Original subtitles

‫Now before leaving the section

‫and move into the gaining access section,

‫where I'm gonna teach you how to break

‫the different encryptions and gain access to networks.

‫I wanna spend one more lecture talking about

‫a really useful attack that still falls under

‫the pre-connection attacks, under the section.

‫The attack that I wanna talk about

‫is the deauthentication attack,

‫this attack allow us to disconnect any device

‫from any network before connecting

‫to any of these networks

‫and without the need to know the password for the network.

‫To do this,

‫we're going to pretend to be the client

‫that we want to disconnect by changing

‫our MAC address to the MAC address of that client

‫and tell the router that I want to disconnect from you.

‫Then we're going to pretend to be the router,

‫again, by changing our Mac address

‫to the router's Mac address,

‫and tell the client that you requested to be disconnected,

‫so I'm going to disconnect you.

‫This will allow us to successfully disconnect

‫or deauthenticate any client from any network.

‫Now we're actually not going to do this manually,

‫we're gonna use a tool called aireplay-ng, to do that.

‫From the previous lecture,

‫we know that this Mac address, right here,

‫belongs to an Apple computer and like I said,

‫this Apple computer is actually my computer, right here.

‫And as you can see,

‫this host machine is connected to this network, right here,

‫which is the same as the one that you see in here,

‫and it actually has internet access.

‫So, if I just look for test,

‫you'll see that I'm connected

‫and I can look for things, I can use Google.

‫So, I have a proper working internet connection.

‫Now, we're gonna come back here

‫and we're going to use a tool called aireplay-ng,

‫to launch the deauthentication attack

‫and disconnect this Mac computer from the internet.

‫So, we're gonna to type the name of the program,

‫which is aireplay-ng,

‫we're gonna tell it that I want to run

‫a deauthentication attack.

‫Then, I'm gonna give it the number

‫of deauthentication packets that I want to send,

‫so I'm gonna give it a really large number,

‫so that it keeps sending these packets to

‫both the router and the target device.

‫Therefore I'll disconnect my target device

‫for a very long period of time.

‫And the only way to get it back to connect

‫is to hit Control + C and quit aireplay-ng.

‫Next, I'm gonna give aireplay-ng

‫the MAC address of my target network.

‫So I'm gonna do, dash a,

‫and give it the MAC address,

‫which I'm gonna copy from here,

‫then I'm gonna use, dash c,

‫to give it the MAC address of the client

‫that I want to disconnect.

‫And the client that I want to disconnect

‫is this client right here, which is the Apple computer,

‫like we said.

‫So, I'm gonna copy it and paste it here.

‫If your target network runs on the five gigahertz frequency,

‫then you'll have to add, dash capital D,

‫to the command in here.

‫But my target, as you can see, it uses 2.4 gigahertz,

‫therefore, I don't need to do this,

‫and I'm simply just gonna add my wireless card

‫in monitor mode, which is mon0.

‫Now, It's very important to understand that

‫this command will only disconnect the target client

‫from the specified network.

‫So if there are other networks that the target clients can

‫connect to, it will automatically connect to them.

‫So in many cases,

‫it might connect to the five gigahertz version

‫of the network,

‫or it might connect to a completely different network

‫that it already knows the password to.

‫And if it's a mobile device,

‫it might even continue to have internet access

‫through its mobile data plan.

‫So it might seem like the attack did not work,

‫but it actually worked,

‫and the client just disconnected from this network

‫and is using another network.

‫To solve this,

‫all you have to do is simply open up a new terminal window

‫and run the exact same command,

‫but this time targets the new network that the client

‫connected to.

‫I actually covered that along with more advanced topics

‫in my advanced network hacking course,

‫check out the bonus lecture,

‫the last lecture of this course for more information

‫about my advanced network hacking course

‫and all of the other courses

‫that you can take along with this course.

‫So a very, very simple command we're typing, aireplay-ng,

‫this is the name of the program that we're going to use.

‫We're doing, dash dash deauth,

‫to tell aireplay-ng

‫that I want to run a deauthentication attack.

‫I'm giving it a really large number of packets,

‫so that it keeps sending the deauthentication packets

‫to both the router and the client,

‫and keep the client disconnected.

‫I'm using, dash a,

‫to specify the MAC address of the target router

‫or the target access point.

‫Then I'm using, dash c,

‫to specify the MAC address of the client.

‫Finally, I'm giving it, mon0,

‫which is the name of my wireless adapter in monitor mode.

‫Now you can run this command like this

‫and in most cases it would work, but in very rare cases,

‫this command will fail unless airodump-ng

‫is running against the target network.

‫So, what I'm gonna do now

‫is I'm gonna go back to my first terminal in here,

‫and I'm going to run airodump-ng,

‫using the command that we seen before.

‫And I don't want to write anything to a file,

‫so I'm going to remove the write argument.

‫So, I'm just doing a normal airodump-ng command,

‫I'm literally just giving it the BSS ID

‫of my target network and I'm giving it the target channel,

‫and then I'm just gonna hit Enter.

‫We seen how to do this, we spent a full lecture on it,

‫that's why I did it really quick.

‫And then I'm gonna go back to the command

‫that we wrote so far and I'm going to hit Enter,

‫now, as you can see aireplay-ng,

‫it's telling me that it's sending the

‫deauthentication packets.

‫And if we go back here and look up,

‫you can see that I actually lost my connection

‫and I'm trying to connect back.

‫So, obviously if I try to look for anything,

‫so let's say, test2,

‫you'll see, I'll get stuck and nothing will load for me.

‫So the only way for me to connect back

‫is if I go back here,

‫if I quit this by doing, Control + C, quit this again.

‫And now my machine should be able to connect back

‫and restore its connection.

‫This is actually very, very handy in so many ways,

‫it's very useful in social engineering cases,

‫where you could disconnect clients from the target network

‫and then call the user and pretend to be a person

‫from the IT department

‫and ask them to install a virus or a backdoor

‫telling them that this would fix their issue.

‫You could also create another fake access point

‫and get them to connect to the fake access point

‫and then start spying on them from that access point,

‫and we'll see how to do that later on in the course.

‫And you can also use this to capture the handshake,

‫which is what happened in here, actually.

‫And this is vital when it comes to WPA cracking.

‫And we'll talk about this,

‫once we get to the WPA cracking section.

‫So, like I said,

‫this is a small attack that can be used as a plugin

‫to other attacks or to make other attacks possible.