How to Hack WPA (Wi-Fi How to Hack WPA (Wi-Fi Protected Access) Wireless Protected Access) Wireless Internet Using Aircrack-ngInternet Using Aircrack-ng

Presented By: Presented By:

Nikesh Balami Nikesh Balami

This presentation is intended to inform the This presentation is intended to inform the audience about methods used to “Hack” audience about methods used to “Hack” wireless internet connections, not for any wireless internet connections, not for any malicious use but strictly for educational malicious use but strictly for educational purposes and personal intentions such as purposes and personal intentions such as recovering a misplaced network key for recovering a misplaced network key for the users own wireless connection. the users own wireless connection.

WPA or WPA2WPA or WPA2

Stands for Wi-Fi Protected AccessStands for Wi-Fi Protected Access Created to provide stronger securityCreated to provide stronger security Still able to be cracked if a short password is Still able to be cracked if a short password is

used. used. WPA 1WPA 1

– – Based on 3rd draft of 802.11iBased on 3rd draft of 802.11i

– – Uses TKIPUses TKIP

– – Backward compatible with old hardwareBackward compatible with old hardware WPA 2WPA 2

––Based on 802.11iBased on 802.11i

– – Uses CCMP (AES)Uses CCMP (AES)

– – Not compatible with old hardwareNot compatible with old hardware

Aircrack-ngAircrack-ng

““Aircrack-ng is an 802.11 WEP and WPA-PSK Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys keys cracking program that can recover keys once enough data packets have been captured. once enough data packets have been captured. It implements the standard FMS attack along It implements the standard FMS attack along with some optimizations like KoreK attacks, as with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the well as the all-new PTW attack, thus making the attack much faster compared to other WEP attack much faster compared to other WEP cracking tools. In fact, Aircrack-ng is a set of cracking tools. In fact, Aircrack-ng is a set of tools for auditing wireless networks.”tools for auditing wireless networks.”

Tools used in this PresentationTools used in this Presentation

Wi-Fi BoosterWi-Fi Booster VMware WorkstationVMware Workstation Backtrack 5 r3Backtrack 5 r3

Wi-Fi BoosterWi-Fi Booster

o Make broadband wireless in possible Make broadband wireless in possible coveragecoverage

o Strengthen radio signal to increase the Strengthen radio signal to increase the effective range and coverage area for effective range and coverage area for

Wi-Fi communicationWi-Fi communicationo Install easily, just plug in and playInstall easily, just plug in and playo Save lots of wiring costsSave lots of wiring costs

VMware WorkstationVMware Workstation

Secure way to run multiple operating Secure way to run multiple operating systems at the same time.systems at the same time.

It is an integral component of any serious It is an integral component of any serious technical professional’s toolkit.technical professional’s toolkit.

It offers the broadest host and guest It offers the broadest host and guest operating system support, the richest user operating system support, the richest user experience, and the most comprehensive experience, and the most comprehensive feature set.feature set.

BacktrackBacktrack

Backtrack is an operating system Backtrack is an operating system based on the Ubuntu GNU/Linux based on the Ubuntu GNU/Linux distribution aimed at digital forensics distribution aimed at digital forensics and penetration testing use. It is named and penetration testing use. It is named after backtracking, a search algorithm. after backtracking, a search algorithm. The current version is Backtrack 5, The current version is Backtrack 5, code name “Revolution.”code name “Revolution.”

Backtrack ToolsBacktrack Tools

BackTrack includes many well known security tools including:BackTrack includes many well known security tools including:

o Metasploit integrationMetasploit integrationo RFMON Injection capable wireless driversRFMON Injection capable wireless driverso Aircrack-NGAircrack-NGo KismetKismeto NmapNmapo OphcrackOphcracko EttercapEttercapo Wireshark (formerly known as Ethereal)Wireshark (formerly known as Ethereal)o BeEF (Browser Exploitation Framework)BeEF (Browser Exploitation Framework)o HydraHydra

ProcessProcess

Install a VMware workstation on your Install a VMware workstation on your ComputerComputer

Open the Vmware workstation and install Open the Vmware workstation and install Backtrack 5 r3 on itBacktrack 5 r3 on it

After completing installation After completing installation Go to VM>Removable DeviceGo to VM>Removable Device And now connect your Wi-Fi Booster or And now connect your Wi-Fi Booster or

Wi-Fi Receiver on it Wi-Fi Receiver on it

Process Cont…Process Cont…

Now after doing all of this your Backtrack 5 Now after doing all of this your Backtrack 5 r3 is ready to user3 is ready to use

Open the Terminal of backtrack 5 r3Open the Terminal of backtrack 5 r3 And type “And type “airmon-ngairmon-ng” to check our Wi-Fi ” to check our Wi-Fi

Booster works on it or notBooster works on it or not Again type “Again type “airmon-ng start wlan0airmon-ng start wlan0” to ” to

create a new mon0 interfacecreate a new mon0 interface

How To See Weather Our How To See Weather Our Booster Works Or NotBooster Works Or Not

Process Cont…Process Cont…

Now type “Now type “airodump-ng mon0airodump-ng mon0” to see the ” to see the connection and use “connection and use “wash –i mon0wash –i mon0” to see ” to see the WPS “ON” connectionthe WPS “ON” connection

After successful completion of the process After successful completion of the process you will see the BSSID of the connection you will see the BSSID of the connection at the first line . Copy that BSSID and at the first line . Copy that BSSID and keep it at the safe.keep it at the safe.

How To Get BSSIDHow To Get BSSID

Process Cont…Process Cont…

Last step . Attacking the connection using Last step . Attacking the connection using reaverreaver

Type the code at the Terminal “Type the code at the Terminal “reaver –i reaver –i mon0 –b <<paste the BSSID over hear>> mon0 –b <<paste the BSSID over hear>> -vv -vv””

After waiting for an hours you will got the After waiting for an hours you will got the keykey

Attacking With ReaverAttacking With Reaver

Problem Occurs While HackingProblem Occurs While Hacking

ProblemProblem

Happy Hacking