How Hackers Steal Your Internet & How to Defend Against It « Null Byte :: WonderHowTo

I have had a lot of people ask me, "How does my neighbor keep getting into my wireless?!". Chances are, these people are all using WEP, a deprecated wireless encryption protocol. Either that, or you are using oneweakWPA passphrase.If someone can access your wireless network that easily, this isNOTa good thing. After someone cracks an access point, possibilities are limitless. There's SSL stripping, packet sniffing, MITM (Man-In-The-Middle) attacks, ARP poisoning—not to mention being completely anonymous by using someone else's Wi-Fi.Proof of ConceptThe theory behind cracking access points is simple. For WEP, you fake authentication with the access point to get it to send you packets, then send fragments of packets back to the AP (Access Point). In return, the AP will send a torrent of packets because they're broken. On a network, if a packet is broken, they get resent. When you capture the packets, some will have initialization vectors on them. An attacker captures as many of those as they can, then cracks away at them using an algorithm. WEP is algorithmically weak—after enough IVs, you can crack any password. No matter how long. No matter how complex.WPA/2 is a little different. To crack a WPA/2 AP, you need to send a de-authentication packet to a connected client, and force it to re-authenticate. When it does this, capture the four-way handshake between them, as this contains the hash of the AP's password. This means: post handshake capture, you can do all your attacking offline.WPA/2 has the fixed a vulnerability that was in WEP and has a required password length of an 8 character minimum. This means brute-forcing is nearlyimpossible. A dictionary attack is the only way to go. Dictionaries use a pre-generated list of words, and attempts each word, one by one. These don't necessarily have to be words, butanypre-generated string of ASCII characters.In thisNull Byte, I'm going to show you how to break into your own wireless network and assess its security so you can have a impenetrable network! This will be done in Linux, because Windows does not have open-source, injection capable drivers (WinPcap and USB wireless interfaces aside). For instructions on getting packet injection capable drivers in Linux, you will find a lovely tutorial, written by me for Null Bytehere.All of the commands in bold are Terminal commands.Step1Spoofing a MAC AddressBefore anysmartcracker would attack your AP, they will always spoof their MAC (Media Access Control) address! Your MAC address is your wireless NIC's (Network Interface Card) unique identity!UNIQUE. That means if it was paid for with Mommy and Daddy's credit card, they'll know it'syoubehind the computer.To spoof a MAC address, open a terminal and use these commands:sudo ifconfig wlan0 downsudo ifconfig wlan0 hw ether 46:75:63:6b:55:21sudo ifconfig wlan0 upA frequent cracker would likely make a script out of this to do it quickly. You can put any hex number you want there for the MAC address you're spoofing to, mine is just an example.To make sure your MAC changed, you would do:ifconfigThen confirm that the "wlan0" interface matches what we put into the terminal.Step2Finding Your APTo find your AP, do a scan of local wireless APs:sudo iwlist wlan0 scanTake note of the MAC address of the access point, as well as the channel it is on, you will need it later.Step3Install Aircrack-NGInstall the aircrack-ng suite. It contains all the tools needed to assess your AP's security. In Arch Linux, it is:sudo pacman -S aircrack-ngAnd Ubuntu:sudo apt-get install aircrack-ngNow, install the aircrack-ng scripts, because sometimes you won't be able to run airmon-ng, etc. from the terminal without them:sudo pacman -S aircrack-ng-scriptsAnd Ubuntu:sudo apt-get install aircrack-ng-scriptsStep4Cracking the Wireless APNow we are going to start the actual attack on the AP. You will need to replace the text in brackets with your corresponding info, which you should have written down.Put your wireless interface into monitor mode, as this will allow it to sniff traffic:sudo airmon-ng start wlan0-OR-sudo ifconfig wlan0 mode monitorYour interface for monitoring should now be named "mon0".If you have a WEP encrpyted network, refer to "Cracking WEP" below. If you have a WPA or WPA2 network, skip this and go straight to "Cracking WPA & WPA2".Cracking WEPFor WEP encryption, we need to fake authentication with the AP so it sends you traffic (note: if you cant authenticate, spoof your MAC to match one of the clients already connected to it. You can see the under "stations" in airodump-ng). Open another tab in your terminal, and type:sudo aireplay-ng -a [AP's MAC] -e [AP's SSID(name)] mon0To