1. Module 48 (Wireless Hacking)
At the end of this Module, you'll understand the fundamental ideas behind Wireless Hacking. You'll know about IEEE , wireless channels, and SSIDs. You'll know how the handshake works. You'll also know about the differences between WEP, WPA, and WPA2 wireless encryption.
Module 48

2. Wireless
IEEE family of standards define how wireless LANs are implemented
b/g work in the range of GHz
This bandwidth range is broken up into 14 overlapping channels (1-14)
US Channels 1-11 are supported (most commonly used are nonoverlapping channels 1, 6, and 11)
Use of channels above 11 is prohibited in the U.S.
Module 48

3. SSID SSID: Service Set IDentifier (network name)
BSSID (Basic SSID): MAC address of the Access Point (AP)
ESSID (Extended SSID): name for one or more APs providing the same service to get to a wired LAN.
Module 48

4. 802.11 Handshake Probe Request Probe Response Auth Request
Auth Challenge
Auth Response
Auth Success
Associate Request
Associate Response
Data
Module 48

5. Wireless Encryption Open
WEP (Wired Equivalent Privacy*) uses RC4 stream cipher and CRC32 for integrity check
WPA (Wifi Protected Access) uses Temporal Key Integrity Protocol (TKIP) Message Integrity Check (Michael) subject to reinjection and spoofing
WPA2 uses Advanced Encryption Standard (AES) encryption
Module 48
*for small values of private

6. WEP Authentication
Can use Open System Authentication (common) in which no authentication occurs, the Station just encrypts packets using the Key. Or shared key authentication can be used.
Access Point
Station
Auth Request
Auth Challenge (cleartext)
Auth Response (RC4[Key,cleartext])
Auth Success
Module 48

7. ARP and FMS Attack
ARP (Address Resolution Protocol) IP control packet translates layer 3 network (IP) addresses ( ) to layer 2 datalink (MAC) addresses (00:04:4A:E6:2D:7D)
Fluhrer, Mantin, and Shamir (FMS) devised an attack against WEP encryption based on the use of ARP requests.
Module 48

8. WEP Cracking Details
The WEP Key is a string of 10 hex digits (4 bits each).
WEP uses this 40 bit key and dynamically generated 24-bit initialization vector (IV) to encrypt traffic.
The IVs are transmitted in clear text.
RC4 is a stream cipher, so if a known message is sent many times with many different IVs the stream cipher can be decrypted.
ARP packets are small and have both a known structure and reply. In particular, they all have a common length.
WEP is cracked by sniffing an ARP packet, then replaying it over and over again to generate many encrypted replies with different IVs.
Module 48

9. How Does WPA Encryption Work?
The Access Point and client Station share a secret Pairwise Master Key (PMK).
The AP and Station use a four-way handshake to establish a Pairwise Transient Key (PTK)
If the four-way handshake can be captured, then a dictionary attack can be mounted to verify the PMK.
If a connection is dropped it can be re-established by repeating the handshake.
Module 48

11. How is WPA Cracked? Dictionary attack on Pairwise Master Key.
Resources for dictionary attacks:
Wireless AP-specific wordlists (often include regionally meaningful sports team names and phrases)
Module 48

12. How do I get kali to use my host's wireless connection?
You don't usually use the host wireless connection.
Better to use a USB Wireless adapter.
Recommended adapter: ALFA AWUS036NHR
Practical applications next Thursday
Module 48