Kali Linux Wireless Penetration Testing: Beginner's Guide

More Information
  • Create a wireless lab for your experiments
  • Sniff out wireless packets and hidden networks
  • Capture and crack WPA-2 keys
  • Discover hidden SSIDs
  • Explore the ins and outs of wireless technologies
  • Sniff probe requests and track users through SSID history
  • Attack radius authentication systems
  • Sniff wireless traffic and collect interesting data
  • Decrypt encrypted traffic with stolen keys

As wireless networks become ubiquitous in our lives, wireless penetration testing has become a key skill in the repertoire of the professional penetration tester. The Kali Linux security distribution comes with a myriad of tools used for networking attacks and detecting security loopholes.

Kali Linux Wireless Penetration Testing Beginner's Guide presents wireless pentesting from the ground up, introducing all elements of penetration testing with each new technology. Learn various wireless testing methodologies by example, from the basics of wireless routing and encryption through to detailed coverage of hacking methods and attacks such as the Hirte and Caffe Latte.

  • Learn wireless penetration testing with Kali Linux; Backtrack’s evolution
  • Detect hidden wireless networks and discover their names
  • Explore advanced Wi-Fi hacking techniques including rogue access point hosting and probe sniffing
  • Develop your encryption cracking skills and gain an insight into the methods used by attackers and the underlying technologies that facilitate these attacks
Page Count 214
Course Length 6 hours 25 minutes
ISBN 9781783280414
Date Of Publication 29 Mar 2015
Hardware requirements
Software requirements
Installing Kali
Time for action – installing Kali
Setting up the access point
Time for action – configuring the access point
Setting up the wireless card
Time for action – configuring your wireless card
Connecting to the access point
Time for action – configuring your wireless card
Revisiting WLAN frames
Time for action – creating a monitor mode interface
Time for action – sniffing wireless packets
Time for action – viewing management, control, and data frames
Time for action – sniffing data packets for our network
Time for action – packet injection
Important note on WLAN sniffing and injection
Time for action – experimenting with your adapter
The role of regulatory domains in wireless
Time for action – experimenting with your adapter
Hidden SSIDs
Time for action – uncovering hidden SSIDs
MAC filters
Time for action – beating MAC filters
Open Authentication
Time for action – bypassing Open Authentication
Shared Key Authentication
Time for action – bypassing Shared Authentication
WLAN encryption
WEP encryption
Time for action – cracking WEP
Time for action – cracking WPA-PSK weak passphrases
Speeding up WPA/WPA2 PSK cracking
Time for action – speeding up the cracking process
Decrypting WEP and WPA packets
Time for action – decrypting WEP and WPA packets
Connecting to WEP and WPA networks
Time for action – connecting to a WEP network
Time for action – connecting to a WPA network
Default accounts and credentials on the access point
Time for action – cracking default accounts on the access points
Denial of service attacks
Time for action – deauthentication DoS attacks
Evil twin and access point MAC spoofing
Time for action – evil twins and MAC spoofing
A rogue access point
Time for action – cracking WEP
Honeypot and Mis-Association attacks
Time for action – orchestrating a Mis-Association attack
The Caffe Latte attack
Time for action – conducting a Caffe Latte attack
Deauthentication and disassociation attacks
Time for action – deauthenticating the client
The Hirte attack
Time for action – cracking WEP with the Hirte attack
AP-less WPA-Personal cracking
Time for action – AP-less WPA cracking
A man-in-the-middle attack
Time for action – man-in-the-middle attack
Wireless Eavesdropping using MITM
Time for action – Wireless Eavesdropping
Session hijacking over wireless
Time for action – session hijacking over wireless
Finding security configurations on the client
Time for action – deauthentication attacks on the client
Setting up FreeRADIUS-WPE
Time for action – setting up the AP with FreeRADIUS-WPE
Attacking PEAP
Time for action – cracking PEAP
Security best practices for Enterprises
WPS attacks
Time for action – WPS attack
Probe sniffing
Time for action – collecting data


Vivek Ramachandran

Vivek Ramachandran has been working on Wi-Fi security since 2003. He discovered the Caffe Latte attack and also broke WEP Cloaking, a WEP protection schema, publicly in 2007 at DEF CON. In 2011, he was the first to demonstrate how malware could use Wi-Fi to create backdoors, worms, and even botnets.

Earlier, Vivek was one of the programmers of the 802.1x protocol and Port Security in Cisco's 6500 Catalyst series of switches, and he was also one of the winners of the Microsoft Security Shootout contest held in India among a reported 65,000 participants. He is best known in the hacker community as the founder of SecurityTube.net, where he routinely posts videos on Wi-Fi security, assembly language, exploitation techniques, and so on. SecurityTube.net receives over 100,000 unique visitors a month.

Vivek's work on wireless security has been quoted in BBC Online, InfoWorld, MacWorld, The Register, IT World Canada, and so on. This year, he will speak or train at a number of security conferences, including Blackhat, DEF CON, Hacktivity, 44con, HITB-ML, BruCON Derbycon, Hashdays, SecurityZone, and SecurityByte.

Cameron Buchanan

Cameron Buchanan is a penetration tester by trade and a writer in his spare time. He has performed penetration tests around the world for a variety of clients across many industries. Previously, Cameron was a member of the RAF. In his spare time, he enjoys doing stupid things, such as trying to make things fly, getting electrocuted, and dunking himself in freezing cold water. He is married and lives in London.