BackTrack 5 Wireless Penetration Testing Beginner's Guide: Master bleeding edge wireless testing techniques with BackTrack 5.

Burn the BackTrack ISO (we are using the BackTrack 5 KDE 32-Bit edition) that you have downloaded into a bootable DVD.

Boot the laptop with this DVD and select the option BackTrack Text – Default Boot Text Mode from the boot menu:

If booting was successful then you should see the familiar BackTrack screen:

You can boot into the graphical mode by entering startx on the command prompt. Enjoy the boot music! Once you are in the GUI, your screen should resemble the following:

Now click on the Install BackTrack icon to the top-left of the desktop. This will launch the BackTrack installer as shown next:

This installer is similar to the GUI-based installers of most Linux systems and should be simple to follow. Select the appropriate options in each screen and start the installation process. Once the installation is done, restart the machine as prompted, and remove the DVD.

Once the machine restarts, it will present you with a login screen. Type in the login as "root" and password as "toor". You should now be logged into your installed version of BackTrack. Congratulations!

Power on the access point and use an Ethernet cable to connect your laptop to one of the access point's Ethernet ports.

Enter the IP address of the access point configuration terminal in your browser. For the DIR-615, it is given to be 192.168.0.1 in the manual. You should consult your access point's setup guide to find its IP address. If you do not have the manuals for the access point, you can also find the IP address by running the route –n command. The gateway IP address is typically the access point's IP. Once you are connected, you should see a configuration portal which looks like this:

Explore the various settings in the portal after logging in and find the settings related to configuring a new SSID.

Change the SSID to Wireless Lab. Depending on the access point, you may have to reboot it for the settings to change:

Similarly, find the settings related to Authentication and change the setting to Open Authentication. In my case, the Security Mode configuration of None indicates that it is using Open Authentication mode.

Save the changes to the access point and reboot it, if required. Now your access point should be up and running with an SSID Wireless Lab.

Plug in the card to one of the BackTrack laptop's USB ports and boot it.

Once you log in, open a console terminal and type in iwconfig. Your screen should resemble as follows:

As you can see, wlan0 is the wireless interface created for the Alfa wireless card. Type in ifconfig wlan0 up to bring the interface up. Then type in ifconfig wlan0 to see the current state of the interface:

The MAC address 00:c0:ca:3e:bd:93 should match the MAC address written under your Alfa card. This is a quick check to ensure that you have enabled the correct interface.

Let us first see what wireless networks our Alfa card is currently detecting. Issue the command iwlist wlan0 scanning and you will find a list of networks in your vicinity:

Keep scrolling down and you should find the Wireless Lab network in this list. In my setup, it is detected as Cell 05, it may be different in yours. The ESSID field contains the network name:

As multiple access points can have the same SSID, verify that the MAC address mentioned in the Address field above matches your access point's MAC. A fast and easy way to get the MAC address is underneath the access point or using the web-based GUI settings.

Now, issue the command iwconfig wlan0 essid "Wireless Lab" and then iwconfig wlan0 to check the status. If you have successfully connected to the access point, you should see the MAC address of the access point in the Access Point: field in the output of iwconfig, as shown in the following screenshot:

We know the access point has a management interface IP address "192.168.0.1" from its manual. Alternatively, this is the same as the default router IP address when we run the route –n command. Let's set our IP address in the same subnet by issuing the command ifconfig wlan0 192.168.0.2 netmask 255.255.255.0 up. Verify the command succeeded by typing ifconfig wlan0 and checking the output:

Now let's ping the access point by issuing the command ping 192.168.0.1. If the network connection has been set up properly, then you should see the responses from the access point. You can additionally issue an arp –a to verify that the response is coming from the access point. You should see that the MAC address of the IP 192.168.0.1 is the access point's MAC address we have noted earlier. It is important to note that some of the more recent access points might have response to ICMP Echo Request packets disabled. This is typically done to make the access point secure out-of-the-box with only the bare minimum configuration settings available. In such a case, you could try to launch a browser and access the web interface to verify that the connection is up and running.

On the access point, we can verify the connectivity by looking at the connection logs. As you can see in the following log, the MAC address of the wireless card 00:c0:ca:3a:bd:93 has been logged: