All language subtitles for 26 - Hacking WPA & WPA2 Without a Wordlist English

OK, now that we know what the bloops is and how it can be used to recover the password for a WPA and

WPA two networks, let's see how to do that in practice.

So right here I have my curling machine, I've already enabled monitor mode on my wireless adapter on

one zero.

Now usually we use aero dump energy to see all the networks around us.

But right now we want to see the networks that have the enabled.

But because, like I said, it's just a feature and people can turn this feature off.

So first of all, I'm going to use a tool called Wash.

To display all the networks around me that have enabled, so we're going to do wash dash dash interface

and give it my interface in monitor mode, which is more on zero.

So all we're doing is wash is the name of the tool interface to give it the interface, and one zero

is my wireless adapter in miter mode.

If I hit enter now, you'll see it'll list my network straight away.

Now I press control City Council this similar to dump and because it'll keep running unless you cancel

it.

And you can see this is my target network.

It's called Test app.

It's given us the vendor of the hardware used in this network.

And this access point, the LC key, tell us whether WPC is locked or not, because sometimes WPC logs

after a number of failed attempts.

So right now, this is no which means that we can actually go ahead and try to guess the pin.

It's given us the version of the it's using version one.

The signal strength is in here, the channel on the backside.

Now I explained the meaning of all of these things before in my A-roads lecture, so I'm not going to

talk about them now.

If you forgot the meaning of any of these terms, please go back to the Arrow Dump and G Lecture.

Now, this network actually uses WPA, too, so just to confirm this to you, if I go here to my host

machine and just try to connect to it.

You'll see that instilled in me that this uses a WPA to password, but like I said, we don't care if

it's WPA or WPA two because we're going to be exploiting a feature in these inscriptions, which is

the WPA feature.

So now that we know our target network uses the.

There's a good chance that this attack will work against it.

The only reason it might fail is if the target uses PPC or push button authentication.

Like I said, if the target uses PPC, then it will refuse all the pins unless the button is pressed

on the router and therefore this attack will fail.

The only way to know is to literally try this attack and see if it works.

So I'm going to copy the Mac address of this network or the society.

And the first thing that I'm going to do, similar to what we did with the Blue EP, I'm going to associate

with the target network using a fake authentication attack.

So basically, I'll be saying I want to communicate with you.

Please don't ignore me.

So that when I run the attack, the network will start accepting the pins and not ignore me.

So to associate, we're going to use the exact same command that we used when we did it with W EP.

So we're going to use airplay and we're going to tell it.

I want to run a fake authentication attack.

We're going to give it the delay.

So this is the time to wait between association attempts.

Previously, we set it to zero and we had to do this manually every now and then.

Right now, I'm going to set it to 30 so that we associate with the target network every 30 seconds.

Then I'm going to do a Dash eight to give it the Mac address of my target and Dash H to give it the

Mac address of my wireless adapter in monitor mode.

And we see that we can get this by doing ifconfig.

And copy it from here, we said it's the first 12 digits.

And I'll just replace the minus with the column.

And finally, I'm going to give it the name of my wireless adapter in monitor mode, which is my zero.

So I explained this in details before.

That's why I did it quickly.

If you don't remember how I did this.

Please go back to the fake authentication attack lecture.

So the command is ready now, but I'm not going to execute it.

I'm going to go down to the bottom terminal and run river, which is the program that will brute force

the pin for me, and only then I will associate with the target because otherwise a Triple-A energy

will fail to associate with my network.

So I'm going to move to this terminal right here.

I'm going to clear the screen.

And we're going to run River, which is the program that's going to brute force the pin, so it's going

to try every possible pin until it get the right pin.

Once it has the right pin, it will use it to compute the actual WPA key.

So using river is very, very simple.

It's very similar to everything we've been doing so far.

So first of all, we have to type the program name, which is the river.

Then I'm going to do a dash dash beside to give it the Mac address of my target network.

So I'm just going to paste it.

Then I'm going to do a Dash Dash channel.

And give it the channel of the target network, which is one.

Then we're going to do a Dash Dash interface and give it my wireless adapter innovator mode, which

is than zero.

So a very, very simple command we're using reverse, this is the name of the program that will do the

brute force thing for us and give us the key.

We're giving it the best ideas, the Mac address of my target.

We're doing that channel to give it the channel.

That's my target is running on.

And we're doing Dash Dash interface to give it the name of my wireless adapter in monitor mode.

I'm also going to add two more options.

I'm going to add Dash V to show us as much information as possible.

This is really helpful if it fails or things go wrong.

We'll be able to know what's happening, why things are going wrong, and I'm also going to do a dash

dash.

No associate.

To tell the river not to associate with the target network because we're already manually doing that

in here.

So River can automatically do this, tap right here for you.

But I've seen that it's fills a lot.

Therefore, it's actually better to do it ourselves manually here and then tell the river not to associate.

So now I'm going to hit enter to get the river to walk, and I'm going to go up to the top terminal

and I'm going to to enter to associate with the target network telling it Please don't ignore us so

that river at the bottom here can brute force the pin and try every possible pin until we get the correct

pin, which we'll use to get the password.

And as you can see right now, River is trying.

The PIN one two three four five six seven.

Aren't perfect.

You can see the pin was actually one two three four five six seven zero, so it's a simple pin.

It actually came with this pin.

So I it's manually set this pin.

My writer came from the factory with the GPS enabled with this pin.

So like I said, this still works, but again, not against old rafters.

From that, it was able to discover the WPA key, which is you are you are W6 or and the name of the

writer is Test AP.

So it can literally go ahead and connect with this password.

And I'll be able to connect to the network and see and decrypt all of the packets sent in the air.