WiFi Penetration Testing — Practical Guide

بسم الله الرحمن الرحيم

Today I am gonna be covering WiFi penetration testing along side some notes and commands that I hope you find helpful!

Introduction

This blog was inspired after giving a WiFi hacking workshop.

Let’s talk about what WiFi penetration testing / WiFi hacking is and when is it used for.

As a WiFi penetration tester, the goal is to get access to a certain WiFi, which is usually done by obtaining the WiFi password.

Furthermore, WiFi networks can sometimes act as initial access in red teaming engagements.

I will skip talking about the theory part even though you should definitely read about it, this guide is made to be hands-on and will cover the basics of WiFi hacking, mainly WPA/WPA2 & a brief about WPA 2 enterprise.

Getting your WiFi Adapter Ready

In order to perform the attacks described you will need a physical WiFi adapter that supports monitor mode. I will be using my Alfa adapter which does support monitor mode (be sure to google your WiFi adapter before purchasing it).

First, we will run iwconfig to check all connected wireless network interfaces.

iwconfig output

We can see a couple of important information such as our wireless adapter name (wlan0) and the mode which is managed, in order to be able to run our attacks successfully we will need to change it to monitor mode.

We can achieve that by running

sudo airmon-ng start kill
sudo airmon-ng start wlan0
iwconfig # make sure mode now shows monitor

Monitor mode now enabled

That’s GREAT!

Now we can start with our attacks as described below.

Personal WPA/WPA2

Personal WPA/WPA2 are your common WiFi networks found at homes, and local stores and are the most common WiFi type you will run against.

Back to our goal, we want to get the WiFi’s password, in order to do that we can capture the WiFi’s password hash (also known as Four-way handshake).

Four-way handshale

After obtaining the WiFi hash we will try to crack it to get the WiFi’s clear text password.

Let’s get started, shall we!

As we mentioned we need to capture the WiFi’s hash, we can either monitor and wait for someone to authenticate (connect) to the network, or we can force a client to reauthenticate by disconnecting (deauthentication).

Note that in a red teaming simulation where you have to stay under the radar, monitoring the traffic till a client authenticates is the approach you want to go with.

Phase 1 (Finding our client’s WiFi network)

Let’s start by scanning and finding our target network.

sudo airodump-ng wlan0

airodump output

For demonstration purposes, I will be targeting my own WiFi network. A couple of pieces of information are needed such as ESSID (fh_f41c38) and our BSSID (58:AE:F1:F4:1C:38) which is the MAC address of the AP (access point) finally let’s keep in mind it is running in channel 11.

Phase 2 (Finding connected clients)

Now with that information in mind, let’s scan for connected clients so we force them to be disconnected, allowing us to capture the Four-way handshake and extract the WiFi hash from it.

sudo airodump-ng wlan0 -c 11 --bssid 58:AE:F1:F4:1C:38

Obtaining our victim’s MAC address

Phase 3 (Capturing the Four-way handshake)

Getting the handshake while running two terminals.

Terminal 1:
sudo airodump-ng wlan0 -c 11 --bssid 58:AE:F1:F4:1C:38 -w save
Terminal 2: (Note: this will disconnect the client, be careful)
sudo aireplay-ng -a 58:AE:F1:F4:1C:38 -c F6:3D:C8:12:BC:EC --deauth 10 wlan0

Four-way handshake captured successfully!

We have successfully captured the Four-way handshake, we can verify that by finding save-01.cap in our current working directory. Now that we have a cap file with the four-way handshake we can try cracking it to get the clear text password for the WiFi.

Cracking the hash

There are two main methods that we will be covering.

First Method: Using aircrack-ng which takes cap files as input and a wordlist, this will work from our Linux machine as follows.

aircrack-ng save-01.cap -w /usr/share/wordlists/rockyou.txt

However, this method is discouraged since its relatively slow and takes around 30 minutes to finish rockyou.txt.

Second Method (recommended): Converting the cap file to a format hashcat can handle and then crack the hash with hashcat. We can use hashcat’s website to extract the WiFi hashes from any capture file.

Now we can use hashcat on our downloaded file with mode 22000, I will be using hashcat with windows since that would be a faster approach.

.\hashcat.exe -a 0 -m 22000 .\wifi_hash .\rockyou.txt

hashcat needs less than a minute to finish rockyou.txt

However, the WiFi’s password can’t be found in rockyou.txt, that is because my router is still on the default password :)

After researching my ISP (let’s not mention them to not get into any issue) the default password is wlan followed by 6 random hex characters which we can crack using hashcat with attack mode 3 as follows.

.\hashcat.exe -a 3 -m 22000 .\wifi_hash wlan?h?h?h?h?h?h

AND WE CRACK MY WIFI’S PASSWORD

Hash cracked!

Be sure to test more than one password list, for example a password of phone numbers could be the password, also some random 8 numbers which can be tested with.

.\hashcat.exe -a 3 -m 22000 .\wifi_hash ?d?d?d?d?d?d?d?d

And much more, this is up to your imagination and experience with common WiFi passwords.

WPA2 Enterprise

You may encounter clients running WPA2 enterprise which companies usually use. The main difference is that in WPA2 enterprise a username and password are needed to authenticate rather than just a password in the traditional personal WPA configurations.

I may cover some attack scenarios for the WPA2 enterprise.

If you are interested in that topic be sure to check the resources down below.

Final Thoughts

Some VERY useful notes:

https://github.com/dh0ck/Wi-Fi-Pentesting-Cheatsheet/

https://github.com/alenperic/OSWP-Study-Guide

Finally, if you like to practice on your own with hands-on labs I really RECOMMEND checking out https://lab.wifichallenge.com/challenges.

That is all for today, thanks for reading and happy hacking!

My LinkedIn: https://www.linkedin.com/in/yousof-nahya/