DOCSLIB.ORG

WEP/WPA Cracking

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
WEP/WPA Cracking GenCyber_WEP_cracking (2).docx Wireless System Administration Wireless Security Audit Tools - WEP/WPA cracking Goal: In this lab you will explore wireless security tools on the Kali suite. These tools will be an introduction to WEP and WPA security. 1 of 13 GenCyber_WEP_cracking (2).docx 1 Gather and organize 1.1 Gather required equipment: • Alfa AWUS036NH • Linksys WRT54GL or other Access point capable of being configured for both WEP and WPA security • Kali Linux on raspberry pi • Wireless client (a smartphone works well) 2 Setup - Kali In this section you will start Kali linux on your raspberry pi with the Alfa wireless adapter attached. This is your “attacking” station. 2.1 Kali Boot into Kali 2.2 Network Manager Stop Network Manager - kill it with fire: # service network-manager stop 2.3 Monitor Mode - airmon-ng In this section you will place your raspberry pi into monitor mode using airmon-ng. Use man airmon-ng to find the correct commands. 1. List and kill all possible programs that could interfere with the wireless card when placing it into monitor mode. 2. Determine your external (USB) Alfa wireless interface: # iwconfig 2 of 13 GenCyber_WEP_cracking (2).docx 3. Put your external (USB) Alfa wireless interface into monitor mode using airmon-ng. (Hint: the command used is very similar to the one we used the earlier this week to scan the wireless) Note: channel number in the command is going to be the same channel listed on top of the Linksys AP your are using. Normally you would perform scans of the wireless environment to do this yourself, but for time we are providing the channel for you. After running the command in step 3 you should have a new monitoring interface. 4. Determine your new wireless interface: # iwconfig Note: new interface is usually indicated by wlanXmon from the iwconfig output. X would be the interface number from the previous iwconfig output 3 Monitor mode - testing Testing Monitor mode Scenario: Making sure the “attacking” station (you raspberry pi) wireless card is in monitor mode. 3.1 Wireshark Use wireshark to test your wireless card. Browse to the wireshark application under Applications >> 09 – Sniffing & Spoofing >> wireshark 3 of 13 GenCyber_WEP_cracking (2).docx Select the new monitor interface you created in the previous section. Click on the blue fin in the top left corner of the application in order to start capturing packets on the monitor interface. You should be able to see traffic that is produced by devices using the channel you set in the previous section. This is traffic that is not generated by you raspberry pi. However, most of this traffic is encrypted and cannot be viewed in plain text currently. You can close wireshark after this test. 3.2 airodump-ng Start airodump to take a basic site survey # airodump-ng newInterface Look for your ESSID, and verify that it is indeed running WEP Using ctrl+c will send a break command to the program and end the program when you are finished. 4 of 13 GenCyber_WEP_cracking (2).docx 3.3 Capture Try to capture just the channel and look for just WEP encrypted networks # airodump-ng -c CHANNEL --encrypt WEP newInterface Verify that you are only capturing packets to and from your AP by making sure it’s the only AP listed. If not you have to specify a BSSID (MAC address of access point, this can be found in the originally airodump-ng command output): # airodump-ng -c CHANNEL --encrypt WEP newInterface --bssid BSSID You can stop airodump-ng using a Linux break command once you have verified that it is capturing correctly. 5 of 13 GenCyber_WEP_cracking (2).docx 4 WEP Next we’re going to initiate the WEP attack itself. This will require us to get the #Data column up to anywhere from 5000 to 10,000 IVs. This is going to be done with a standard attack that involves capturing a predictable packet (an ARP request) and re-playing it to force the connected clients to respond. 4.1 WEP - Capture - IVs Make a new directory: # mkdir /dump # mkdir /dump/GenCyber # mkdir /dump/GenCyber/WEPattack Now capture just the IVs to a file: # airodump-ng -w /dump/GenCyber/WEPattack/wepattack.pcap -c CHANNEL --ivs newInterface --bssid BSSID Leave this capture file running. 4.2 WEP - Associate First, In a separate terminal (or a new tab) run the following to Associate to an access point. Note: this will work better if you run it on a different network card than the one you are using to capture the packets. Example: if you are using the Alfa to monitor/capture packets, use the internal wireless card or another Alfa to associate/de-associate. You will need to use the commands necessary to set this into monitor mode like you did in section 3. to Associate: 6 of 13 GenCyber_WEP_cracking (2).docx Use man aireplay-ng to learn what the flags in the below command do. # aireplay-ng -1 0 -a BSSID-OF-AP monY Where monY is a different monitor interface than the one currently being used to capture IVs. Look for the “Association successful :-)” 4.3 WEP - ARP In a separate terminal (or a new tab) run the following command to listen for an ARP packet to replay. Note: this will work better if you run it on a different network card than the one you are using to capture the packets and use the same one that you just associated with. Example: if you are using the Alfa to monitor/capture packets, use the internal wireless card or another Alfa to associate/de-associate. 7 of 13 GenCyber_WEP_cracking (2).docx Use man aireplay-ng to learn what the flags in the below command do. # aireplay-ng -3 -b BSSID monY Note: If you don't see any ARPs, connect your smartphone to the access point and try web browsing. Use Key 1 as the password to connect your phone or laptop. Note: If you are still having issues, try to re-associate: to Associate: # aireplay-ng -1 0 -a BSSID-OF-AP monY 8 of 13 GenCyber_WEP_cracking (2).docx 4.4 WEP - Capturing You should have two windows open: One listening/replaying ARP packets and one capturing the IVs generated from the wireless packets going in and out of the network. Go back to your airodump-ng window, and the #Data should be climbing quickly. When it reaches somewhere between 5000 and 10,000 you can stop it. If the IV aren’t increasing, read the following: http://www.aircrack- ng.org/doku.php?id=i_am_injecting_but_the_ivs_don_t_increase&Dok uWiki=1943ff9484c75095683d41ac6313a148 9 of 13 GenCyber_WEP_cracking (2).docx 4.5 WEP - Cracking After the #DATA reaches between 5000 and 10,000 - Run the following to start WEP key recovery (you may need to select the proper network). In some instances, you may need to get #DATA above 15,000 in order to recover the key. # aircrack-ng /dump/GenCyber/WEPattack/wepattack.pcap-0#.ivs 5 Bonus - Access Point - WPA If you complete the WEP cracking you can try your hand at some WPA cracking. In this section, you will setup your access point to run WPA on your wireless network. Login to the router at http://192.168.1.1 Username/password => admin Click the “Wireless” tab Click the “Wireless Security” section Set “Security Mode” to “WPA Personal” with TKIP Set “Passphrase” to “blackhat” 5.1 Monitor mode - testing On the attacking machine, Look for our WPA access point: # airodump-ng monX 10 of 13 GenCyber_WEP_cracking (2).docx 5.2 WPA - Capture In order for this attack to work, we actually need to have a client attached to our network already. Use a smart phone, another laptop, or something else WPA-compatible to connect to your network. Once you have a client attached, issue the following command: # airodump-ng -w /dump/GenCyber/WEPattack/wpaattack.WPA --bssid YOUR_BSSID -c CHANNEL monX 5.3 WPA - Deauth Next we have to de-auth our client so we can capture the handshake. In a new window on the attacking machine: # aireplay-ng -0 30 -e YOUR_ESSID_MAC -c YOUR_CLIENT_MAC monX 11 of 13 GenCyber_WEP_cracking (2).docx 5.4 WPA - Handshake Once this runs, you should see “HANDSHAKE” near the top right part of the window. If not, re- authenticate with your device, and repeat the deauth flood until you do. Once you get the handshake, You can now stop the airodump-ng scan with a CONTROL-C 12 of 13 GenCyber_WEP_cracking (2).docx 5.5 WPA - Cracking You will now try to crack the WPA password against a dictionary file located at: /usr/share/wordlists/rockyou.txt In some cases, the rockyou file may be gzipped and you will need to uncompress it. We’re going to be doing a CPU-based dictionary attack, which is the slowest ways to do it. In a security setting, you’d either use amazon’s cloud-based GPU instances, or you’d build a password-cracking rig. There are also fast methods by using pre-compile password files known as “rainbow tables” that match passwords with SSIDs. In a new window type: # aircrack-ng wpaattack.WPA-{highest number}.cap -w /usr/share/wordlists/rockyou.txt Let this run for at least 10 mins, and by then you should have recovered your WPA passphrase (it’s in there) 13 of 13 .
Load more

Recommended publications
  • Exploring Open Source Wireless Tools by Jake Snyder (The Dread Pirate Roberts) @Jsnyder81 Who Am I?
    Exploring Open Source Wireless Tools By Jake Snyder (The Dread Pirate Roberts) @jsnyder81 Who am I? • Wireless Engineer at CompuNet Inc • CCIE-W #43153 • CWNE #161 • Security Enthusiast • Linux hobbiest • Wireless Field Day Delegate (http://techfieldday.com/event/wfd8/) • Blogger • Maker What does a set of professional tools cost? What I use at work: Ekahau ESS: $4000 Omnipeek: $2500 Chanalyzer + WiSpy: $1250 Aircheck: $2000 *All prices are approximates Professional tools in my first year. • Airmagnet Survey pro • Yup, that was it. http://www.popsugar.com/entertainment/Princess-Bride-Quotes-35919789#photo-35919789 “I mean, if we only had a wheelbarrow, that would be something.” -Westley Sometimes you have to build a wheelbarrow • Linux VM • Proxim 8494 • Airmon-NG • Wireshark “Well, why didn’t you list that among our assets in the first place” -Westley All these tools… Why Open Source? Pros: Cons: • Low Cost • Free if your time is worth • Flexibility nothing • Lots of available tools • Pieces of a solution, you have to put it together • Low barrier to entry • Requires knowledge • Time = investment “Please consider opensource as an alternative to suicide.” – Prince Humperdink What are my hobbiest opensource costs? Options for todays presentation: Raspberry PI: $223 Intel NUC $436 Raspberry PI 2B $38 NUC5CPYH: $134.00 ASUS USB-N53 $45 8G Memory: $34 Micro SD Card: $15 SSD: $40 Case: $5 Intel 7265 $28 Ubertooth: $120 WiSpy 2.4Ghz: $200 Existing Laptop: $8 • USB stick to boot linux • The chocolate coating makes it go down easier • VM is an option, albeit not a good one My Preferred Wireless Adapters • Asus USB-N53 • Intel 726x • 802.11n • 802.11ac • 2x2:2 • 2x2:2 • USB 2.0 • Mini PCIe half height and m.2 • Ralink RT3572 using RT2800 Driver • Intel IWLWIFI: Non-Free firmware • Works on Raspberry PI required • $45 on Amazon • $27 on amazon • Has issues with Deauth/Dissassoc • Lots of clients using them packets not being passed to host.
