Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition
  • Toc
  • feedback
Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition

Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition

By : Cameron Buchanan, Vivek Ramachandran
4.5 (44)
close
Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition

Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition

4.5 (44)
By: Cameron Buchanan, Vivek Ramachandran

Overview of this book

If you are a security professional, pentester, or anyone interested in getting to grips with wireless penetration testing, this is the book for you. Some familiarity with Kali Linux and wireless concepts is beneficial.
Table of Contents (13 chapters)
close
close
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
1. Wireless Lab Setup
1. Wireless Lab Setup
Hardware requirements
Software requirements
Installing Kali
Time for action – installing Kali
Setting up the access point
Time for action – configuring the access point
Setting up the wireless card
Time for action – configuring your wireless card
Connecting to the access point
Time for action – configuring your wireless card
Summary
2
2. WLAN and its Inherent Insecurities
2. WLAN and its Inherent Insecurities
Revisiting WLAN frames
Time for action – creating a monitor mode interface
Time for action – sniffing wireless packets
Time for action – viewing management, control, and data frames
Time for action – sniffing data packets for our network
Time for action – packet injection
Important note on WLAN sniffing and injection
Time for action – experimenting with your adapter
The role of regulatory domains in wireless
Time for action – experimenting with your adapter
Summary
3
3. Bypassing WLAN Authentication
chevron up
3. Bypassing WLAN Authentication
Hidden SSIDs
Time for action – uncovering hidden SSIDs
MAC filters
Time for action – beating MAC filters
Open Authentication
Time for action – bypassing Open Authentication
Shared Key Authentication
Time for action – bypassing Shared Authentication
Summary
4
4. WLAN Encryption Flaws
4. WLAN Encryption Flaws
WLAN encryption
WEP encryption
Time for action – cracking WEP
WPA/WPA2
Time for action – cracking WPA-PSK weak passphrases
Speeding up WPA/WPA2 PSK cracking
Time for action – speeding up the cracking process
Decrypting WEP and WPA packets
Time for action – decrypting WEP and WPA packets
Connecting to WEP and WPA networks
Time for action – connecting to a WEP network
Time for action – connecting to a WPA network
Summary
5
5. Attacks on the WLAN Infrastructure
5. Attacks on the WLAN Infrastructure
Default accounts and credentials on the access point
Time for action – cracking default accounts on the access points
Denial of service attacks
Time for action – deauthentication DoS attacks
Evil twin and access point MAC spoofing
Time for action – evil twins and MAC spoofing
A rogue access point
Time for action – cracking WEP
Summary
6
6. Attacking the Client
6. Attacking the Client
Honeypot and Mis-Association attacks
Time for action – orchestrating a Mis-Association attack
The Caffe Latte attack
Time for action – conducting a Caffe Latte attack
Deauthentication and disassociation attacks
Time for action – deauthenticating the client
The Hirte attack
Time for action – cracking WEP with the Hirte attack
AP-less WPA-Personal cracking
Time for action – AP-less WPA cracking
Summary
7
7. Advanced WLAN Attacks
7. Advanced WLAN Attacks
A man-in-the-middle attack
Time for action – man-in-the-middle attack
Wireless Eavesdropping using MITM
Time for action – Wireless Eavesdropping
Session hijacking over wireless
Time for action – session hijacking over wireless
Finding security configurations on the client
Time for action – deauthentication attacks on the client
Summary
8
8. Attacking WPA-Enterprise and RADIUS
8. Attacking WPA-Enterprise and RADIUS
Setting up FreeRADIUS-WPE
Time for action – setting up the AP with FreeRADIUS-WPE
Attacking PEAP
Time for action – cracking PEAP
EAP-TTLS
Security best practices for Enterprises
Summary
9
9. WLAN Penetration Testing Methodology
9. WLAN Penetration Testing Methodology
Wireless penetration testing
Planning
Discovery
Attack
Reporting
Summary
10
10. WPS and Probes
10. WPS and Probes
WPS attacks
Time for action – WPS attack
Probe sniffing
Time for action – collecting data
Summary
11
A. Pop Quiz Answers
Chapter 1, Wireless Lab Setup
Chapter 2, WLAN and its Inherent Insecurities
Chapter 3, Bypassing WLAN Authentication
Chapter 4, WLAN Encryption Flaws
Chapter 5, Attacks on the WLAN Infrastructure
Chapter 6, Attacking the Client
Chapter 7, Advanced WLAN Attacks
Chapter 8, Attacking WPA-Enterprise and RADIUS
12
Index
Index

Time for action – uncovering hidden SSIDs

Perform the following instructions to get started:

  1. Using Wireshark, if we monitor Beacon frames in the Wireless Lab network, we are able to see the SSID in plain text. You should see Beacon frames, as shown in the following screenshot:
    Time for action – uncovering hidden SSIDs
  2. Configure your access point to set the Wireless Lab network as a hidden SSID. The configuration option to do this may differ across access points. In my case, I need to check the Invisible option in the Visibility Status option, as shown in the following screenshot:
    Time for action – uncovering hidden SSIDs
  3. Now if you take a look at the Wireshark trace, you will find that the SSID Wireless Lab has disappeared from the Beacon frames. This is what hidden SSIDs are all about:
    Time for action – uncovering hidden SSIDs
  4. In order to bypass Beacon frames, we will first use the passive technique of waiting for a legitimate client to connect the access point. This will generate probe request and probe response packets that will contain the SSID of the network, thus revealing its presence:
    Time for action – uncovering hidden SSIDs
  5. Alternately, you...

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
Start a 7-day FREE trial
End of Section 3
Next Section
bookmark search playlist download
font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete