How to Pick an Antenna for Wi-Fi Hacking « Null Byte :: WonderHowTo

When learningWi-Fi hacking, picking a compatible Wi-Fi network adapter is the first step to learning to crack Wi-Fi passwords.Many compatible adapters have swappable antennas, and there are several different kinds of specialized antennas you can add to a network adapter to increase its range and performance. Using a high-gain omnidirectional antenna, a panel antenna, and a parabolic grid, we'll examine the effect on Wi-Fi signal strength for each category of Wi-Fi antenna.Antennas Expand What Network Adapters Can DoWireless network adapters frequently come with a small omnidirectional antenna attached, which can be replaced with an aftermarket antenna. These omnidirectional antennas can pick up a signal about equally from every direction and work best in an office or home where there is no way to know what direction the signal will be coming from. In circumstances where the signal still isn't strong enough, we can sacrifice the ability to get a reasonably strong signal from any direction for a much more substantial gain in directional signal strength.Some applications of directional antennas include extreme range and the ability to hunt down signals by signal strength. While omnidirectional antennas make signal hunting extremely difficult, directional antennas will record a spike in signal strength whenever they are pointed towards the source of a Wi-Fi transmission.Don't Miss:Use the Buscador OSINT VM for Conducting Online InvestigationsYou'll also find different types of directional antennas connecting long-range Wi-Fi links that can span over a mile with a clear line of sight. They are popular on boats, remote sensor stations, and construction sites with remotely linked security cameras.Omnidirectional AntennasThe standard antenna you'll expect to see on a router or network adapter is the "Rubber Ducky" style antenna that looks like a simple stick. These are simple, cheap, and work very well for what most consumers need.TheAlfa AWUS036NEHnetwork adapter.Image by Kody/Null ByteThis kind of antenna will have a flat, round radiation pattern that looks like a donut.The radiation pattern of an omnidirectional antenna.Image viaWikimedia CommonsThe pattern is ideal for connecting to a wireless access point on the same floor but isn't suitable for connecting to any network outside its range or on another level.Panel Directional AntennasDirectional panel antennas have a radiation pattern that looks more like a flashlight than a donut. This pattern is much weaker than an omnidirectional antenna in most directions but very strong both directly in front and behind the antenna.TheAlfa AWUS036NEHandAlfa RP-SMA 7panel antenna.Image by Kody/Null ByteThe main lobe of this radiation pattern, when pointed at the source of a Wi-Fi network, can project extreme range where a regular "Duck" antenna could never reach. If the antenna is moved even a small amount, however, the signal strength can drop off rapidly.The radiation pattern of a directional antenna.Image viaWikimedia CommonsThis makes a panel antenna an excellent choice for a fixed location but a poor choice for an environment where you don't know the direction of the Wi-Fi signal.Parabolic Grid AntennasIf the radiation pattern of a panel antenna is like a flashlight, the radiation pattern for a parabolic dish antenna is more like a laser beam. These antennas can get an extreme range and are meant for remote fixed locations that can span many miles with a clear line of sight.TheSimpleWiFi G2424parabolic grid antenna.Image by Kody/Null ByteWhile parabolic grids are bulky and not subtle at all, they have the most extreme reach of nearly any kind of Wi-Fi antenna. Thanks to their high gain and directionality, they can sniff information when compared with programs likeKismetfrom miles away when positioned correctly.The radiation pattern of a parabolic dish antenna.Image viaWikimedia CommonsLike panel antennas, bumping or changing the angle of the antenna can cause the signal to degrade rapidly. As we learned later, even picking up the Wi-Fi device we were tracking can cause a measurable signal spike.What You'll NeedTo follow this guide, you'll need aKali-compatible Wi-Fi network adapterlike theAlfa AWUS036NEH, which has a removable Wi-Fi antenna.Buy on Amazon:Alfa AWUS036NEH(Alt)For an omnidirectional antenna, check out high-gain omnidirectional antennas like theAlfa ARS-N19 Wireless 9 dBi antenna. There are a variety of indoor and outdoor panel adapters available, but I used theAlfa RP-SMA 7 dBi panel antenna. Parabolic grids are more expensive but are worth it if you're looking for the best possible range. If portability and subtlety aren't a consideration, theSimpleWiFi G2424 parabolic grid antennahas the best range of any of the other options we tried.Buy on Amazon:Alfa ARS-N19Buy on Amazon:Alfa RP-SMA 7Buy on Amazon:SimpleWiFi G2424Step 1: Connect the Adapter & Enable Monitor ModeFirst, you'll need to connect your Kali-compatible Wi-Fi network adapter. Once it's plugged in, you can runip ato find it. It should be named something likewlan1if your internal card iswlan0.~# ip a

1:  lo: <LOOPBACK,UP,LOWER,UP> tu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
     inet 127.0.0.1/8 scope host lo
        valid_lft forever preferred_lft forever
     inet6 ::1/128 scope host
        valid_lft forever preferred_lft forever
2:  eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
     link/ether ##:##:##:##:##:## brd ff:ff:ff:ff:ff:ff
3:  wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
     link/ether ##:##:##:##:##:## brd ff:ff:ff:ff:ff:ff
     inet 192.168.0.24/24 brd 129.168.0.255 scope global dynamic noprefixroute wlan0
        valid_lft 2335sec preferred_lft 2335sec
     inet6 ####:####:####:####:####:####:####:####/64 scope global dynamic noprefixroute
        valid_lft 3599sec preferred_lft 3599sec
     inet6 ####::####:####:####:####/64 scope link noprefixroute
        valid_lft forever preferred_lft forever
6:  wlan1mon: <BROADCAST,ALLMULTI,PROMISC,NOTRAILERS,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN group default qlen 1000
     link/ieee802.11/radiotap ##:##:##:##:##:## brd ff:ff:ff:ff:ff:ffNext, in a terminal window, run the followingifconfigcommand to bring the network adapter up and theairmon-ngcommand to put it into monitor mode. If your card is named something besides wlan1, make sure to change the name to match yours. Once your card is in monitor mode, you can runifconfigto confirm the card is now named something likewlan1mon.~# ifconfig wlan1 up
~# airmon-ng start wlan1
~# ifconfiqNow that our card is in monitor mode, we'll be selecting a network to track as our reference point. We'll use the strength of this network's signal to test out our antennas and see what kind of signal strength each type of antenna gives us.First, let's pull up a list of Wi-Fi networks we can target. We can do this by runningairodump-ng wlan1monand watching the adapter scan through all the Wi-Fi channels. After the list has populated a bit, pressControl-Cto cancel the scan.Don't Miss:Detect & Classify Wi-Fi Jamming Packets with the NodeMCU~# airodump-ng wlan1mon

 CH 11 ][ Elapsed: 0 s ][ 2020-04-30 04:36

 BSSID              PWR  Beacons    #Data,  #/s  CH  MB   ENC  CIPHER   AUTH ESSID

 ##:##:##:##:##:##  -80        2        0     0  11  130  WPA2 CCMP     PSK  belkin.4d6
 ##:##:##:##:##:##  -83        2        0     0  11  130  OPN                DAGOBAH SYSTEM-guest
 ##:##:##:##:##:##  -81        2        0     0  11  130  WPA2 CCMP     PSK  DAGOBAH SYSTEM
 ##:##:##:##:##:##  -65        2        0     0  11  130  WPA2 CCMP     PSK  Sky.NET
 ##:##:##:##:##:##  -76        2        0     0   5  130  WPA2 CCMP     PSK  MySpectrumWiFi1b-2G
 ##:##:##:##:##:##  -68        5        1     0  11  130  WPA2 CCMP     PSK  Carmen Merendez
 ##:##:##:##:##:##  -82        3        0     0   1  130  WPA2 CCMP     PSK  MySpectrumWiFi58-2G

 BSSID              STATION             PWR Rate    Lost    Frames  Probe

 ##:##:##:##:##:##   ##:##:##:##:##:##  -54  0 - 6      0        3Now, identify the channel that a network with a strong signal is on. We'll rerun theairodump-ngcommand with the added-cflag to scan only on the channel our target network is broadcasting. If we want to scan on channel 1, our command would look like below.~# airodump-ng wlan1mon -c 1

 CH  1 ][ Elapsed: 6 s ][ 2020-04-30 04:36

 BSSID              PWR  RXQ  Beacons    #Data,  #/s  CH  MB   ENC  CIPHER   AUTH ESSID

 ##:##:##:##:##:##  -78   68       48        3     0   1  195  WPA2 CCMP     PSK  MySpectrumWiFi58-2G
 ##:##:##:##:##:##  -82    0        6        3     0   1  195  WPA2 CCMP     PSK  TC8715D49
 ##:##:##:##:##:##  -83    5        3        0     0   1   65  WPA2 CCMP     PSK  LG Aristo 6082

