Apr 18, 2017 05:47 PM
(This post was last modified: Jun 10, 2017 08:47 AM by Not Your Average Orange.)
I've seen so many people make thread like this:
So I decided to make a post about it and refer them here. Anyways, here goes nothing...
-----------------------------------------------------
Getting setup
You can't just run a command on Windows and then expect it to run. You need a proper Linux operating system, as most if not all pentesting scripts are written for Linux. A favorite of this forum would be Kali Linux, which comes with all the hacking tools you need pre installed on a Debian based OS. Here is a tutorial on how to boot kali linux from a USB. Beware, as booting it from a USB does not save your data. It is best to save your stuff on an additional USB. Once you have made the USB, plug it into your pc, then when booting click F8, or whatever your computer tells you to click to get to the BIOS. From there edit boot options to boot from USB. You will also need a wireless adapter capable of monitor/promiscuous mode (being able to 'see' packets) and packet injection (allowing you to inject packets such as deauth packets). I reccomend the TP-LINK WN722N for fifteen dollars off of Amazon. It's cheap and will get you started. I also recommend taking a look at Pomtwin's post comparing wireless adapters.
Automated Network Hacking
If you're only gonna crack your neighbors wifi once, then what's the point about learning all this stuff? Automated tools do attempt to crack networks for you, here are some you could use:
Wifite - Wifite is an automated network cracker that attempts attacks such as WPS pin bruteforcing and getting WPA(2) handshakes. Download. It has a very nice user interface and is easy to use.
Fluxion - Fluxion creates a fake network with the same name as your victim's, bumps them off their own, forces them onto yours and then attempts to phish their router password. It has very realistic phishing pages. It's made by an HF member, Deltaflux. Download it from the official site here..
Infernal Twin - I haven't personally tried this out but it is like Fluxion except it does additional things for you such as network mapping, saving data to a DB and more. Download it here.
WPS
Before we go any further we want to check if WPS is enabled, I also recommend reading the section below me (oh the irony) to find out things like how to get network BSSID's and monitor mode stuff so you can understand what we are doing here. WPS is (now not so common, but you will still find it) a router vulnerability that allows you to login to the router with a seven digit numeric code. We can exploit this with a few programs:
First to check if WPS is installed, we will do
wash -i (interface/wlan1mon)
If it is installed, we can use something like reaver to exploit it. Remember to follow the install instructions listed on the github. Here is the command:
reaver -i wlan1mon -b (network BSSID) --mac-changer
We're telling Reaver to brute forcing the network using wlan1mon and to spoof our MAC address so victims can't identify where our packets are coming from. It will take a few hours but it will be worth it.
'The real deal' - cracking with commands
Automated stuff doesn't always work- and let's be honest; you don't know what you're doing. With commands you have full control over what you're doing and hopefully by the end of this you will know what you're typing. We'll be using the aircrack-ng suite which is pre installed on kali linux. You can get it from the official website, here. One thing to know about linux is that it labels your wifi adapters like so:
Your internal wireless adapter will usually be wlan0, your usb one will be wlan1, another usb one will be wlan2 etc. To find your adapters type iwconfig in the command line.
aircrack-ng start <wlan1> (Click to View)
airodump-ng wlan1mon (Click to View)
airodump-ng -c channel # --bssid BSSID -w file wlan1mon[/spoiler (Click to View)
aireplay-ng --deauth 20 -a BSSID wlan1mon (Click to View)
Handshakes
Wireless handshakes have the password stored in them. However don't get too excited as it's encrypted. The thing about routers is that it's hard to crack a router if it's not at default password. You can tell if it's at default password most of the time by seeing if the name/essid of the network has changed. For example: Netgear33 is a netgear router and is likely at default pass. Another example: ilovecupcakes123 is most likely not at default password as the name was changed. The more handshakes the better- check how many handshakes you have (/4) by opening up a .cap file with wireshark.
Cracking a handshake
Ono, you don't have three GTX 1080's to crack a handshake!! Well good news, because there are services out there that can do it for you. Such as this one. You submit your .cap file, where the handshake is stored over there. They will try to crack it. But what if you do have 3 GTX 1080's? (that an exaggeration) Well, for starters try to find out if the router is at default password. If it is, you're in luck. If it's a netgear router most netgear's are adjective_noun_3d. However, it all depends on the essid. There are two general ways to crack handshakes: with a wordlist and a mask. For cracking yourself, you should use hashcat for both windows and linux.
Wordlists
Wordlists are lists full of words. You try every single password in the list and see if it works. You want to find a wordlist related to the router assuming it's still at default password. If the router's name is NETGEARXX (x = numbers) try googling netgear list and you should find something. Note, to crack a handshake in hashcat you must first convert it to .hccapx format using a converter like this. Command to run in hashcat, you must first cd into the HC directory:
hashcat64.exe -m 2500 filename.hccapx wordlist.txt
Masks
Masks are a very useful part of hashcat. Read more about them here.
Thanks for reading. If you need help the wireless section is always open, and so are my PM's. :) If you have any suggestions or feedback please post below. 🤝
Quote:hi, how i hack neighbours wifi?
