How to Share Wi-Fi Adapters Across a Network with Airserv-Ng « Null Byte :: WonderHowTo

If you want to carry a variety of network adapters without looking suspicious, a perfect solution is accessing them through Airserv-ng. Tucked away in the Aircrack-ng suite, this tool allows a hacker to plug any number of network adapters into a Raspberry Pi and access them over a Wi-Fi or Ethernet connection.Hacking Wi-Fi requires you to have a compatible wireless network adapter, which usually means plugging it directly into your computer. But, that may not always be appropriate or possible, as an external network adapter can draw attention to you or be difficult to connect to certain types of devices. Thanks to tools like the Raspberry Pi, it's easy to have a second computer out of sight and connected to a network adapter suitable for hacking.Don't Miss:How To Hack Wi-Fi — Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsRaspberry Pi's for Wi-Fi HackingA typical scenario might be a penetration tester who wants to be able to conduct offensive network operations like MITM attacks or handshake gathering, but doesn't want to be the only person in the office with a bulky external network adapter card visibly blinking away. Some attacks may even require multiple external wireless cards to be effective, which I've found can alone be enough to be reported to management at co-working spaces.Instead, plugging all of the required network cards into a Raspberry Pi and then accessing the Pi over Wi-Fi allows the penetration tester to keep the adapters out of sight while using less suspicious devices to access the Pi and issue commands. The only problem that remains is how to connect to the Pi, which is usually accomplished by an SSH connection.While SSH is encrypted, which is great if we're using a Wi-Fi network where someone might be intercepting traffic, it comes with some limitations. First, you're connecting to the Pi and running commands from the Pi remotely, which means that you have to use the tools on the Raspberry Pi. You also don't have direct access to the tools on your primary computer while doing so, because you're running command-line tools on the Pi through your computer. For things like Wi-Fi password cracking, the Pi doesn't have the speed to be very effective.Don't Miss:Automating Wi-Fi Hacking with Besside-ngWhile it's possible to use some tools on the Pi over SSH and then copy files back and forth to do things like password cracking that the Pi isn't good at, there is a cleaner solution. By creating an encrypted Wi-Fi network on the Pi and connecting to it from our primary computer, we can access all of the network adapters plugged into the Pi directly from our computer as though they were directly plugged in.Airserv Makes Wi-Fi Cards Network ResourcesAirserv-ng provides access to the Wi-Fi network adapters differently than SSH, allowing us to use more powerful tools on our primary computer. Instead of using the Pi to run the attacks, we use it to serve up the Wi-Fi network adapters, then use tools on our primary computer as though we had the Wi-Fi adapters directly plugged into it.In this setup, we create an encrypted network between the internal cards of our primary computer and the Raspberry Pi. Over this Wi-Fi network, the Raspberry Pi serves any network adapters we plug into it on the network at any port number we want. When set up correctly, we can then access a particular network adapter by typing the IP address, and then the port number on which airserv-ng is serving the adapter.Using Programs with Airserv-Ng InterfacesNormally, we'd start scanning the Wi-Fi traffic around us with a command likeairodump-ng wlan1mon. This command is running the programairodump-ngon the interfacewlan1mon, which is plugged into our computer. If, however, we were connected to the same Wi-Fi network as a Raspberry Pi running Airserv-ng on a Wi-Fi adapter, we could run a command that looks likeairodump-ng 192.168.0.16:666to do the same thing.So what is this doing? We're still running airodump-ng on an interface, but this time we're specifying the IP address of the Raspberry Pi on the network plus the default port number Airserv-ng is hosting the Wi-Fi adapter on. We can also run programs like besside-ng to grab handshakes this way, taking care not to attack the Wi-Fi link between the primary computer and the Pi.What You'll NeedTo use airserv-ng, we'll need to have the aircrack-ng suite installed on the computer on which we want to serve a network interface. In our example with a Raspberry Pi, we'll also need either to be running either Raspbian or Kali Linux on our Pi.Step 1: Install Aircrack-NgFirst, we'll need to install the aircrack-ng suite. This comes preinstalled on Kali Linux, but on Raspbian, it's easy to install. In a terminal window, type the following to install the aircrack-ng suite.sudo apt install aircrack-ngOnce this finishes downloading, you should have several useful programs, including airserv-ng.To check if you've correctly installed the program, runman airserv-ngto look at the manual entry for the program. You should see something like below.man airserv-ng
NAME
       airserv-ng - a wireless card server

