & MoreNews:PSP2 (Next Generation Portable) or NGP