 BSSID              STATION             PWR Rate    Lost    Frames  ProbeLeave this running in the terminal window. From here, we'll openWiresharkto begin graphing the data.Step 2: Open Wireshark & Select TargetOnce Wireshark is open, select your network adapter as the source and click on the shark fin icon to start the capture. After the capture is started, you'll see a lot of packets from various networks in the area. Locate a broadcast packet from the network you want to track and click on it.Under the IEEE 802.11 Beacon Frame information, look for the transmitter address and right-click on it. From the menu, click on "Apply as Filter" and then "Selected" to create a display filter for only transmissions from that Wi-Fi device.Now, you should only see packets from the device you're tracking, and you should have a display filter like the one below in the Wireshark filter bar.wlan.ta == 3a:53:9c:b4:39:efThis is telling Wireshark to only display packets with a transmitter address matching that of the device you want to track. You can track any other device that is consistently broadcasting the same way, but you may have to target other data packets because smartphones don't give off beacon frames.Step 3: Monitor Signal Strength & Test Omnidirectional AntennaNow, plug in your omnidirectional antenna. After getting no signal at first, the signal jumps up when we screw on our omnidirectional antenna and stays there relatively no matter what angle the adapter is held.This steady signal is good enough for reception and is resistant to change as I move the adapter around and through the room. The only position it doesn't like is its tip facing directly towards the Wi-Fi source.Step 4: Test the Directional Panel AntennaNext, screw in your directional panel antenna. After a signal drop from removing the omnidirectional antenna, we start to see a pattern take shape. The directional antenna can get a consistently higher signal strength when it is pointed directly at the source of the broadcasts but gets worse signal strength when pointed away.We can use this directionality to achieve a higher signal strength when pointed at any fixed Wi-Fi target, but moving targets will cause a signal drop when they wander out of the main lobe of the panel.Step 5: Test the Parabolic Grid AntennaFinally, we attach the parabolic grid, and after a huge spike from unplugging the panel antenna, we start to get the highest signal strength we've been able to achieve so far. While sweeping the antenna back and forth, I can not only tell exactly where the source is, I can also get spikes of signal strength that greatly exceed anything I was able to get with the omnidirectional or panel antenna.In the graph below, the omnidirectional and panel antenna are on the left of the signal spike in the middle, and the parabolic grid is on the right. Once we zeroed the parabolic dish in, we got a much stronger and more sensitive signal.Towards the end of the capture, I picked up the Wi-Fi device we were tracking in another room and observed a jump in signal strength from the dish, meaning it's possible to even detect when someone is moving a device physically with a highly directional antenna.Directional Antennas Create Useful Radiation PatternsWhile directional network adapter can dramatically increase the signal of a network when aimed correctly, the advantage disappears or can shift as Wi-Fi signals bounce off walls and other obstacles. In an environment with many obstacles, you may find that the strongest signal a directional antenna can receive may be from an angle other than directly towards the source.It's also worth noting that a larger omnidirectional antenna doesn't always mean a stronger signal. If a Wi-Fi source is closeby, a larger antenna can extend the strongest part of the radiation pattern beyond where the target is located.I hope you enjoyed this guide to using specialized antennas for Wi-Fi hacking! If you have any questions about this tutorial on using directional and omnidirectional antennas, leave a comment below, and feel free to reach me on Twitter@KodyKinzie.Don't Miss:Discover & Attack Raspberry Pis Using Default CredentialsWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by Kody/Null ByteRelatedHow To:Hunt Down Wi-Fi Devices with a Directional AntennaHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow To:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019How To:Make a satellite dish Wi-Fi antenna for free internetBuyer's Guide:Top 20 Hacker Holiday Gifts for Christmas 2017How To:Build a weatherproof compact high gain WiFi antennaHacking Gear:10 Essential Gadgets Every Hacker Should TryHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Enable Monitor Mode & Packet Injection on the Raspberry PiHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Automate Wi-Fi Hacking with Wifite2How To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:Get the Strongest Wi-Fi Connection on Your Android Every TimeHow To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow To:Use Kismet to Watch Wi-Fi User Activity Through WallsHow To:Share Any Password from Your iPhone to Other Apple DevicesHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Wardrive with the Kali Raspberry Pi to Map Wi-Fi DevicesHow To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow To:What All the Bluetooth & Wi-Fi Symbols Mean in iOS 11's New Control Center (Blue, Gray, or Crossed Out)How To:Fix the Wi-Fi Roaming Bug on Your Samsung Galaxy S3How To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHow To:Your iPhone's Using More Data Than It Needs, but This Could Stop ItWiFi Prank:Use the iOS Exploit to Keep iPhone Users Off the InternetHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow to Hack with Arduino:Building MacOS Payloads for Inserting a Wi-Fi BackdoorHow To:Recover a Lost WiFi Password from Any DeviceHow To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow To:Check Wi-Fi Reliability & Speed at Hotels Before Booking a RoomNews:Art Meets Information Liberation with the Transparency Grenade