[Captain Meow]

Hello, Is there any way of cracking hotspot wifi spot with kali linux?

[paynety174]

Yeah. Depending on the encryption though. If its WEP, very easy. WPA/WPA2 without WPS, kinda tricky, WPA/WPA2 with WPS, very easy. Look up Reaver and Pixie Dust attack.

[BeNT-]

Yeah. Depending on the encryption though. If its WEP, very easy. WPA/WPA2 without WPS, kinda tricky, WPA/WPA2 with WPS, very easy. Look up Reaver and Pixie Dust attack.

You keep saying (several threads) WPA/WPS very easy.. It can be, but are you familiar with WPS locks? Not very easy, and in some cases not a viable option given time constraints (same as WPA/WPA2) "kinda tricky", LOL, nice understatement.

B.

[Captain Meow]

Yeah. Depending on the encryption though. If its WEP, very easy. WPA/WPA2 without WPS, kinda tricky, WPA/WPA2 with WPS, very easy. Look up Reaver and Pixie Dust attack.

Nah, i CAN connect to the network (there is no pass), but as soon as turn on the browser it redirects me to a login page with user and pass (hotspot login page)

[sp3ctrum]

So you have hit a captive portal. There are a few ways to bypass these. The easiest and most used way is session jacking. This is when you run airodump-ng get a list of the devices connected to the access point, choose a mac address and then fire up macchanger.

Code

# Put wireless interface into monitor mode
sudo airmon-ng start wlan0
# Run airodump to get a list of already assoicated clients
sudo airodump-ng --bssid "MAC address of access point here"
# after finding a mac, stop monitor mode, and interface, then macchanger
sudo airmon-ng stop mon0
sudo ifconfig wlan0 down
sudo macchanger -m "MAC address you found" wlan0
sudo ifconfig wlan0 up
# Connect to AP and enjoy free webz

There are other ways as well but they tend to be more of a hassle for beginners: DNS tunneling, ping tunneling, etc.. But if your interested:

http://blog.rootshell.be/2007/03/22/dns2...e-portals/

[Captain Meow]

@The_Chang
Thanks alot! One more question, im kinda new to kali. Can you recommend me some books or websites with tutorials (where can i find the most new tools for kali and etc.)

[Neotokyo]

There are not really any set tutorials for Kali. It is just a linux distribution. If you need to learn linux such as unix commands, etc... Then you can google that. Otherwise it is best to simply look up the toolkit online and find tutorials on it. Such as looking up what is a mac address, how to change it on kali, what is aircrack-ng, how to .... with aircrack-ng

[Almost Einstein]

http://www.google.com no problem. Either bruteforce or dictionary attack

[aanarchyy]

So you have hit a captive portal. There are a few ways to bypass these. The easiest and most used way is session jacking. This is when you run airodump-ng get a list of the devices connected to the access point, choose a mac address and then fire up macchanger.

Code

# Put wireless interface into monitor mode
sudo airmon-ng start wlan0
# Run airodump to get a list of already assoicated clients
sudo airodump-ng --bssid "MAC address of access point here"
# after finding a mac, stop monitor mode, and interface, then macchanger
sudo airmon-ng stop mon0
sudo ifconfig wlan0 down
sudo macchanger -m "MAC address you found" wlan0
sudo ifconfig wlan0 up
# Connect to AP and enjoy free webz

There are other ways as well but they tend to be more of a hassle for beginners: DNS tunneling, ping tunneling, etc.. But if your interested:

http://blog.rootshell.be/2007/03/22/dns2...e-portals/
/

That's very interesting, i was always wondering aout that, but never actually thought about it the times the oportunity arose to try it.
im gonna be trying some dns tunneling tonight! 🎉

[Vicious™]

The easiest way is to put your wifi card in monitor mode and scan for computers connected to that access point, then copy their MAC address and spoof your Mac address to theirs. The hotspot will think that you are that computer. Here's are some videos on it:

https://m.youtube.com/watch?v=AU0VRA84-CQ

P.S. You must have Linux and a wifi card capable of Monitor mode.

[aanarchyy]

I'm more interested in seeing if i can get this to work with all the "xfinitywifi" networks that are litterally EVERYWHERE where i live.

Session stealing and client cloning wont work for that. Also, what if there aren't any clients connected to clone or hijack?

[-ExCeL-]

I'm more interested in seeing if i can get this to work with all the "xfinitywifi" networks that are litterally EVERYWHERE where i live.

Session stealing and client cloning wont work for that. Also, what if there aren't any clients connected to clone or hijack?

For Xfinity

You can do it one of two ways:

1. Either wait until a client connects to the network and clone their MAC or;

2. Set up a fake hotspot that mimics the SSID and Xfinity login page that steals credentials when they enter their information to connect. Although this may or may not take a while to get someone to connect.

I have had success from #2. That partly because I have the ability to broadcast the SSID in pretty long distances with an amplifier. Also, I live in a populated area with a lot of traffic (stores, larges church's, etc) nearby.

[aanarchyy]

Here is how the routers are set up around here:

Each router has two access points, one is a WPA2 encrypted named "HOME-XXXX" with the X's being the last four digits of either the wlan mac or the lan mac.
The other is named "xfinitywifi" which is an open network that prompts you for your xfinity account username and password.

Getting into the HOME-XXXX part is usually trivial, expecially since most of them are vulnerable to pixiewps, but i was looking for a way into the xfinitywifi part. The likelyhood of someone actually logging into it and typing in their credentials are next to nothing.

Not just looking for access to the router and be done with it, im looking to attack in several different vectors incase one doesn't work. Like no wps or something. The WPA2 password is default a 16 digit alphanumeric upper-case only password, so it would take quite a while to crack.

See what i'm saying here? Multiple avenues of attack.

Or even finding a way into xfinitywifi to read the credentials straight from the router.

[-ExCeL-]

Here is how the routers are set up around here:

Each router has two access points, one is a WPA2 encrypted named "HOME-XXXX" with the X's being the last four digits of either the wlan mac or the lan mac.
The other is named "xfinitywifi" which is an open network that prompts you for your xfinity account username and password.

Getting into the HOME-XXXX part is usually trivial, expecially since most of them are vulnerable to pixiewps, but i was looking for a way into the xfinitywifi part. The likelyhood of someone actually logging into it and typing in their credentials are next to nothing.

Not just looking for access to the router and be done with it, im looking to attack in several different vectors incase one doesn't work. Like no wps or something. The WPA2 password is default a 16 digit alphanumeric upper-case only password, so it would take quite a while to crack.

See what i'm saying here? Multiple avenues of attack.

Or even finding a way into xfinitywifi to read the credentials straight from the router.

If you have access to their internet, the DNS spoof and redirect them to some made up Xfinity page asking for their credentials for whatever reason. You'll get their login information and can use it with any Xfinity WiFi hotspot.

[Captain Meow]

Can you give me an artical about this method with DNS spoofing into fake login and one more question that is out of the topic : If im connected to a wifi and i want to redirect the victims to download my payload.exe (how can i do that?)