Audit Wireless Access Points
If you find any rogue access points, at this point you can take steps to find their owners and make sure they are closed down. But what about your official ones? How secure are they?
Here's how to find out.
Firstly, if they wireless networks are secured by WEP, then as mentioned above the answer is "not secure at all." Here's proof:
First, make a note of the channel of the WEP protected access point you want to test from the Airodump-ng window. In the case above the channel (CH) is channel 1.
Next, quit airodump-ng by doing a control-c , then restart it by typing: airodump-ng -c X -w mycapture ath0
changing the X for the channel number of your access point. This will start capturing data which you will use to crack the WEP key, in a file called mycapture-01.cap in your home directory.
Next you'll need to inject some traffic onto the network. To do this you can use Aircrack-ng's packet injection tool, Aireplay-ng, to monitor the network and wait for an ARP request, and then re-inject (or replay) this ARP request over and over again. This stimulates a response from the access point, until enough packets have been collected to crack the WEP key.
How many is enough? 40,000 packets will be enough 50 per cent of the time, while 85,000 packets gives you a 95% chance of success.
To inject the ARP requests onto the network, you'll first need to look in the Airodump-ng window and make a note of the MAC addresses of the base station and a connected client.
Then start aireplay, by typing: aireplay-ng -3 –b [base station MAC address] –h [client Mac address] ath0
The -3 in the command tells aireplay-ng to search for ARP requests and then replay them)
As soon as an ARP request is received, aireplay-ng will start injecting it back onto the network, and airodump-ng will start collecting packets in the file mycapture-01.cap. (see Figure 2.)
To crack the key, all that's required is to start Aircrack-ng, and tell it to work on the data in mycapture-01.cap using a statistical attack known as PTW, which is activated using the –z option: aircrack-ng –z mycapture-01.cap
Wait a minute or two, and in most cases you'll have the WEP key to the network. If you can do that, then so can a hacker. The moral of the story is never, ever rely on WEP for any sort of network protection.
If you find any rogue access points, at this point you can take steps to find their owners and make sure they are closed down. But what about your official ones? How secure are they?
Here's how to find out.
Firstly, if they wireless networks are secured by WEP, then as mentioned above the answer is "not secure at all." Here's proof:
First, make a note of the channel of the WEP protected access point you want to test from the Airodump-ng window. In the case above the channel (CH) is channel 1.
Next, quit airodump-ng by doing a control-c , then restart it by typing: airodump-ng -c X -w mycapture ath0
changing the X for the channel number of your access point. This will start capturing data which you will use to crack the WEP key, in a file called mycapture-01.cap in your home directory.
Next you'll need to inject some traffic onto the network. To do this you can use Aircrack-ng's packet injection tool, Aireplay-ng, to monitor the network and wait for an ARP request, and then re-inject (or replay) this ARP request over and over again. This stimulates a response from the access point, until enough packets have been collected to crack the WEP key.
How many is enough? 40,000 packets will be enough 50 per cent of the time, while 85,000 packets gives you a 95% chance of success.
To inject the ARP requests onto the network, you'll first need to look in the Airodump-ng window and make a note of the MAC addresses of the base station and a connected client.
Then start aireplay, by typing: aireplay-ng -3 –b [base station MAC address] –h [client Mac address] ath0
The -3 in the command tells aireplay-ng to search for ARP requests and then replay them)
As soon as an ARP request is received, aireplay-ng will start injecting it back onto the network, and airodump-ng will start collecting packets in the file mycapture-01.cap. (see Figure 2.)
To crack the key, all that's required is to start Aircrack-ng, and tell it to work on the data in mycapture-01.cap using a statistical attack known as PTW, which is activated using the –z option: aircrack-ng –z mycapture-01.cap
Wait a minute or two, and in most cases you'll have the WEP key to the network. If you can do that, then so can a hacker. The moral of the story is never, ever rely on WEP for any sort of network protection.