Show Posts
1
Hacking and Security / Free Wi-Fi using Reaver and how to protect yourself
« on: March 09, 2014, 12:56:08 AM »
Most of you guys may be familiar with Reaver nut for those that aren't im gonna teach you how to gain your neighbors Wi-Fi...
People assume that because their wireless encryption key is WPA2 standard, they are safe from cyber attack. They are wrong. Reaver is a program inside of Kali Linux that allows an attacker (maybe that creepy neighbor of yours that never comes out of their apartment without taking weird to a new level), easily compromise your routers password by attacking the PIN authorization process between your router and other devices. See, with your router’s PIN, a password is not needed. In fact, because Reaver doesn’t use a dictionary file to bruteforce your password, it doesn’t matter how strong or long it is and Reaver WILL eventually crack the PIN!
Your router’s PIN is eight numbers long. Your router knows four of these numbers and any devices that use the wireless password knows the other four numbers. Reaver randomly runs every possible combination of four numbers until it cracks the PIN! Then voila! The attacker gets your full PIN and Password
HOW TO PROTECT YOURSELF
Set your wireless router to LOCK WPS. This locks your WPS PIN and makes you invulnerable to this method of attack.
HOW THE ATTACK IS CARRIED OUT
In order to use Reaver, you need to get your wireless card’s interface name, the BSSID of the router you’re attempting to crack (which I will show you how to find), and you need to make sure your wireless card is in monitor mode. So let’s do all that!
FIND YOUR WIRELESS CARD
Inside Terminal, type: iwconfig
Press Enter. You should see a wireless device in the subsequent list. Most likely, it’ll be named:
wlan0 or wlan1
But if you have more than one wireless card, or a more unusual networking setup, it may be named something different.
Put your wireless card into monitor mode: Assuming your wireless card’s interface name is: wlan0
Execute the following command to put your wireless card into monitor mode:
airmon-ng start wlan0
This command will output the name of monitor mode interface, which you’ll also want to make note of. Most likely, it’ll be: mon0
FIND THE BSSID YOU WANT TO CRACK
Lastly, you need to get the unique identifier of the router you’re attempting to crack so that you can point Reaver in the right direction. To do this, execute the following command:
airodump-ng mon0
When you see the network you want, press Ctrl+C to stop the list from refreshing, then copy that network’s BSSID (it’s the series of letters, numbers, and colons on the far left). The network should have WPA or WPA2 listed under the ENC column.
Now, with the BSSID and monitor interface name in hand, you’ve got everything you need to start up Reaver.
CRACK THE NETWORK WITH REAVER
To find out if the AP you are attacking usese WPS (vulnerable to Reaver), you can use:
wash -i mon0
Look under the LOCK column. If your target BSSID has it’s WPS LOCKED (you will see “yes” for LOCKED WPSs), then Reaver will not be able to crack the PIN. If you see a “no”, then continue…
Now execute the following command in the Terminal. (replacing and monitor interface and the BSSID with the BSSID that you copied down above):
reaver -i mon0 -b [bssid] -vv
For example, if your monitor interface was mon0 like mine, and your BSSID was
8D:AE:9D:65:1F:B2
(a BSSID I just made up), your command would look like:
reaver -i mon0 -b 8D:AE:9D:65:1F:B2 -vv
Press Enter, sit back, and let Reaver work its disturbing magic. Reaver will now try a series of PINs on the router in a brute force attack, one after another. This will take a while. In my successful test, Reaver took about 6 hours to crack the PIN and deliver me the correct password. The Reaver documentation says it can take between 4 and 10 hours so it could take more or less time than I experienced, depending.
People assume that because their wireless encryption key is WPA2 standard, they are safe from cyber attack. They are wrong. Reaver is a program inside of Kali Linux that allows an attacker (maybe that creepy neighbor of yours that never comes out of their apartment without taking weird to a new level), easily compromise your routers password by attacking the PIN authorization process between your router and other devices. See, with your router’s PIN, a password is not needed. In fact, because Reaver doesn’t use a dictionary file to bruteforce your password, it doesn’t matter how strong or long it is and Reaver WILL eventually crack the PIN!
Your router’s PIN is eight numbers long. Your router knows four of these numbers and any devices that use the wireless password knows the other four numbers. Reaver randomly runs every possible combination of four numbers until it cracks the PIN! Then voila! The attacker gets your full PIN and Password
HOW TO PROTECT YOURSELF
Set your wireless router to LOCK WPS. This locks your WPS PIN and makes you invulnerable to this method of attack.
HOW THE ATTACK IS CARRIED OUT
In order to use Reaver, you need to get your wireless card’s interface name, the BSSID of the router you’re attempting to crack (which I will show you how to find), and you need to make sure your wireless card is in monitor mode. So let’s do all that!
FIND YOUR WIRELESS CARD
Inside Terminal, type: iwconfig
Press Enter. You should see a wireless device in the subsequent list. Most likely, it’ll be named:
wlan0 or wlan1
But if you have more than one wireless card, or a more unusual networking setup, it may be named something different.
Put your wireless card into monitor mode: Assuming your wireless card’s interface name is: wlan0
Execute the following command to put your wireless card into monitor mode:
airmon-ng start wlan0
This command will output the name of monitor mode interface, which you’ll also want to make note of. Most likely, it’ll be: mon0
FIND THE BSSID YOU WANT TO CRACK
Lastly, you need to get the unique identifier of the router you’re attempting to crack so that you can point Reaver in the right direction. To do this, execute the following command:
airodump-ng mon0
When you see the network you want, press Ctrl+C to stop the list from refreshing, then copy that network’s BSSID (it’s the series of letters, numbers, and colons on the far left). The network should have WPA or WPA2 listed under the ENC column.
Now, with the BSSID and monitor interface name in hand, you’ve got everything you need to start up Reaver.
CRACK THE NETWORK WITH REAVER
To find out if the AP you are attacking usese WPS (vulnerable to Reaver), you can use:
wash -i mon0
Look under the LOCK column. If your target BSSID has it’s WPS LOCKED (you will see “yes” for LOCKED WPSs), then Reaver will not be able to crack the PIN. If you see a “no”, then continue…
Now execute the following command in the Terminal. (replacing and monitor interface and the BSSID with the BSSID that you copied down above):
reaver -i mon0 -b [bssid] -vv
For example, if your monitor interface was mon0 like mine, and your BSSID was
8D:AE:9D:65:1F:B2
(a BSSID I just made up), your command would look like:
reaver -i mon0 -b 8D:AE:9D:65:1F:B2 -vv
Press Enter, sit back, and let Reaver work its disturbing magic. Reaver will now try a series of PINs on the router in a brute force attack, one after another. This will take a while. In my successful test, Reaver took about 6 hours to crack the PIN and deliver me the correct password. The Reaver documentation says it can take between 4 and 10 hours so it could take more or less time than I experienced, depending.