Menu
Every new hacker loves to Google the words “How to hack WiFi passwords?” So i thought why not make a blog post on it. PS Every professional hacker was a script kiddie at some point. Before we start lets look at some terminology. BSSID- It is the MAC addrses of a device ESSID- It is the name of a device. AP- Access Point, example a router. Guys in this tutorial I am going to show you how to get password of saved wifi ii like my video stay updated by subscribing this. We will put our wifi adapter in monitoring mode and retrieve the MAC address of connected clients with Airodump-NG on Kali Linux. Then we will be using the Macchanger tool to spoof our MAC address, bypass MAC filtering and connect to the wireless network. Hacking the WiFi network password is outside the scope of this tutorial. Whitelist the Mac address, so that attack may be successful to crack your password but WiFi router will block the attacker since mac is not registered. Disclaimer This. Wifi password hacking has become popular as people are always in search of the free internet. But due to the advancement of technology, hacking wifi, and cracking passwords have become a difficult task to do. The reason the newer wifi protocols have become safer is due to the implementation of WPA/WPA2 (wifi protected access) protocols.
Every new hacker loves to Google the words “How to hack WiFi passwords?” So i thought why not make a blog post on it.
PS Every professional hacker was a script kiddie at some point
Before we start lets look at some terminology.
BSSID- It is the MAC addrses of a device
ESSID- It is the name of a device.
AP- Access Point, example a router.
ESSID- It is the name of a device.
AP- Access Point, example a router.
There are a few types of WiFi encryption:
- WEP (Wired Equivalency Privacy)
- WPA(Wi-Fi Protected Access)
- WPA2(Wi-Fi Protected Access 2)
- WPA2 with WPS(Wireless Protected Setup)
- WPA3(Wi-Fi Protected Access)
For this post we will only be focusing on WPA2 because that’s the one most commonly used.
WPA2 uses the Advanced Encryption Standard (AES) and Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), respectively.
Developed by the U.S. government to protect classified data, AES comprises three symmetric block ciphers. Each encrypts and decrypts data in blocks of 128 bits using 128-bit, 192-bit and 256-bit keys. Although the use of AES requires more computing power from APs and clients, ongoing improvements in computer and network hardware have mitigated performance concerns.
CCMP protects data confidentiality by allowing only authorized network users to receive data, and it uses cipher block chaining message authentication code to ensure message integrity.
Advertisements
WPA2 also introduced more seamless roaming, allowing clients to move from one AP to another on the same network without having to reauthenticate, using Pairwise Master Key caching or preauthentication.
WPA2 Password Hacking
Okay, so hacking WPA-2 PSK involves 2 main steps-
- Getting a handshake (it contains the hash of password, i.e. encrypted password)
- Cracking the hash.
What we need is:
- An attacker (you)
- A client
- An AP (Access point)
- A network adapter capable of packet injection. (i recommend ALFA AWUS036NH)
When the client and the AP communicate in order to authenticate the client, they have a 4 way handshake that we can capture. This handshake has the hash of the password. Now there’s no direct way of getting the password out of the hash, and thus hashing is a robust protection method. But there is one thing we can do. We can take all possible passwords that can exists, and convert them to hash. Then we’ll match the hash we created with the one that’s there in the handshake. Now if the hashes match, we know what plain text password gave rise to the hash, thus we know the password. If the process sounds really time consuming to you, then its because it is. WPA2 hacking (and hash cracking in general) is pretty resource intensive and time taking process. Now there are various different ways cracking of WPA2 can be done. But since WPA2 is a long shot, we shall first look at the process of capturing a handshake.
Now since i don’t want you to remain script kiddies forever, let me explain what the 4 way handshake actually is.
The Four-Way Handshake
The authentication process leaves two considerations: the access point (AP) still needs to authenticate itself to the client station (STA), and keys to encrypt the traffic need to be derived. The earlier EAP exchange or WPA2-PSK has provided the shared secret key PMK (Pairwise Master Key). This key is, however, designed to last the entire session and should be exposed as little as possible. Therefore the four-way handshake is used to establish another key called the PTK (Pairwise Transient Key). The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address. The product is then put through PBKDF2-SHA1 as the cryptographic hash function.
The handshake also yields the GTK (Group Temporal Key), used to decrypt multicast and broadcast traffic.
The handshake also yields the GTK (Group Temporal Key), used to decrypt multicast and broadcast traffic.
The actual messages exchanged during the handshake are depicted in the figure and explained below:
Here is YouTube video for a better understanding.
The Aircrack-ng suite
Aircrack-ng is a complete suite of tools to assess WiFi network security.
It focuses on different areas of WiFi security:
- Monitoring: Packet capture and export of data to text files for further processing by third party tools
- Attacking: Replay attacks, deauthentication, fake access points and others via packet injection
- Testing: Checking WiFi cards and driver capabilities (capture and injection)
- Cracking: WEP and WPA PSK (WPA 1 and 2)
Here is a breakdown of tools that we would use:
- Airmon-ng (for initiating monitor mode)
- Airodump-ng (to capture the handshake)
- Aireplay-ng (to deauthenticate clients)
- Aircrack-ng (to brute force the password)
Step 1 Set your interface to monitor mode.