    [Show full text]
  • Evaluating Kismet and Netstumbler As Network Security Tools & Solutions
    Master Thesis MEE10:59 Evaluating Kismet and NetStumbler as Network Security Tools & Solutions Ekhator Stephen Aimuanmwosa This thesis is presented as part requirement for the award of Master of Science Degree in Electrical Engineering Blekinge Institute of Technology January 2010 © Ekhator Stephen Aimuanmwosa, 2010 Blekinge Institute of Technology (BTH) School of Engineering Department of Telecommunication & Signal Processing Supervisor: Fredrik Erlandsson (universitetsadjunkt) Examiner: Fredrik Erlandsson (universitetsadjunkt i Evaluating Kismet and NetStumbler as Network Security Tools & Solutions “Even the knowledge of my own fallibility cannot keep me from making mistakes. Only when I fall do I get up again”. - Vincent van Gogh © Ekhator Stephen Aimuanmwosa, (BTH) Karlskrona January, 2010 Email: [email protected] ii Evaluating Kismet and NetStumbler as Network Security Tools & Solutions ABSTRACT Despite advancement in computer firewalls and intrusion detection systems, wired and wireless networks are experiencing increasing threat to data theft and violations through personal and corporate computers and networks. The ubiquitous WiFi technology which makes it possible for an intruder to scan for data in the air, the use of crypto-analytic software and brute force application to lay bare encrypted messages has not made computers security and networks security safe more so any much easier for network security administrators to handle. In fact the security problems and solution of information systems are becoming more and more complex and complicated as new exploit security tools like Kismet and Netsh (a NetStumbler alternative) are developed. This thesis work tried to look at the passive detection of wireless network capability of kismet and how it function and comparing it with the default windows network shell ability to also detect networks wirelessly and how vulnerable they make secured and non-secured wireless network.
    [Show full text]
  • Wi-Fi Monitoring & Kismet
    Wi-Fi Monitoring & Kismet Mike Kershaw @KismetWireless Sharkfest 2019 Intro ● Wi-Fi sniffing has been around since the late 1990s ● Still something we need to do now… ● More and more “last-mile” is going to wireless ● More and more sensors, control networks, etc are going to wireless ● Offices are increasingly using Wi-Fi instead of running cable ● BYOD (Bring Your Own Device) is huge ● Plenty of security problems need monitoring Get off my lawn ● Kismet is over 18 years old now ● I used to joke it was old enough to drive. Now it’s old enough to buy cigarettes and vote. ● Undergone several significant rewrites over that period ● Most recent major rewrite in the last few years adds all new capabilities, user interfaces, etc ● More on this later though... Why do we need something special? ● Why do we even need another tool just to monitor Wi-Fi ● There’s already so many that monitor packets ● Maybe have heard of one or two ● Rhymes with “Tire Bark” ● I heard there’s some sort of conference about it? Wi-Fi is a unicorn ● Truly shared medium. Anywhere signal goes, it impacts something ● Not just shared media with your network, but shared with everyone near you ● Multiple networks overlap bandwidth and channel access ● Isn’t Ethernet. Your OS might act like it is. It isn’t. ● Remember the OSI model? You’re suddenly really going to care about layer 1 and 2 more than you ever did before. ● Knowing a network is there is not knowing what’s going on with the network ● Knowing what’s impacting your network is not simple! Discovering Wi-Fi networks ● Several techniques can be used to discover Wi-Fi ● Scanning mode: looks for advertising networks; can’t see clients, but does a good job showing what access points are out there.
    [Show full text]
  • Wireless Course: Wi-Fi Tools
    Wireless Course: Wi-Fi Tools These slides have been updated and condensed from the original course material All things Great and Wi-Fi “How do I get my insulin pump configured for WEP?” -- A real customer Sniffing Wi-Fi - Very simple - but requires firmware and drivers that can do it. - Linux definitely can. BSD often can. Windows can only with special hardware. MacOS can - sometimes. - Mobile devices often cannot due to firmware limitations Don’t call it promisc mode - Promisc mode on wired Ethernet turns off the hardware filter, but still reports 802.3 Ethernet frames - Monitor mode turns off associating to APs and returns 802.11 formatted frames! - No longer an Ethernet device to Linux! 802.11 in normal (or promisc) mode - 802.3 formatted data frames from the network you’re associated to - *Maybe* some data-only frames from overlapping networks, because sometimes, drivers suck - Not much else 802.11 in Scanning Mode - What Netstumbler uses - What your OS uses to display nearby networks - Queries card firmware for advertising networks - No way to get packetized data, just summaries - Really noisy 802.11 in Monitor Mode - Raw 802.11 frames - Management frames (beacons, probes, etc) - Data frames (from all networks overlapping this channel) - Ack, CTS, RTS frames - Broken crap, like fragmented frames Broken Frames - Normally cards only report valid frames - Some devices and drivers will report invalid frames which are corrupted - Collisions are the most common problem - FCS (frame checksum) filtering is your friend What Supports Monitor? - Anything using mac80211-based (ie in-kernel) drivers in Linux probably works - Anything using out-of-kernel drivers almost definitely does not work - Beware! Many distributions ship out-of-kernel busted drivers! - Atheros is good.
