Wi-Fi

Airmon-ng

• Can enable or disable monitor mode on a wireless interface

airmon-ng start <interface>

• Or on a specific channel:

airmon-ng start <interface> <channel>

• iwconfig will show Mode:Monitor if it is in monitor mode.
• To check for interfering processes and then kill them run the following:

airmon-ng check
airmon-ng check kill

• To stop the monitor mode:

airmon-ng stop <interfacename>

Airodump-ng

• Captures packets
• Captures WEP IVs and WPA/WPA2 handshakes
• Interface needs to be in monitor mode first
• Will scan on 2.4Ghz band
• The -w or --write will save the output

airodump-ng <interface> -w <filename>

• To dump on a specific channel:

airodump-ng -c <channel> <interface>
airodump-ng -c <channel>,<channel>,<channel> <interface>

• To scan on a different band
  • a - 5Ghz
  • b - 2.4Ghz
  • g - 2.4Ghz

airodump-ng <interface> --band <a,b,g>

• The output will show the available APs at the top, and then the clients connected to the Wi-Fi network below that.
• When using the write option the following files will be generated
  • .cap
  • .csv
  • .kismet.csv
  • .kismet.netxml
  • .log.csv

Airgraph-ng

• Python script for generating a graphical representation of the wireless networks.
• Uses the CSV files made by airodump-ng
• Clients - AP Relationship graph
  • Shows the connections between clients and APs
  • The graph will show the AP colour-coded by the encryption type
    • Green = WPA
    • Red = Open
    • Black = Unknown
    • Yellow = WEP
• Clients probe graph
  • Shows the probed networks by clients

airgraph-ng -i <file>.csv -g CAPR -o <output name> 
airgraph-ng -i <file>.csv -g CPG -o <output name>

Airplay-ng

• Used to inject frames.

• Generates traffic that can be used when cracking WEP and WPA-PSK keys

• Implements the following attacks

  • Attack 0: Deauthentication
  • Attack 1: Fake authentication
  • Attack 2: Interactive packet replay
  • Attack 3: ARP request replay attack
  • Attack 4: KoreK chopchop attack
  • Attack 5: Fragmentation attack
  • Attack 6: Cafe-latte attack
  • Attack 7: Client-oriented fragmentation attack
  • Attack 8: WPA Migration Mode
  • Attack 9: Injection test

• For deauthantication you can also uise the --death flag.

Airdecap-ng

• Used to decrypt WEP/WPA/WPA2 capture files if you have the hexadecimal WEP key or the passphrase

• Outputs a new file ending -dec.cap

• To remove wireless headers from an unencrypted capture file:

airdecap-ng -b <bssid> <pcap>

• To decrypt a WEP capture:
  • the key is in hexadecimal format

airdecap-ng -w <WEP KEY> <pcap>

• To decrypt WPA encrypted capture:
  • The ESSID is the name of the network

airdecap-ng -p <passphrase> <pcap> -e essid

Aircrack-ng

• This is used to crack WEP/WPA/WPA2 that use PSK or PMKID
• Offline attack
• Benchmark the host first, the output will show how many passphrases per second can be cracked.

aircrack-ng -S

• To crack WEP you need to have a decent amount of IVs

aircrack-ng -K <file>.ivs

• To crack WPA you need to have captured the 4-way handshake.
• To crack WPA PSK dictionary method is needed.

aircrack-ng <pcap> -w <wordlist>