newbie_guide
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
newbie_guide [2018/11/21 23:14] – Updated information and removed outdated information mister_x | newbie_guide [2018/11/21 23:28] – [Injection support] Update interface name mister_x | ||
---|---|---|---|
Line 66: | Line 66: | ||
===== Discovering Networks ===== | ===== Discovering Networks ===== | ||
- | The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like | + | The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like [[https:// |
- | [[http://www.kismetwireless.net/ | + | |
- | Prior to looking for networks, you must put your wireless card into what is called " | + | Prior to looking for networks, you must put your wireless card into what is called " |
- | To put your wireless card into monitor mode: | + | To put your wireless card into monitor mode using [[airmon-ng]]: |
- | [[airmon-ng]] start rausb0 | + | |
- | To confirm it is in monitor mode, run " | + | It will create create another interface, and append " |
- | Then, start airodump-ng to look out for networks: | + | Then, start [[airodump-ng]] to look out for networks: |
- | airodump-ng | + | airodump-ng |
- | " | ||
- | Take a look in the documentation of the nic driver. For most newer drivers, the primary interface name is " | ||
If airodump-ng could connect to the WLAN device, you'll see a screen like this: | If airodump-ng could connect to the WLAN device, you'll see a screen like this: | ||
Line 88: | Line 85: | ||
{{https:// | {{https:// | ||
- | [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). | + | [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). 802.11a |
+ | |||
+ | The current channel is shown in the top left corner. | ||
After a short time some APs and (hopefully) some associated clients will show up. | After a short time some APs and (hopefully) some associated clients will show up. | ||
Line 95: | Line 94: | ||
^ BSSID | The MAC address of the AP | | ^ BSSID | The MAC address of the AP | | ||
+ | ^ RXQ | Quality of the signal, when locked on a channel | | ||
^ PWR | Signal strength. Some drivers don't report it | | ^ PWR | Signal strength. Some drivers don't report it | | ||
^ Beacons | ^ Beacons | ||
Line 111: | Line 111: | ||
^ Probes | ^ Probes | ||
- | Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack wep with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength. | + | Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack WEP with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength. |
In the example above the net 00: | In the example above the net 00: | ||
Line 119: | Line 119: | ||
Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking: | Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking: | ||
- | airodump-ng -c 11 --bssid 00: | + | airodump-ng -c 11 --bssid 00: |
With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The " | With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The " | ||
Line 151: | Line 151: | ||
Try to connect to your AP using [[aireplay-ng]]: | Try to connect to your AP using [[aireplay-ng]]: | ||
- | aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00: | + | aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00: |
The value after -a is the BSSID of your AP. | The value after -a is the BSSID of your AP. |
newbie_guide.txt · Last modified: 2018/11/21 23:31 by mister_x