Differences

This shows you the differences between two versions of the page.

--- newbie_guide [2018/11/21 23:14] – Updated information and removed outdated information mister_x
+++ newbie_guide [2018/11/21 23:27] – [Sniffing IVs] Update interface name mister_x
@@ Line 66: / Line 66: @@
 ===== Discovering Networks =====
-The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like
+The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like [[https://kismetwireless.net/|Kismet]] can be used too.
-[[http://www.kismetwireless.net/|Kismet]] can be used too.
-Prior to looking for networks, you must put your wireless card into what is called "monitor mode".  Monitor mode is a special mode that allows your PC to listen to every wireless packet.  This monitor mode also allows you to optionally inject packets into a network.  Injection will be covered later in this tutorial.
+Prior to looking for networks, you must put your wireless card into what is called "monitor mode".  Monitor mode is a special mode that allows your computer to listen to every wireless packet.  This monitor mode also allows you to optionally inject packets into a network.  Injection will be covered later in this tutorial.
-To put your wireless card into monitor mode:
+To put your wireless card into monitor mode using [[airmon-ng]]:
-[[airmon-ng]] start rausb0
+  airmon-ng start wlan0
-To confirm it is in monitor mode, run "iwconfig" and confirm the mode.  The [[airmon-ng|airmon-ng page]] on the Wiki has generic information and how to start it for other drivers.
+It will create create another interface, and append "mon" to it. So, **wlan0** will become **wlan0mon**. To confirm it is in monitor mode, run "iwconfig" and confirm the mode.
-Then, start airodump-ng to look out for networks:
+Then, start [[airodump-ng]] to look out for networks:
-  airodump-ng rausb0
+  airodump-ng wlan0mon
-"rausb0" is the network interface (nic) name. If you are using a different WLAN device than a rt2570 you'll have to use a different nic name.
-Take a look in the documentation of the nic driver. For most newer drivers, the primary interface name is "wlan0", but for monitoring, a secondary interface ("mon0", created when you run airmon-ng) is used.
 If airodump-ng could connect to the WLAN device, you'll see a screen like this:
@@ Line 88: / Line 85: @@
 {{https://www.aircrack-ng.org/img/newbie_airodump.png}}
-[[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). Channels between 36 and 149 are used for 802.11a. The current channel is shown in the top left corner.
+[[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). 802.11a is in the 5GHz and availability in different countries is more fragmented than on 2.4GHz. In general, known channels starts at 36 (32 in some countries) to 64 (68 in some countries) and 96 to 165. Wikipedia has more details on channel availability. The Linux [[https://wireless.wiki.kernel.org/en/developers/Regulatory/CRDA|Central Regulatory Domain Agent]] takes care of allowing/forbidding transmissions on the different channels for your country; however, it needs to be set appropriately.
+The current channel is shown in the top left corner.
 After a short time some APs and (hopefully) some associated clients will show up.
@@ Line 95: / Line 94: @@
 ^ BSSID        | The MAC address of the AP  |
+^ RXQ          | Quality of the signal, when locked on a channel |
 ^ PWR          | Signal strength. Some drivers don't report it  |
 ^ Beacons      | Number of beacon frames received. If you don't have a signal strength you can estimate it by the number of beacons: the more beacons, the better the signal quality |
@@ Line 111: / Line 111: @@
 ^ Probes       | Network names (ESSIDs) this client has probed  |
-Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack wep with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength.
+Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack WEP with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength.
 In the example above the net 00:01:02:03:04:05 would be the only possible target because it's the only one with an associated client. But it also has a high signal strength so it's really a good target to practice.
@@ Line 119: / Line 119: @@
 Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:
-  airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump rausb0
+  airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump wlan0mon
 With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk.  The "-''''-bssid" combined with the AP MAC address limits the capture to the one AP.  The "-''''-bssid" option is only available on new versions of airodump-ng.