    [Show full text]
  • Wifi Capture and Injection on Various Oses Revisited Thomas D’Otreppe
    WiFi capture and injection on various Oses revisited Thomas d’Otreppe SharkFest ‘16 • Computer History Museum • June 13-16, 2016 whoami • Security researcher • Author of Aircrack-ng • Created Offensive Security Wireless Attacks aka WiFu • Software developer @ MainNerve SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Agenda • What’s monitor mode? • Linux • Windows • BSD • OSX • Android • Demos SharkFest ‘16 • Computer History Museum • June 13-16, 2016 What’s that? • Monitor (aka RF Mon) mode is awesome • Packet injection is awesomer SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Linux • Most popular platform • WiFi adapters are cheap • Has had support for a very long time • Lots of tools support it • WiFi stack got better over time • Custom • ieee80211 • mac80211 SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Adapter support • Most of them (if not too new) • https://wikidevi.com • Vendor drivers: • No monitor mode support • Never, ever SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Tools • Aircrack-ng • Wireshark • Kismet • Tcpdump • Dumpcap • A lot more… SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Enable monitor mode Enable monitor mode 1. airmon-ng check kill 2. airmon-ng start wlan0 Start capturing • airodump-ng wlan0mon SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Wireshark • Capture Options SharkFest ‘16 • Computer History Museum • June 13-16, 2016 tcpdump and others • As root, use –I to put interface in monitor mode • tcpdump -I -i wlan0 • dumpcap –I wlan0 • tshark –I –i wlan0 SharkFest ‘16 • Computer History Museum • June 13-16, 2016 Wireshark, tcpdump and others • Sometimes monitor mode/changing link layer (to 802.11) fails.
    [Show full text]
  • Lab 6 Part 2: Wireless Exploitation & Defenses
    计算机科学与工程系 Department of Computer Science and Engineering CS 315 Computer Security Course Lab 6 Part 2: Wireless Exploitation & Defenses Introduction In this lab students will explore ways to perform wireless attacks and understand potential defenses. The attacks that will be covered are inspecting & modifying wireless card parameters, changing the wireless transmission channel, flooding attacks, and cracking keys of WPA2 protected networks. Software Requirements All required files are packed and configured in the provided virtual machine image. - The VMWare Software http://apps.eng.wayne.edu/MPStudents/Dreamspark.aspx - The Kali Linux, Penetration Testing Distribution https://www.kali.org/downloads/ - Wireshark: Network protocol analyzer https://www.wireshark.org/#download - Aircrack- ng: a suite of tools to assess WiFi network security http://aircrack-ng.en.softonic.com/ Fengwei Zhang – CS 315 Computer Security Course 1 Setup an Access Point In this lab, we use a TP-LINK Wireless N300 Home Router as an example, but the same concepts or ideas are applicable on other routers. Next, it explains the basic steps to setup the access point’s Service Set Identifier (SSID) and security mechanism. If you have done this before, skip this section. Figure below shows a TP-LINK Wireless N300 Home Router that we are using in the classroom. Step 1: Connect your laptop or desktop to a router. This step depends on routers. Some routers require using Ethernet cable to physical connect the router. Some other routers may be able to connect via wireless using its Service Set Identifier (SSID). For the router that we are using in the classroom need to physically connect to one of the router’s LAN ports.
