Minashi / tmp

WIFI-Pentesting

General Assumptions:

iw dev wlan0 scan | grep SSID ## wireless networks within the range of the wireless card (wlan0) are detected

airmon-ng start wlan0 ## setting the wireless card (wlan0) to monitor mode

airodump-ng wlan0mon ## detecting surrounding networks by listening to the network in monitor mode

iwconfig wlan0mon channel 3 ## change the channel where the wireless network card is located

iwlist wlan0mon channel ## view the channel where the wireless network card is located

airodump-ng -c 3 --bssid <AP_MAC> -w <capture_file> wlan0mon ## listening to the target AP on the specified channel

Attack Map

WEP? or WPA/WPA2?

WEP;

AUTH: OPN? or SKA?

AUTH: OPN;

Any client connected to AP? YES? or NO?

> YES;

  # ARP Request Replay Attack
  # Interactive Packet Replay Attack
  # Deauthentication Attack (can be used in both cases (yes or no))

> NO;

  # Fake Authentication Attack (can be used in both cases (yes or no))
  # Fragmentation Attack
  # Korek ChopChop Attack

AUTH: SKA (Bypassing WEP Shared Key Authentication);

## There is a client connected to the AP. You can follow the steps below to attack;

 # Deauthentication Attack
 # Fake Shared Key Authentication Attack
 # ARP Request Replay Attack
 # Deauthentication Attack
 # Aircrack-ng

WPA/WPA2

Attack;

# Deauthentication Attack

Cracking the network key;

# with Aircrack-ng
# with JTR and Aircrack-ng
# with coWPAtty
# with Pyrit