So I decided to make a post about it and refer them here. Anyways, here goes nothing...
-----------------------------------------------------
Getting setup
You can't just run a command on Windows and then expect it to run. You need a proper Linux operating system, as most if not all pentesting scripts are written for Linux. A favorite of this forum would be Kali Linux, which comes with all the hacking tools you need pre installed on a Debian based OS. Here is a tutorial on how to boot kali linux from a USB. Beware, as booting it from a USB does not save your data. It is best to save your stuff on an additional USB. Once you have made the USB, plug it into your pc, then when booting click F8, or whatever your computer tells you to click to get to the BIOS. From there edit boot options to boot from USB. You will also need a wireless adapter capable of monitor/promiscuous mode (being able to 'see' packets) and packet injection (allowing you to inject packets such as deauth packets). I reccomend the TP-LINK WN722N for fifteen dollars off of Amazon. It's cheap and will get you started. I also recommend taking a look at Pomtwin's post comparing wireless adapters.
Automated Network Hacking
If you're only gonna crack your neighbors wifi once, then what's the point about learning all this stuff? Automated tools do attempt to crack networks for you, here are some you could use:
Wifite - Wifite is an automated network cracker that attempts attacks such as WPS pin bruteforcing and getting WPA(2) handshakes. Download. It has a very nice user interface and is easy to use.
Fluxion - Fluxion creates a fake network with the same name as your victim's, bumps them off their own, forces them onto yours and then attempts to phish their router password. It has very realistic phishing pages. It's made by an HF member, Deltaflux. Download it from the official site here..
Infernal Twin - I haven't personally tried this out but it is like Fluxion except it does additional things for you such as network mapping, saving data to a DB and more. Download it here.
WPS
Before we go any further we want to check if WPS is enabled, I also recommend reading the section below me (oh the irony) to find out things like how to get network BSSID's and monitor mode stuff so you can understand what we are doing here. WPS is (now not so common, but you will still find it) a router vulnerability that allows you to login to the router with a seven digit numeric code. We can exploit this with a few programs:
First to check if WPS is installed, we will do
wash -i (interface/wlan1mon)
If it is installed, we can use something like reaver to exploit it. Remember to follow the install instructions listed on the github. Here is the command:
reaver -i wlan1mon -b (network BSSID) --mac-changer
We're telling Reaver to brute forcing the network using wlan1mon and to spoof our MAC address so victims can't identify where our packets are coming from. It will take a few hours but it will be worth it.
'The real deal' - cracking with commands
Automated stuff doesn't always work- and let's be honest; you don't know what you're doing. With commands you have full control over what you're doing and hopefully by the end of this you will know what you're typing. We'll be using the aircrack-ng suite which is pre installed on kali linux. You can get it from the official website, here. One thing to know about linux is that it labels your wifi adapters like so:
Your internal wireless adapter will usually be wlan0, your usb one will be wlan1, another usb one will be wlan2 etc. To find your adapters type iwconfig in the command line.
aircrack-ng start <wlan1> (Click to View)
airodump-ng wlan1mon (Click to View)
airodump-ng -c channel # --bssid BSSID -w file wlan1mon[/spoiler (Click to View)
aireplay-ng --deauth 20 -a BSSID wlan1mon (Click to View)
Handshakes
Wireless handshakes have the password stored in them. However don't get too excited as it's encrypted. The thing about routers is that it's hard to crack a router if it's not at default password. You can tell if it's at default password most of the time by seeing if the name/essid of the network has changed. For example: Netgear33 is a netgear router and is likely at default pass. Another example: ilovecupcakes123 is most likely not at default password as the name was changed. The more handshakes the better- check how many handshakes you have (/4) by opening up a .cap file with wireshark.
Cracking a handshake
Ono, you don't have three GTX 1080's to crack a handshake!! Well good news, because there are services out there that can do it for you. Such as this one. You submit your .cap file, where the handshake is stored over there. They will try to crack it. But what if you do have 3 GTX 1080's? (that an exaggeration) Well, for starters try to find out if the router is at default password. If it is, you're in luck. If it's a netgear router most netgear's are adjective_noun_3d. However, it all depends on the essid. There are two general ways to crack handshakes: with a wordlist and a mask. For cracking yourself, you should use hashcat for both windows and linux.
Wordlists
Wordlists are lists full of words. You try every single password in the list and see if it works. You want to find a wordlist related to the router assuming it's still at default password. If the router's name is NETGEARXX (x = numbers) try googling netgear list and you should find something. Note, to crack a handshake in hashcat you must first convert it to .hccapx format using a converter like this. Command to run in hashcat, you must first cd into the HC directory:
hashcat64.exe -m 2500 filename.hccapx wordlist.txt
Masks
Masks are a very useful part of hashcat. Read more about them here.
Thanks for reading. If you need help the wireless section is always open, and so are my PM's. :) If you have any suggestions or feedback please post below. 🤝
![[Image: VPWSgxk.gif]](https://i.imgur.com/VPWSgxk.gif)