start the live capture of airbourne packets:sudo airodump-ng --ivs -c [channel of AP] --bssid [AP's MAC address] -w [~/Desktop] mon0Next, you need to fake-authentication with the AP:sudo aireplay-ng -a [AP's MAC] -e [AP's ESSID(name)] mon0When you have fake-authenticated successfully, you should now start re-injecting packets:sudo aireplay-ng -3 -b [AP's MAC] -h [Your MAC] mon0When it's done, you should see it generating large amounts of traffic in the airodump-ng window. After you get 20-100,000 packets or "Data", as airodump calls them, you should be ready to crack the password.To crack your password, run this in the terminal:sudo aircrack-ng ~/Desktop/[capture file.cap]When aircrack says "KEY FOUND", copy the key and remove the semi-colons from it. Congratulations! You just proved how easy it is for someone to crack your network. With a crafted tool, an attacker can crack your network in less than 60 seconds. I've done it numerous times.Cracking WPA & WPA2To get ready to capture a four-way handshake, start airodump-ng with this command:sudo airodump-ng -c [channel of AP] --bssid [AP's MAC] -w [~/Desktop/psk.cap] mon0Now we need to de-authenticate a client to force them to reconnect and get a four-way handshake faster. Swich to airodump and look at the associated clients (look at the bottom). Copy the MAC address. It there aren't any, wait until someone connects, or try for a later date when you can have another computer connected. Here is the terminal command to force de-authentication:sudo aireplay-ng -0 15 -a [AP MAC] -c [Deauth client MAC] mon0In airodump, you should see in the top-right corner text, "WPA Handshake" and shows a MAC address following it. Example:The handshake was captured and you can now disconnect from the network. If you didn't get the handshake, you might not be close enough to the client.To crack the handshake:sudo aircrack-ng -w [~/path/to/dictionary/file.lst] [~/Desktop/psk-01.cap]You can find great dictionaries for cracking onThePirateBayorPacket Storm. I have over 20, depending on my situation. You can also use "coWPAtty", which usesRainbow Tablesto crack WPA handshakes. Rainbow Tables are pre-computed hashes with their corresponding passphrase. It'sveryeffective. TheChurch of Wi-Fihas the best Rainbow Table set I've seen. However, the torrents are impossible to find now (due to lack of seeders). In order to get them, you need to buy the DVD set.That's all there is to it. So, the bottom line is to use WPA2 with AES encryption in conjunction with an impossibly long password, like "71zJJmfbK50VgdmtjRVJuxcDJr5PVJJAAtG1mIBwbEUshkkO".Questions? Post below, or start a thread in theforum.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage viaThe Elite Hackers SiteRelatedHow To:Defend Yourself Against an Attacker with a KnifeHow To:Defend Yourself Against an Attacker Choking You from the FrontNews:Chinese Hack of U.S. Employment Records Reveals the Weakness of Signature-Based Defense SystemsNews:'Hackers-for-Hire' Attempted to Steal Baidu's Self-Driving Car SecretsHow To:Defend your hacker space with a USB missile launcherHow To:Defend against a straight right hand to the bodyHow To:The Beginner's Guide to Defending Against Wi-Fi HackingNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Defend against an overhead attack with an edged weaponNews:The Biometric Authentication ConundrumHow To:Defend against a left hook in boxingHow To:Defend against the dribble in soccerNews:A Brief History of HackingHow To:Defend in FIFA 11 for the PlayStation 3How To:Get an armored tank vehicle in Dead Island and earn 'Hell in Paradise'News:Shadow Brokers Leak Reveals NSA Compromised SWIFTLocking Down Linux:Harden Sudo Passwords to Defend Against Hashcat AttacksHow To:Defend against the right handHow To:Defend on the insideHow To:Defend against the ground and pound and stand up when against the cage in MMAHow To:Defend vs. a human siege and use the best traps in Dwarf FortressHow To:Defend against a body lock with an ankle pressure submission in MMAHow To:This $1,300 Ethical Hacking Bundle Is on Sale for $40 TodayCyberwar:Hacker vs. HackerNews:Maxine Waters Article with VideoNews:Indie and Mainstream Online Games Shut Down by LulzSecHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItLockdown:The InfoSecurity Guide to Securing Your Computer, Part IHow To:Defend against a back attack with the arm barHow To:Defend against the wrist grab with Aikido IkkyoNews:$(r4BBL3 = SCRABBLE in L33tsp34kHow To:Defend against rear wrist grabs with Aikido NikyoHow To:Secure Your Computer with Norton DNSHow To:Join the Fight Against SOPA and PIPAHow To:How Hackers Take Your Encrypted Passwords & Crack ThemNews:South American teams doing great.News:Name your price for 5 games