Wireless Specific Recipes

In this chapter, we will cover the following topics:

• Scanning for wireless networks
• Bypassing MAC-based authentication
• Breaking WEP encryption
• Obtaining WPA/WPA2 keys
• Exploiting guest access
• Rogue AP deployment
• Using wireless networks to scan and attack internal networks

Introduction

Although all the previous chapters have created a basis for pen testing that works across the spectrum, wireless has its own set of tools that span the pen testing methodology.

• Scanning for Service Set Identifiers (SSIDs)
• Scanning for hidden SSIDs
• Determining security of target SSID
• Testing for MAC address authentication
• Cracking Wired Equivalent Privacy (WEP)
• Cracking Wi-Fi Protected Access (WPA/WPA2)
• Exploiting guest access
• Rogue Access Point (AP) deployment
• Man-in-the-Middle (MITM) wireless attacks
• Using wireless networks to scan internal networks
• Using wireless as a vector for network related attacks

Scanning for wireless networks

Wireless networking is very popular due to its ease of use, reduction of cabling, and ease of deployment. Fortunately for us, the very same features that make it easy to use on a day-to-day setting also make it easy to monitor and to perform attacks from areas that do not rely on physical access to the network. Often the wireless signal bleeds into public areas, such as parking lots, adjacent office spaces, shopping malls, and more. Unless the wireless network administrator has taken great pains to limit the wireless coverage to only their facility, it is very likely that you can begin your wireless reconnaissance using a smart phone to identify a good location to set up your Kali Linux platform within the range.

In this section, we will cover how to use airodump-ng to identify the available wireless SSIDs including those that are not set to advertise...

Bypassing MAC-based authentication

In the absence of a truly centralized authentication, or in the event that devices need to connect to a wireless network but are unable to provide authentication credentials, very frequently an open wireless network will be in place that will be configured to only allow specific MAC addresses to connect. This is frequently the case with older devices that were manufactured before it was common to secure wireless networks.

Given how simple MAC authentication is to bypass, it is still used in a surprising number of locations due to the ease of implementation as well as the perception that this it is effective.

Getting ready

In order to complete this recipe, you will need to follow the commands...

Breaking WEP encryption

Wireless administrators recognized that having open networks or networks that rely on MAC address authentication, presented an unacceptable level of risk and therefore over time, there have been many attempts to harden the authentication to wireless networks, each with their own limitations:

• Wired Equivalent Privacy (WEP) uses the RC4 encryption algorithm and combines the user-defined key with a 24 bit initialization vector (IV). Unfortunately, IV's are reused thus allowing for us to use tools like aircrack-ng to get the original key, giving us access to the target network as an authenticated endpoint.
• Wi-Fi Protected Access (WPA) comes in several different flavors and is much more secure than WEP. Because it can be used in a manner similar to WEP where a pre-shared key is used (WPA-PSK), tools such as fluxion can recover the pre-shared key, and where...

Obtaining WPA/WPA2 keys

This section will walk you through the process of gathering WPA keys using two different methods:

• Social engineering through SSID manipulation and social engineering with fluxion
• Brute force cracking of gathered data using hashcat
  

Getting ready

In order to complete this recipe, you will need to follow the commands laid out in the section Scanning for wireless networks and place your wireless network adapter into the monitor mode.

You can confirm this by running the following:

root@kali:~/wireless# iw dev

Confirm that the interface wlan0mon is set to type monitor:

How to do it...

...

Exploiting guest access

When guest access is offered, often it is on a shared network with the network you are attempting to infiltrate. There are several different types of wireless guest access offered, each has its own vulnerabilities:

1. Pre-shared keys: These are generally WEP or WPA PSK's that are intended to keep unauthorized users or devices to a minimum. Unfortunately, these keys are generally known by many people and are very rarely changed.

2. Captive portal: The guests connect to a wireless network and are automatically redirected to a web page that prompts them for credentials. This may or may not be combined with a pre-shared key.

The most common implementations of guest access include elements of recipes that we have done in previous sections but are stung together and very frequently are labeled as guest networks by their SSID.

...

Rogue AP deployment

In this recipe, we will use wifiphisher to create a rogue, and capture username and passwords from a captive portal that simulates corporate portals.

Since we have covered creating rogue APs and forcing deauthentications in section Cracking WEP Encryption (with airodump-ng/aircrack-ng) and Obtaining WPA/WPA2 Keys (with fluxion), this recipe will focus on the creation of access points that encourage open use and have the ability to gather credentials or deliver malicious payloads.

Getting ready

The tool used in this recipe is not included in the base installation of Kali Linux and must be installed from the command line with the following command:

root@kali:~/wireless# apt-get install wifiphisher

...

Using wireless networks to scan internal networks

Access to a network is the ultimate goal, and the use of wireless networking means that this access is likely easier to gain than through remote access/VPN or through physical access to a network port. Using the recipes in this section, it is highly likely that once you have gained access to the network, you will have done so with the credentials of an authorized user. The next question is: where can you go from here?

In this recipe, we will use some of the tools that we have learned in preceding sections to help identify ways for us to extend the access we have gained so far.

Getting ready

This recipe is built upon the assumption that you have already gained access to the...