Monitor mode or RFMON (Radio Frequency Monitor) mode, enables a device with a wireless network interface controller to monitor all traffic received from the wireless network. Unlike promiscuous mode, which is also used for packet sniffing, RFMON mode enables packets to be captured without having to connect or link with an access point. RFMON mode only works with wireless networks, while promiscuous mode can be applied to both wired and wireless networks.
Now wlan0 is for me, for you it could be wlan1 or wlan2 anything else, depending on you card. So select the interface carefully.
As you can see station mode is disabled and monitor mode is now enabled.
Step 2 Find your target.
Find you targets BSSID by this command:
Yes i know there’s a lot of information over there, so lets break that down as well.
PWR: Signal strength
RXQ: Receive quality
Beacons: Number of announcement packets.
#Data: Number of captured packets
CH: Channel
ENC: Encryption Type
Cipher: Cipher type
Station: MAC address of the client.
Lost: Packets lost
Packets: Data packets sent by client
RXQ: Receive quality
Beacons: Number of announcement packets.
#Data: Number of captured packets
CH: Channel
ENC: Encryption Type
Cipher: Cipher type
Station: MAC address of the client.
Lost: Packets lost
Packets: Data packets sent by client
Anyways, as you can see in the picture above, our target is called Test Router.
Advertisements
Step 3 Capture the Handshake
You will see something like this
The below area is to display clients connected to that AP. Now we need to simultaneously de-authenticate at least one client. In this case will de-authenticate 7A:AC:AD:CC:44:05.
So open another terminal
The command is
The -a is for the APs MAC address, the -c is for the clients MAC and -0 is for deauth mode.
After a few seconds press CTRL-Z to stop sending deauth packets. As soon as the client connects back, we would capture the hashed handshake file.
You can see on the top right corner that we captured the handshake file.
Forgot Wifi Password Mac
Step 4 Brute Forcing the handshake file
I have put the actual password in the file dic.txt along with some other random passwords. So we run aircrack-ng with the dictionary as well as the handshake file (.cap)
Now depending on your dictionary this can take a second or even weeks. I cracked it in a second because the dictionary was small and it contained the password.
Now you may be thinking that this isn’t the most efficient way of getting someones password.
Well the purpose of this article was to explain the basic attack vector used to hack WiFi passwords and to introduce you to the Aircrack-ng. If you want someones password, just go ask them.
There is another way we could get an APs (with WPA2) password and that is by exploiting the WPS pin vulnerability, we could get the password in just a few hours guaranteed, apparently that only works on old routers. So when i get a hold of one i’ll cover that topic as well.
Every type of WiFi encryption has its set vulnerabilities, for example the WEP has an issue with the implementation of the RC4 encryption algorithm. So stay tuned as i cover them one by one.
HAPPY HACKING
Advertisements
Update The default WPA2-PSK passphrase used in some Belkin routers simply replaces a character of the device’s MAC address with another hecxadecimal character, according to security blogger Jakob Lell.
Lell describes the situation as follows:
Each of the eight characters of the default passphrase are created by substituting a corresponding hex-digit of the WAN MAC address using a static substitution table. Since the WAN MAC address is the WLAN MAC address + one or two (depending on the model), a wireless attacker can easily guess the wan mac address of the device and thus calculate the default WPA2 passphrase.
In either case, that’s problematic because it is possible to interrogate WiFi routers in order to learn their MAC address. Some models even advertise the address on the case of the device!
Lell’s revelation, which he says makes it possible to deduce passwords by drawing up a simple substitution table, means all an attacker needs to do to compromise a device is learn its MAC address and then spend a few minutes converting it into Hex.
Show Wifi Password On Pc
Lell’s post on the topic suggests Belkin’s Surf N150 Model F7D1301v1, N900 Model F9K1104v1 and N450 Model F9K1105V2 are all susceptible to the attack.
He also writes that other routers may have the same issue, with only the substitution table differing.
“It is likely that other Belkin devices are affected as well,” Lell’s post says, adding that he has tried to engage the company on the issue since January 2012, without success. “Unfortunately, Belkin has not yet cooperated with us to fix the vulnerability and/or confirm a list of other affected devices,” he says.
The good news is that users need only change the password to make the poorly-coded default codes irrelevant. And we all know users are always diligent about that kind of chore and would never leave a system in an insecure state.
Belkin has responded to The Register's inquiries, saying 'We have been made aware of the work recently published by two researchers at the Technische Universität Berlin regarding the default security configuration of Belkin routers, and appreciate their contribution to improved Wi-Fi security.'
The responses goes on to say the company is 'reviewing the details of the published research to understand its full implications' and will fix the problem if necessary, 'so as to ensure our users continue to benefit from the maximum level of security possible while also guaranteeing interoperability and ease of use.” ®
Get ourTech Resources