Original subtitles

1

Now the attacks that we've seen in the previous video worked perfectly because the pin was really simple

2

it was set to 1 2 3 4 5 6 7 0 and it actually came from the factory like this.

3

So most people will not be modify that.

4

And if your target is using the same router that I got from my internet provider then you'll be able

5

to crack their password very very easily.

6

Right now I just want to show you an example I actually modified the router settings and I set the pin

7

to be something more random again.

8

It still has to be eight digits and still has to be made out of digits on the.

9

So you'll still be able to cover all possibilities and crack it.

10

And I just want to show you that this still works.

11

If the pin was more complicated than just one two three four five six seven.

12

So I'm just going to run Washington

13

and we can see that I have my target here the taste a.p and I'm just going to run a river against it

14

exactly like I did in the previous lecture.

15

Get with the SS ID on the channel and my wireless interface.

16

I'm going to hit enter and river actually supports pause and resume.

17

So if you were a crack in a network and you reached 50 percent for example and then you wanted to stop

18

that attack for some reason you can just press control-C at the same time go do whatever you want it

19

to do and come back even weeks after and just launch Schriever again against that network and river

20

will know where it stopped and it'll start from 50 percent so it's not going to start from scratch.

21

So with this I'm going to tell it.

22

Yes please.

23

Reassume and it's going to start with me so you can see that so far I tried 25 and it's just going

24

to keep going and it's going to try to brute force all possibilities.

25

And if we look at the start you'll remember that it said there is eleven thousand possibilities so it

26

can actually cover all these possibilities it's not a huge number.

27

And then when it covers all of them it will definitely be able to get the pin and then calculate the

28

key from the pin.

29

Now I'm going to Control-C out of this because this is actually working properly and I just wanted I

30

just want to show you what it would look like while it's working.

31

If the pin was a bit more complicated so you can see right here it is zero point 37 percent and it's

32

saying that the estimated maximum time is 6 hours five minutes to cover all possibilities.

33

So you might actually be able to get the to guess the pain before that time and get the key.

34

But the maximum time that you're going to have to wait is six hours five minutes and 18 seconds.

35

Now if I go up now notice that it 0.37 percent if I go up you'll see that I was at zero point three

36

three percent.

37

So it's actually work in it's stride and the pins it's going through the pins and trying them one by

38

one individually so everything is working.

39

All I have to do in this case is just wait for it to get the pin and then give me the key.

40

Now this router is configured in a way that it's going to accept failed attempts and it will never lock.

41

So when we run wash I'm just going to go and run wash again like I did

42

you'll see the WPX locked here.

43

And for my test AP It's still sad to know what this basically means is some routers lock after a number

44

of failed attempts.

45

So when you try to authenticate with them use an Iraq pin after four or five six.

46

However the router is configured they will lock and they'll stop accepting any requests.

47

Even if we try the right pin.

48

So rather than trying against right now the test AP never locks.

49

Even if I try a thousand wrong pins it'll never lock.

50

So that's really handy.

51

And that's why it's very easy to crack.

52

While you were testing you might face some routers that are configured to lock after a number of failed

53

attempts.

54

And once the router locks basically you won't be able to do anything and you'll have to wait for it

55

until it unlocks some routers unlock.

56

After a minute some writers lock after five minutes and some routers take days to unlock.

57

So it's not really a good idea to just sit down and wait for the router to unlock.

58

Now my other router the updated one that's sent from the company actually does lock after failed attempts

59

and I'm going to show you now I'm just going to run Rivara against it and I'm going to show you how

60

the router looks like if it's locked.

61

So my other router is actually the one that I'm using currently.

62

So it's still named the default name and it's this one.

63

So I'm going around revolt against it again using the same command that we did in the previous lecture.

64

I'm not going to do anything fancy So it's just going to be I'm going to clear this first and then I'm

65

going to do Reverchon minus B and thrown in on channel 6 and then I'm going to give him my wireless

66

card and monitor mode hit enter.

67

Sorry I had to give it after mine.

68

I

69

and again is asking me if I wanted to continue from the last time I'm going to say no to start from

70

scratch.

71

And I can see that it works for a bit and then it just completely locks.

72

It doesn't really do anything it just sits down there.

73

Now if I press control-C and greenwash again

74

you'll see that the writer got locked right here and it won't accept anymore requests right now so we

75

can't really do anything at the moment because WPX is locked.

76

Now the simplest way to get the router to unlock is to just the authenticate all the connected computers

77

and keep doing that for a long period of time until the user one of the users will just think that there

78

is something happening in the network and just goes in and turn off the router and turn it back on when

79

they do that the router will get unlocked and then you'll be able to run revert again.

80

So to do that all you have to do is the authentication attacked like we did before.

81

So we're going to do airplane Engy the Auth. if we're going to give it the access point

82

and you're not going to specify a client because you wanted to connect all the clients and then you're

83

going to give it the card in monitor mode which is zero.

84

And don't forget to specify a really large number after the deal with no we spoke about this before

85

and I'm not going to run this attack right now because it actually requires physical interaction of

86

the user to go and restart the router.

87

So again it's not the best way but it is a way to get the router to restart.

88

There is better methods to do that.

89

We're going to do them using a tool called MBK 3 and we'll talk about them in the next lecture.