SYNOPSIS
       airserv-ng <options>

DESCRIPTION
       airserv-ng  is a wireless card server which allows multiple wireless application programs to independently use a
       wireless card via a client-server TCP network connection. All operating system and wireless card driver specific
       code is incorporated into the server. This eliminates the need for each wireless application to contain the com‐
       plex wireless card and driver logic. It is also supports multiple operating systems.

OPTIONS
       -h     Shows the help screen.

       -p <port>
              TCP port to listen on (by default: 666).

       -d <iface>
              Wifi interface to use.

       -c <chan>
              Lock interface to this channel.

       -v <level>
              Debug level. There are 3 debug levels.  Debug level of 1 shows client connection/disconnection (default).
              Debug level of 2 shows channel change requests and invalid client command requests in addition to the de‐
              bug level 1 messages.  Debug level of 3 displays a message each time a packet (and its length) is sent to
              the client. It also include messages from level 2 (and 1).You can hitQto exit. Now that we have this installed, we're ready to try serving up a Wi-Fi card.Step 2: Prepare Your Wi-Fi AdaptersAfter plugging in a Wi-Fi network card you want to serve, we'll need to consider how we're going to be using it. If we need to put it into monitor mode, then we may want to do this first.Don't Miss:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackFirst, find the name of your card by runningifconfigoriwcondig. In Kali, it should look something likewlan1. Next, we'll put it into monitor mode by running the following command.sudo airmon-ng start [name of wifi card here]Keep in mind that if you select the Wi-Fi card you're currently using to accesst internet, the program will probably crash. If you only have one Wi-Fi card but you're using ethernet, you should be able to serve up your Wi-Fi card over your ethernet connection just fine.root@nickles:~# airmon-ng start wlan1

Found 4 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode

  PID Name
  541 NetworkManager
  604 wpa_supplicant
 5143 dhclient
 5157 dhclient

PHY Interface   Driver      Chipset

phy0    wlan0       ath9k       Qualcomm Atheros QCA9565 / AR9565 Wireless Network Adapter (rev 01)
phy3    wlan1       rt2800usb   Ralink Technology, Corp. RT5572

        (mac80211 monitor mode vif enabled for [phy3]wlan1 on [phy3]wlan1mon)
        (mac80211 station mode vif disabled for [phy3]wlan1)When we run ifconfig again, we should see the network card is now namedwlan1mon. It's in monitor mode and ready to go.Step 3: Connect to the Same Network & Serve the CardNow, we can specify a port for each Wi-Fi adapter we want to serve. If we have a Raspberry Pi and a USB hub with multiple Wi-Fi adapters plugged in, you could assign a port number by the name of the network adapter, like port111forwlan1and port222forwlan2.Once you've decided how to keep track of which port leads to which adapter, we can serve it using the following command.root@nickles:~# airserv-ng -d wlan1mon -p 111
Opening card wlan1mon
Setting chan 1
Opening sock port 666
Serving wlan1mon chan 1 on port 111In this command, the-dflag refers to which device we're serving, and the-pcommand refers to which port we're serving it on.Step 4: Access Your Wi-Fi Cards Over the NetworkNow, let's try to grab a handshake through the card we are serving. We can do this from any computer connected to the same local area network, or even from our own computer.First, check to see what our IP address is on the network. We can do this usingifconfig, and it should be something like 192.168.0.2.Now, we'll open Iairodump-ngand try listening for a handshake. Rather than use the command as through the card were directly connected, likeairodump-ng wlan1mon, we'll use it via the airserv-ng interface, using our IP address and the port number instead.root@nickles:~# airodump-ng 192.168.0.37:111
Connecting to 192.168.0.37 port 111...
Connection successful
Connecting to 192.168.0.37 port 111...
Connection successful
airodump-ng: osdep.c:46: wi_set_ht_channel: Assertion `wi->wi_set_ht_channel' failed.