    [Show full text]
  • Advanced Attack Against Wireless Networks Wep, Wpa/Wpa2-Personal and Wpa/Wpa2- Enterprise
    INTERNATIONAL JOURNAL OF SCIENTIFIC & TECHNOLOGY RESEARCH VOLUME 4, ISSUE 08, AUGUST 2015 ISSN 2277-8616 Advanced Attack Against Wireless Networks Wep, Wpa/Wpa2-Personal And Wpa/Wpa2- Enterprise Muthu Pavithran. S, Pavithran. S, ABSTRACT: In the emerging world of electronics the wireless devices are used by millions of people in their day to day life. Every person is constantly in contact with the cyberspace. Thus, ensuring the proper encryption facility is a major undertaking to offer dependable communication. The aim of this paper is to transmit a wireless penetration test and compares the encrypted key of a wireless network with a file that contains the captured packets as alphanumeric letters with the help of Kali Linux. This paper shows penetration tests in WEP and WPA/WPA2 protocols, and also the methods to develop these protocols using various attacks and to supply tools that separate the vulnerable access point protocol for the web administrators to protect their networks. ———————————————————— I. INTRODUCTION attacks and PTW attacks are described.[5].How to secure Hackers who will seek for data to steal or compromise our wireless world and gives steps to take care by the user functionality. While the traditional security measures are for not affected by the attacker.[6].Describes 2 attacks on less efficient the wireless attack surface presents a singular IEEE 802.11 WEP,WPA.Deals with TKIP to encrypt traffic. and difficult challenge. Most of the wireless nets are much How to deal with ARP request and response and to send unprotected so it is vulnerable to assault. When we with custom network.[7].Effective security protocols right consider Wi-Fi most of the people have consciousness from evolution to existing scenario and discusses various about two major encryption techniques (WEP) Wired pros and cond of security protocols in WLAN with respect to Equivalency Protocol and (WPA) Wi-Fi Protected Access its countermeasure techniques on various attacks.[8].
    [Show full text]
  • Fortiwifi and Fortiap Configuration Guide Fortinet Technologies Inc
    FortiWiFi and FortiAP - Configuration Guide Version 6.2.0 FORTINET DOCUMENT LIBRARY https://docs.fortinet.com FORTINET VIDEO GUIDE https://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT https://support.fortinet.com FORTINET TRAINING & CERTIFICATION PROGRAM https://www.fortinet.com/support-and-training/training.html NSE INSTITUTE https://training.fortinet.com FORTIGUARD CENTER https://fortiguard.com/ END USER LICENSE AGREEMENT https://www.fortinet.com/doc/legal/EULA.pdf FEEDBACK Email: [email protected] Aug 4, 2021 FortiWiFi and FortiAP 6.2.0 Configuration Guide 01-620-481070-20210804 TABLE OF CONTENTS Change log 8 What's new in this release 9 Introduction 10 Wireless network equipment 10 FortiAP units 10 FortiGate units 10 FortiWiFi units 11 Wireless management topologies 11 Integrated wireless management 11 Cloud AP management 12 Dedicated wireless controller 12 Related products for wireless networks 12 FortiPlanner 12 FortiManager 13 FortiAnalyzer 13 Wireless network configuration 14 SSIDs on FortiWiFi units 15 Reserved VLAN IDs 15 Wireless network configuration tasks 16 Setting your geographic location 17 Creating a FortiAP profile 17 Defining a wireless network interface (SSID) 20 Configuring DHCP for WiFi clients 23 Configuring security 24 WPA-Personal security 25 WPA-Enterprise security 25 Captive portal security 26 Adding a MAC filter 28 Limiting the number of clients 29 Enabling multicast enhancement 30 Defining SSID groups 30 Configuring dynamic user VLAN assignment 31 VLAN assignment by RADIUS 31 VLAN assignment by VLAN pool 33 Configuring user authentication 34 WPA2 Enterprise authentication 34 WiFi single sign-on (WSSO) authentication 35 Assigning WiFi users to VLANs dynamically 36 MAC-based authentication 36 Authenticating guest WiFi users 37 Configuring firewall policies for the SSID 37 Configuring the built-in access point on a FortiWiFi unit 38 Enforcing UTM policies on a local bridge SSID 39 FortiWiFi and FortiAP Configuration Guide Fortinet Technologies Inc.
    [Show full text]
  • A Non-Intrusive Cyber Physical Social Sensing Solution to People Behavior Tracking: Mechanism, Prototype, and Field Experiments
    sensors Article A Non-Intrusive Cyber Physical Social Sensing Solution to People Behavior Tracking: Mechanism, Prototype, and Field Experiments Yunjian Jia 1,*, Zhenyu Zhou 2,*, Fei Chen 1, Peng Duan 1, Zhen Guo 3 and Shahid Mumtaz 4 1 College of Communication Engineering, Chongqing University, Chongqing 400044, China; [email protected] (F.C.); [email protected] (P.D.) 2 School of Electrical and Electronic Engineering, North China Electric Power University, Beijing 102206, China 3 Guoxin Tendering Group Co., Ltd., Beijing 100044, China; [email protected] 4 Instituto de Telecomunicações, Campus Universitário de Santiago, Aveiro 3810-193, Portugal; [email protected] * Correspondence: [email protected] (Y.J.); [email protected] (Z.Z.); Tel.: +86-23-6510-5059 (Y.J.) Academic Editors: Mianxiong Dong, Zhi Liu, Anfeng Liu and Didier El Baz Received: 31 October 2016; Accepted: 21 December 2016; Published: 13 January 2017 Abstract: Tracking people’s behaviors is a main category of cyber physical social sensing (CPSS)-related people-centric applications. Most tracking methods utilize camera networks or sensors built into mobile devices such as global positioning system (GPS) and Bluetooth. In this article, we propose a non-intrusive wireless fidelity (Wi-Fi)-based tracking method. To show the feasibility, we target tracking people’s access behaviors in Wi-Fi networks, which has drawn a lot of interest from the academy and industry recently. Existing methods used for acquiring access traces either provide very limited visibility into media access control (MAC)-level transmission dynamics or sometimes are inflexible and costly. In this article, we present a passive CPSS system operating in a non-intrusive, flexible, and simplified manner to overcome above limitations.
    [Show full text]
  • TRACING Ifconfig Commands from Userspace to Device Driver
    SEE TEXT ONLY TRACING ifconfig Commands from Userspace to Device Driver I am currently working on expanding FreeBSD’s rtwn(4) wireless device driver. I have the basics down, such as initialization, powering on and off, loading the firmware, etc., and am now trying to fill in specific ifconfig(8) methods. This requires an in-depth knowledge of how ifconfig(8) commands are ultimately delivered to the driver. I could not find concise documentation that outlines each stage of the process, so I wrote one! BY FARHAN KHAN 18 FreeBSD Journal his article is specific to FreeBSD 12.0-CURRENT, but it should apply to any future version and other operating systems that utilize net80211(4), such as OpenBSD, NetBSD, DragonFlyBSD, and illumos. TI hope it serves to help the FreeBSD community continue to develop WiFi and other device drivers. This is not an exhaustive guide, but it should provide you with the basic order of operations. In this exam- ple, I walk through changing the channel on your WiFi card and placing it in monitor mode as follows: # ifconfig wlan0 channel 6 wlanmode monitor High-level Summary FreeBSD’s ifconfig(8) utilizes the lib80211(3) userspace library which functions as an API to popu- late kernel data structures and issue the ioctl(2) syscall. The kernel receives the ioctl(2) syscall in a new thread, interprets the structure, and routes the command to the appropriate stack. In our case this is net80211(4). The kernel then creates a new queued task and terminates the thread. Later on, a different kernel thread receives the queued task and runs the associated net80211(4) handler, which immediately delivers execution to the device driver.
