Original subtitles

Okay now that we have created our fake access point and it's working perfectly against CPS hate STDs

and all web sites it's automatically show in it's logon screen and the logon screen looks exactly like

the logon screen that the people are used to.

We are ready to move to the next step which is the authenticating users.

So you're going to go ahead use airplay ngi and authenticate all users or some users from the actual

network so that they connect to your version to a network and enter their password in there.

Now I'm not going to be covering that because I've already covered how to run a authentication attack

again single multiple and all clients before.

So I'm going to skip over this and I'm going to assume that you already authenticated your clients and

your client is now or clients are connecting to your fake access point.

The final step is going to be sniffing the log in and the password that they're going to be entering.

Now I've also covered sniffing before but this is the end result of everything that we have done so

far.

So I can help to show it.

And I'm also going to do it using a slightly different way just to show you a handier way for this particular

scenario.

So I'm going to go to my caddie machine.

So I already have my wireless access point running and it's called the Royal Wi-Fi version too.

As you know now all I have to do is just capture the packets and I'm just going to use something a little

bit different.

Like I said because I think this is going to be more convenient.

So we're going to use a tool called the shark and this is actually what wireshark uses when sniffing

for data.

We're going to set the interface 2.0 and we're going to use Dasch W to store the data in a file and

that's called this royal wife I that cup so there isn't a very simple command we're doing teeshirt we're

giving it the interface that we want to sniff the data on and I'm using zero because none zero is the

wireless adapter that we're using to broadcast the signal.

So any request to target sends they're actually going to send it to the router and the router in this

case is lan 0 because it's what broke broadcasting our signal Worster everything using the dash w option

into a file called Royal Wi-Fi.

I'm going to hit enter and as you can see this is not going to display anything for me.

This is literally just going to capture packets.

Store them in a file called Royal Wi-Fi Cup.

So that's why it's really handy because I can just let this run and then come back to it later on open

it and Wireshark and analyze it.

So let's go to the Windows machine.

And let's connect royal Wi-Fi.

And as you can see as we've seen before when you try to lie again when you connect you'll automatically

get the log in page.

Now we're assuming that you should of by now you should have ran the authentication attack so that nobody

can connect to the actual network and they can only connect to your fake AP.

So they're going to go on English.

This is not going to be suspicious at all to them because this is exactly the same page that they're

used to enter their information on.

So the user is going to put their user name which is and I'm going to put the password which is one

two three four five six

I'm going to click on Logan and as you can see it's automatically tell me could not get portal configuration.

So the person is going to think that there is an error or something is going wrong.

Now let's go back to the Callimachi and I'm going to stop this by doing Control-C and then I'm going

to open Wireshark

and we'll analyze the file that contains the data that we just captured.

So I'm going to go to File Open and the file that we just created is called Royal y Fido's Cup.

Gonna click on open

and as you can see we have all the packets that we captured so far.

And here now what we're looking for and what we're interested in is TTP packet's because as you remember

we added a form in the same old page and we said that for him to use a post request.

And that's why I said if we are that it's going to be very easy for us to analyze and find the username

and password.

So in the filter and here I'm just going to type in TTP and that will show me only the TTP packets that

were sent over this network.

And as you can see here all these requests are get through quest.

Now again we set the method in our forums that we either manually to use post.

So we're going to look for something that says post in here.

OK.

And we have a post request in here.

Now if we click on the Hastey MLA form you can see that we have a form item called username and the

value for that was.

And then we have another form item and the value for that is 1 2 3 4 5 6.

So we managed to capture the username and password right now.

And all we have to do is just go in and log into that network news in the username and password.