 CH  0 ][ Elapsed: 36 s ][ 2019-04-14 10:36 ][ WPA handshake: 40:70:09:7A:64:90

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 40:70:09:7A:64:90  -39      323     1447   33   6  195  WPA2 CCMP   PSK  spot 2.4 ghz
 8C:A2:FD:01:2B:28  -66      237       27    0   6  195  WPA2 CCMP   PSK  Donna :)
 0E:A2:FD:01:2B:28  -65      114        0    0   6  195  WPA2 CCMP   PSK  Donna :)_Guest
 C0:C1:C0:B6:F3:71  -77      116       15    0   6  130  WPA2 CCMP   PSK  SilverHorse
 C0:C1:C0:B6:F3:72  -78      132       10    0   6  130  OPN              SilverHorse-guest
 8C:A2:FD:00:C5:8E  -78      212       34    0   6  195  WPA2 CCMP   PSK  LavishBest
 70:3A:CB:ED:A4:58  -76        5       11    0   6  130  WPA2 CCMP   PSK  jlc
 60:19:71:F1:A3:20  -78       42        0    0   6  195  WPA2 CCMP   PSK  Red PolishJust like that, we're using the interface on our device from a computer across the network. If we were using a Raspberry Pi, we would bring all of our network cards up and then create a Wi-Fi access point from the internal card of the Pi to facilitate any Wi-Fi hacking needed, picking a different port number each time. If we serve cards wlan1 on port 111, we can access it from our IP number with a:111at the end.Airserv-Ng Makes Network Cards More FlexibleAirserv-ng is a handy tool to make multiple Wi-Fi network cards more accessible and more subtle to access, especially when used with a Raspberry Pi. In addition to allowing a single Raspberry Pi to serve many Wi-Fi adapters over its internal card, multiple people on one team can also share a single adapter as needed, without needing to attach the adapter to their computer physically. While this solution makes using Wi-Fi adapters as a network resource easier, it should be noted that this is not encrypted at all, so be careful when using this in an environment where someone else on the network might be listening in.I hope you enjoyed this guide to using Airserv-ng to make Wi-Fi hacking easier! If you have any questions about this tutorial on using Airserv-ng with the Raspberry Pi, leave a comment below, and feel free to reach me on Twitter@KodyKinzie.Don't Miss:Capturing WPA Passwords by Targeting Users with a Fluxion AttackFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Spy on Network Relationships with Airgraph-NgHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionHow To:Hunt Down Wi-Fi Devices with a Directional AntennaHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon)How To:Pick an Antenna for Wi-Fi HackingHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Automate Wi-Fi Hacking with Wifite2How to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Hack Wi-Fi Networks with BettercapHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Use MDK3 for Advanced Wi-Fi JammingVideo:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSHow To:Select a Field-Tested Kali Linux Compatible Wireless AdapterHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow to Hack Wi-Fi:Creating an Invisible Rogue Access Point to Siphon Off Data UndetectedHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow To:Extend a (Hacked)Router's Range with a Wireless Adapter.How To:Track Wi-Fi Devices & Connect to Them Using ProbequestHow to Hack Wi-Fi:DoSing a Wireless AP ContinuouslyHow To:Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2019How To:Hack Open Hotel, Airplane & Coffee Shop Wi-Fi with MAC Address SpoofingHow To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationHow To:Intercept Images from a Security Camera Using WiresharkHow To:Recover Forgotten Wi-Fi Passwords in WindowsHow To:Crack Wi-Fi Passwords—For Beginners!How To:Hack Wi-Fi & Networks More Easily with Lazy ScriptHow To:Detect Script-Kiddie Wi-Fi Jamming with WiresharkHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow to Hack Wi-Fi:Performing a Denial of Service (DoS) Attack on a Wireless Access PointHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHacking Android:How to Create a Lab for Android Penetration Testing