Original subtitles

1

Okay now and the last video when the user logged into our network and put the username and password

2

we only captured the username we didn't get the password but instead we got something called the challenge

3

and we also got a response.

4

Now the reason for this is because like I said the network that we created the fake network that we

5

created uses a proper WPA enterprise authentication.

6

Therefore when a user tries to connect to that network and authenticate they'll use what's known as

7

a challenge response authentication.

8

So in order to understand what we mean by a challenge and a response here let's have a look on this

9

very simple diagram that I made I'm trying to keep this as simple as possible so that we don't get carried

10

away talking about algorithms encryption and all of that because that on its own needs a full course.

11

So basically what happens when a client tries to connect to a network that uses WPA enterprise.

12

We said this is managed through a radius server.

13

So what happens is the client sends a request saying I want to connect the server says OK no problem

14

solve this challenge for me.

15

So it gives the client a challenge to solve.

16

And this is what you see in here.

17

So we can see this is the challenge that the server that we are running because in this case we have

18

fake access point.

19

So that's the challenge that the server sent to the client to solve.

20

The client goes ahead and solves the challenge it solves.

21

It solves it by encrypt in the challenge used in the password that you put.

22

So basically the password that you put in the log in box will never be sent to the server.

23

What happens is that password is used in a certain manner so that it converts this challenge encrypts

24

it and convert it into a response that the radius server will be able to understand and verify if the

25

password was correct.

26

So you say I want to connect server says no problem.

27

So the challenge for me challenge is solved based on the password that you enter and it's sent to the

28

radius server.

29

Now when we look at this we can see the challenge and the response sent.

30

Now this challenge is encrypted use and net and TLM version 1.

31

Now this is strong encryption and for us we can't actually just encrypted based on the response on its

32

own.

33

So we actually to use the response and the challenge and we'll also need to run a dictionary attack

34

the way this dictionary attack is going to work is it's going to go over a list of a lot of words.

35

It's going to take each one of these words it's going to try to create a response based on these words

36

and compared to this response if the response generated using the word and the word list is correct

37

then the word used to generate that response is the password.

38

Otherwise it will try the next word.

39

So again the way the word this attack is going to work is it's going to go through a list of a lot of

40

passwords that we're going to give to the program.

41

It's going to take each one of these passwords.

42

It's going to apply the formula and try to solve the challenge to generate a response the response generated

43

is going to be compared to this response right here if the response is valid then the password used

44

to generated is the valid password.

45

Otherwise it's going to try the next password.

46

Now there is a number of tools that can run a dictionary attack against net and TLM hushes the one that

47

I want to use is called a s.l c.a.p.

48

Now you can use hashcash and John for that but this tool is just simpler and that's why I'm going to

49

go for it now before using this tool.

50

Let's have a look on its Helpmann you.

51

So we're going to do a cell UAP help

52

so you can see the options here are very simple and you can see the usage is you literally just typing

53

in the tool name followed by the options.

54

So first of all let's type in the name of the tool which is a S L A P.

55

Then we want to use the dash C option to give the challenge.

56

So we have the challenge in here.

57

I'm going to copy it and I'm going to do.

58

Dicy and put the challenge next option that I want to use is the response which is dush or and here.

59

So again I'm going to do a dash capital R and then I'm going to put the response that we got which is

60

this one in here.

61

So I'm just going to copy it and pasted.

62

Finally we want to specify a dictionary to use to crack this harsh and to do that we're going to do

63

that w and I've already created a dictionary using crunch.

64

So you can create your own dictionary or download dictionary online.

65

The dictionary that I have is stored in root and it's called wordlist and that's it.

66

So the command is going to be a cell UAP.

67

We're doing dashi to give the challenge followed by dush or to give the response.

68

And finally we're given the wordlist.

69

So again what's this still going to do is it's going to open this wordlist.

70

It's going to go on it word by word generate a response based on this challenge and compare the response

71

with this response right here if the response generated from the word and the word list is valid then

72

that word is the password.

73

Otherwise it's going to try the next word.

74

So I'm going to hit enter and let this run until it gets me the password.

75

And as you can see this was quite fast and it got me the password right here.

76

The password is 1 2 3 4 A B C D and that's actually the password that I used.

77

So right now we have the user name which is zayd and the password which is 1 2 3 4 for ABC the.