All language subtitles for 2. Discovering Hidden Networks

Now one of the major obstacles that you might find while trying to gain access to a network is if the

network does not broadcast its name.

So if the network is hidden if the network is hidden then you won't be able to connect to the network

even if it does not use any password.

And if it uses a password then you won't be able to use the attacks that we're going to talk about in

future lectures.

So you literally want to be able to do anything until you know the name of the network.

So just to show you an example here I have my own network and I've said it to be hidden.

So I checked this box which says Musk says ID.

Now this could be called something else for you again but for me that's the name of it.

And I've called the network test AP.

So the network actually has a name but it just doesn't broadcast the name in the air.

I've also said the network to not to use any security.

So people can connect as long as they know what the network name.

So if we go here on the Windows machine I just want to show you an example if we go on Wi-Fi networks

you'll see that there is a hidden network around us.

But if we try to connect to the network if I click on it and click on Connect the first thing that it's

going to ask me is to enter the name of the network.

Therefore we can't actually connect to it if we don't know its name.

And if the network is using encryption.

So if it's using a password for the network then we won't be able to launch the crack in attacks if

we don't know the name.

So if your target network is hidden the first step is always to try and determine the name of that network

regardless of whether it uses encryption if it uses a password or if it does not use a password.

So in this lecture I'm going to cover how to determine the name of hidden networks and how to connect

to the network.

Now I'm going to go to my Cali machine and the men on Arrow dump and you on my wireless card in monitor

mode.

So we did this before.

All I do is.

Don't be angry.

And then I put the name of the wireless card which is Mounseer.

And if I hit enter as you can see I can see all my networks around me and we can see them to hit the

network around us and hit the network is actually this one.

So you can see that we can actually get all the information of that network so we can get its MAC address.

We can see its distance we can see the beacons we can see the data if there was a lot of data sent.

We can see the encryption.

So in our case it's open.

It's not using encryption.

But if it was using encryption then you'll see it uses WEP or WPA or whatever its use in.

The only thing that's hidden is the name of the network so you can see it here.

We actually don't have the name of the network.

So basically when a network is configured to be hidden it only hides the network name.

But it still broadcasts in it its existence it still Telen all the devices around other that exist.

My mac addresses this.

My channel is this and it's given all the information except the name.

And basically what it's saying is if you know my name then you can connect to me.

So what we're going to do now is we're going to run a dump and against this specific network because

that's our target.

And we've done this in previous lectures again.

But I'm just going to do it real quick here.

So I'm going to copy its MAC address and I'll get an error down punji and I'm going to specify the SS

ID of the target network which is the MAC address

and then I'm going to specify the channel which is 6 for this target network.

And then I'm going to give as my wireless card and monitor mode which is zero.

So again we run this command a lot of times it's a point.

You were given at the MAC address of the target network.

And then we're given the channel which is six and then we get with the wireless card name in monitor

mode.

I'm going to hit enter and you can see now it's a dump and he is running against this specific network.

Now in many cases if the target network is a bit active you'll actually be able to get the name of it

simply by run up against it.

And our case we can see that the network is not active so we don't know and he is not able to determine

its name.

But what we can also see is we can see that there is a client connected to the network right here because

we said the second section of Erol Don't be angry.

Show us the connected devices so we can see that there is a device connected to this network and that

device has this MAC address.

So what we're going to do now is we're going to use audio authentication attack like we did it before

and we're going to disconnect this device from this network.

But the difference is we're actually going to disconnected for a very short period of time so that it

automatically reconnects to the target network and when it does that it's going to send the network

name in the air.

Since we have a dump engines running it will be able to capture that name and it will show it to us

here and then we'll know the name of the network.

So again the attack is going to be very simple.

Oregon to do is we're going to do a deal authentication attack for a very short period of time.

That's going to disconnect the target device for a split second.

So they won't even feel it and the operating system will automatically connect back to the network when

it does that it's going to send the network name in the air and we're Sniffen on that channel.

So we'll be able to capture that name and we'll know the network name.

So I'm going to split the screen and you've actually run this attack before.

So I'm just going to do it here again and it will be a chance for you to revise it.

So we're going to do a replay ngi

Diot and then we're going to put the MAC address of the target network after the argument and then I'm

going to do mine a C and then I'll give the MAC address of the client that I want to disconnect and

it's this one right here.

And finally I'm going to put the name of the wireless card in monitor mode which is Montsoreau Now I

actually forgot to specify the number of the authentication packets to send in the previous videos we

actually used a really big number in here so that we can keep the target computer disconnected for as

long as possible.

In this video we actually want them to be disconnected for a split second.

So I'm going to use four packets usually two is sufficient.

But I'm just going to use for just to make sure that the target device will get disconnected.

So it's all because we're using a very small number.

It'll be disconnected for a very short period of time.

And the target person who is used in that network will not even feel that.

So the same command that we did before nothing different airplanes.

We're doing the authentication attack and we're using a very small number of packets because we don't

want the target person to feel that they got disconnected.

We gave the MAC address of the target network after the option and then we gave the MAC address of the

client.

I want to disconnect after the C option.

I'm going to her Antar

and as you can see nearly after sending two packets we were able to determine the name of the network.

So right here in Arizona and it's on us that was the name of the network is test a.p.

And now if the network is open like in our case we can just go ahead and connected that network or if

the network is using encryption like whipped WPA or WPA to then we actually know the name of the network

now and you'll be able to launch the attacks that you're going to learn in the next lectures against

that network and then determine its key.

So the attack was very simple.

All we had to do is run aero dump energy against our specific target network and then the authenticate

one of the clients for a very short period of time and they'll automatically get connected to the network

when they do that we'll know the network name.