Hello all,
This will be my first thread and I wanted to make a usefull one :)
So as an ongoing pentester, when having a specific target. I'm always using a simple strategy on how to hack for example the PC of my neighbour.
1. The first step is to get in their WiFi. WiFi can be hacked in a couple of different ways.
You can:
- Hack the WEP key by recieving lots of IV's.
- Hack the WPA/WPA2 key by deauthenticating a client and capturing the handshake.
- Hack the WPS pin by bruteforcing.
Since most routers these days use WPA2 it's the most common target for hacking WiFi. When someone has captured a handshake you can try to crack it with a dictionary attack. Or you can try to crack the key by social engineering (with tools like fluxion).
2. The second step is to scan the network to look for targets.
Do a quick and easy scan with nmap like: "nmap -sS -O <targets ip range>". It is important to know what operating system is running on the machines, becuase you can use this information to find target-specific exploits.
Personally I would log the internet traffic and look for active moments in the network. In the periods when it is busy I will do some MiTM attack to give the target a fake router-update page (It will fit with the router update page used with fluxion). I will add the BeEF-hook.js file in the sourcecode of the page and start my armitage-BeEF setup.
3. Loot // persistance
If you want to keep the machine for later use, just upload a backdoor on it so it will stay persistant. You can start looting creds, files etc.
If you don't care about this just start looting.
I hope this was a good first thread, I would love to see some feedback and comments.
MackyNous
This will be my first thread and I wanted to make a usefull one :)
So as an ongoing pentester, when having a specific target. I'm always using a simple strategy on how to hack for example the PC of my neighbour.
1. The first step is to get in their WiFi. WiFi can be hacked in a couple of different ways.
You can:
- Hack the WEP key by recieving lots of IV's.
- Hack the WPA/WPA2 key by deauthenticating a client and capturing the handshake.
- Hack the WPS pin by bruteforcing.
Since most routers these days use WPA2 it's the most common target for hacking WiFi. When someone has captured a handshake you can try to crack it with a dictionary attack. Or you can try to crack the key by social engineering (with tools like fluxion).
2. The second step is to scan the network to look for targets.
Do a quick and easy scan with nmap like: "nmap -sS -O <targets ip range>". It is important to know what operating system is running on the machines, becuase you can use this information to find target-specific exploits.
Personally I would log the internet traffic and look for active moments in the network. In the periods when it is busy I will do some MiTM attack to give the target a fake router-update page (It will fit with the router update page used with fluxion). I will add the BeEF-hook.js file in the sourcecode of the page and start my armitage-BeEF setup.
3. Loot // persistance
If you want to keep the machine for later use, just upload a backdoor on it so it will stay persistant. You can start looting creds, files etc.
If you don't care about this just start looting.
I hope this was a good first thread, I would love to see some feedback and comments.
MackyNous