    [Show full text]
  • WLAN Pi Deep Dive Instructors: ​ Jerry Olla & Ferney Munoz Twitter: ​ @Jolla / @Ferney Munoz
    WLAN Pi Deep Dive Instructors:​ Jerry Olla & Ferney Munoz Twitter:​ @jolla / @Ferney_Munoz Session Overview The goal of this session is to provide you with the knowledge and hands-on experience using the WLAN Pi to analyze and monitor Wi-Fi networks. The WLAN Pi is a versatile hardware and software platform that is specifically designed with wireless professional in mind. It has been loaded up with many Wi-Fi tools that can assist you in analyzing and troubleshooting Wi-Fi issues. Essentials you’ll need Laptop​ - Windows or macOS ● With enough battery to make it through the 2hr session, power may be limited ● Wireshark​ (with SSHdump) ● SSH client (Windows 10 and macOS have built in SSH clients) ○ If needed, ​Putty​ is a free SSH client for Windows What’s included 1. Custom WLAN Pi kit​ - includes a 16GB microSD card, preloaded with all the ​fun toys​ important Wi-Fi tools you’ll be using, a Wi-Fi adapter (Comfast CF-912ac), USB-C cable, and USB-A adapter. 1 WLAN Pi Project The WLAN Pi project started in 2016 at WLPC. The goal was to create a portable, ready-to-use device that could function as a network endpoint for measuring network performance and throughput. Since then, it has been widely embraced in the awesome wireless community and after many contributions, this tiny box has evolved well beyond a network performance testing device. Today, it can also be used as a remote Wi-Fi scanner, packet capture tool, portable Wi-Fi signal generator and much more! These capabilities assist wireless professionals with designing better wireless networks, troubleshooting issues more quickly, and validating wireless network performance.
    [Show full text]
  • Penetration Testing on a Wireless Network. – Using Backtrack 5
    Bachelor’s Thesis (TUAS) Degree Program: Information Technology Specialization: Internet Technology 2013 Gbolahan Ola PENETRATION TESTING ON A WIRELESS NETWORK. – USING BACKTRACK 5 BACHELOR’S THESIS | ABSTRACT TURKU UNIVERSITY OF APPLIED SCIENCES Information Technology | Internet Technology 2013 | 55 Instructor: Lassi Junnila Gbolahan Ola PENETRATION TESTING ON A WIRELESS NETWORK -- USING BACKTRACK 5 This thesis aim to demonstrate and analyse various types of threat that are encountered while using a wireless network. Wireless network unarguably has made the accessibility to the Internet much easier; it cannot be overstressed that it also has loopholes that can be used to attack an unknown user. KEYWORDS: Wlan, BackTrack 5, Wireshark, Access Point TURKU UNIVERSITY OF APPLIED SCIENCE, BACHELOR’S THESIS | GBOLAHAN OLA FOREWORD I give glory to God for the gift of life to complete this work. Gratitude to Lassi Junnila for taking the time to supervise this project. Lastly I thank my family especially my mother for her words of encouragement throughout my studies. Autumn 2013 Turku Gbolahan Ola TURKU UNIVERSITY OF APPLIED SCIENCE, BACHELOR’S THESIS | GBOLAHAN OLA TABLE OF CONTENTS 1 INTRODUCTION 1 1.1 Motivation 1 1.2 Thesis Objectives 1 1.3 Organisation and Structure 2 2 IEEE 802.11 4 2.1 Standards and Bands 4 2.2 Channels and Frequencies 8 2.3 Headers and Frames 11 2.4 Security 23 3 BACKTRACT 5 28 4 SETUP AND INSTALLATION 30 4.1 Hardware 30 4.2 Testing the Wireless Card for Sniffing 31 4.3 Software 33 5 PENETRATION TEST 35 5.1 Pawning Beacon Frames 35 5.2 Pawning Hidden SSID 40 5.3 De-authentication Attack 45 5.4 Wpa-Psk Cracking 49 6 SUMMARY 53 REFERENCES 54 FIGURES Figure 1.
    [Show full text]