Original subtitles

1

Now one of the major obstacles that you might find while trying to gain access to a network is if the

2

network does not broadcast its name.

3

So if the network is hidden if the network is hidden then you won't be able to connect to the network

4

even if it does not use any password.

5

And if it uses a password then you won't be able to use the attacks that we're going to talk about in

6

future lectures.

7

So you literally want to be able to do anything until you know the name of the network.

8

So just to show you an example here I have my own network and I've said it to be hidden.

9

So I checked this box which says Musk SS ID.

10

Now this could be called something else for you again but for me that's the name of it.

11

And I've called the network test AP.

12

So the network actually has a name but it just doesn't broadcast the name in the air.

13

I've also set the network to not to use any security.

14

So people can connect as long as they know what the network name.

15

So if we go here on the Windows machine I just want to show you an example.

16

If we go on Wi-Fi networks you'll see that there is a hidden network around us.

17

But if we try to connect to this network if I click on it and click on Connect the first thing that

18

it's going to ask me is to enter the name of the network.

19

Therefore we can't actually connect to it if we don't know its name.

20

And if the network is using encryption.

21

So if it's using a password for the network then we want to be able to launch the crack in attacks if

22

we don't know the name.

23

So if your target network is hidden the first step is always to try and determine the name of that network

24

regardless of whether it uses encryption if it uses a password or if it does not use a password.

25

So in this lecture I'm going to cover how to determine the name of hidden networks and how to connect

26

to the network.

27

Now I'm going to go to my coffee machine and I'm there on a dump and you on my wireless card in monitor

28

mode.

29

So we did this before.

30

All I do is error.

31

Don't be angry.

32

And then I put the name of the wireless card which is mon's your.

33

And if I hit enter as you can see I can see all my networks around me and we can see any hidden network

34

around us.

35

And the hidden network is actually this one.

36

So you can see that we can actually get all the information of that network so we can get its MAC address.

37

We can see its distance we can see the beacons we can see the data if there was a lot of data and we

38

can see the encryption.

39

So in our case it's open it's not using encryption but if it was using encryption then you'll see it

40

uses WEP or WPA or whatever its use.

41

The only thing that's hidden is the name of the network so you can see and here.

42

We actually don't have the name of the network.

43

So basically what the network is configured to be hidden.

44

It only hides the network name but it's still broadcast and its existence.

45

It still Telen all the devices around did that exist.

46

My mac addresses this.

47

My channel is this and it's given all the information except the name.

48

And basically what I'm saying is if you know my name then you can connect to me.

49

So what we're going to do now is we're going to run a dump and against this specific network because

50

that's our target.

51

And we have done this in previous lectures again.

52

But I'm just going to do it real quick here.

53

So I'm going to copy its MAC address and on their own Aradigm punji and I'm going to specify the SS

54

ID of the target network which is the MAC address

55

and then I'm going to specify the channel which is 6 for this target network

56

and then I'm going to give as my wireless card and monitor mode which is zero.

57

So again we run this command a lot of times.

58

It's a dump.

59

And you were given at the MAC address of the target network and they were given a channel which is six.

60

And then we give it the wireless card name in monitor mode.

61

I'm going to hit enter and you can see now a dump.

62

And he is running against this specific network.

63

Now in many cases if the target network is a bit active you'll actually be able to get the name of it

64

simply by running a dump and be against it.

65

And our case we can see that the network is not active.

66

So we don't know and he is not able to determine its name.

67

But what we can also see is we can see that there is a client connected to the network right here because

68

we said the second section of dump G Show us the connected devices so we can see that there is a device

69

connected to this network and the device has this MAC address so what we're going to do now is we're

70

going to use audio authentication attack like we did it before and we're going to disconnect this device

71

from this network.

72

But the difference is we're actually going to disconnected for a very short period of time so that it

73

automatically reconnects to the target network and when it does that it's going to send the network

74

name in the air.

75

Since we have a dump and just running it will be able to capture that name and it will show it to us

76

here and then we'll know the name of the network.

77

So again the attack is going to be very simple or we're going to do is we're going to do the authentication

78

attack for a very short period of time.

79

That's going to disconnect the target device for a split second.

80

So they won't even feel it and the operating system will automatically connect back to the network when

81

it does that it's going to send the network name in the air and we're Sniffen on that channel.

82

So we'll be able to capture that name and we'll know the network name.

83

So I'm going to split the screen and you've actually run this attack before.

84

So I'm just going to do it here again and it will be a chance for you to revise it.

85

So we're going to do airplane ngi

86

Diot and then we're going to put the MAC address of the target network after the argument and then I'm

87

going to do mine a C and then I'll give the MAC address of the client that I want to disconnect.

88

And it's this one right here

89

and finally I'm going to put the name of the wireless card in monitor mode which is Montsoreau Now I

90

actually forgot to specify the number of the authentication packets to send in the previous videos we

91

actually used.

92

A really big number in here so that we can keep the target computer disconnected for as long as possible.

93

In this video we actually want them to be disconnected for a split second.

94

So I'm going to use four packets usually two is sufficient.

95

But I'm just going to use for just to make sure that the target device will get disconnected.

96

So it's all because we're using a very small number.

97

It'll be disconnected for a very short period of time.

98

And the target person who is using that network will not even feel that.

99

So the same command that we did before nothing different airplanes we were doing the authentication

100

attack and we're using a very small number of packets because we don't want the target person to feel

101

that they got disconnected.

102

We gave the MAC address of the target network after the option and then we gave the MAC address of the

103

client that we want to disconnect after the C option.

104

I'm going to hear Antar

105

and as you can see nearly after sending two packets we were able to determine the name of the network.

106

So right here in Arizona and it's so not other than the name of the network is test a.p.

107

And now if the network is open like in our case we can just go ahead and connect to that network or

108

if the network is using encryption like WEP WPA or WPA to then we actually know the name of the network

109

now and you'll be able to launch the attacks that you're going to learn in the next lectures against

110

that network and then determine its key.

111

So the attack was very simple.

112

All we had to do is run aero dump energy against our specific target network and then the authenticate

113

one of the clients for a very short period of time and they'll automatically get connected to the network

114

when they do that we'll know the network name.