Mastering Kali Linux Wireless Pentesting

Jilumudi Raghu Ram, Brian Sak

• Publisher: Packt Publishing
• Year: 2016
• eBook ISBN: 9781785285561
• Edition: 1
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Test your wireless network's security and master advanced wireless penetration techniques using Kali Linux

About This Book

• Develop your skills using attacks such as wireless cracking, Man-in-the-Middle, and Denial of Service (DOS), as well as extracting sensitive information from wireless networks
• Perform advanced wireless assessment and penetration tests
• Use Embedded Platforms, Raspberry PI, and Android in wireless penetration testing with Kali Linux

Who This Book Is For

If you are an intermediate-level wireless security consultant in Kali Linux and want to be the go-to person for Kali Linux wireless security in your organisation, then this is the book for you. Basic understanding of the core Kali Linux concepts is expected.

What You Will Learn

• Fingerprint wireless networks with the various tools available in Kali Linux
• Learn various techniques to exploit wireless access points using CSRF
• Crack WPA/WPA2/WPS and crack wireless encryption using Rainbow tables more quickly
• Perform man-in-the-middle attack on wireless clients
• Understand client-side attacks, browser exploits, Java vulnerabilities, and social engineering
• Develop advanced sniffing and PCAP analysis skills to extract sensitive information such as DOC, XLS, and PDF documents from wireless networks
• Use Raspberry PI and OpenWrt to perform advanced wireless attacks
• Perform a DOS test using various techniques and tools

In Detail

Kali Linux is a Debian-based Linux distribution designed for digital forensics and penetration testing. It gives access to a large collection of security-related tools for professional security testing - some of the major ones being Nmap, Aircrack-ng, Wireshark, and Metasploit.

This book will take you on a journey where you will learn to master advanced tools and techniques to conduct wireless penetration testing with Kali Linux.

You will begin by gaining an understanding of setting up and optimizing your penetration testing environment for wireless assessments. Then, the book will take you through a typical assessment from reconnaissance, information gathering, and scanning the network through exploitation and data extraction from your target. You will get to know various ways to compromise the wireless network using browser exploits, vulnerabilities in firmware, web-based attacks, client-side exploits, and many other hacking methods. You will also discover how to crack wireless networks with speed, perform man-in-the-middle and DOS attacks, and use Raspberry Pi and Android to expand your assessment methodology.

By the end of this book, you will have mastered using Kali Linux for wireless security assessments and become a more effective penetration tester and consultant.

Style and approach

This book uses a step-by-step approach using real-world attack scenarios to help you master the wireless penetration testing techniques.

Mastering Kali Linux Wireless Pentesting

---

Table of Contents

Mastering Kali Linux Wireless Pentesting

Credits

About the Authors

About the Reviewer

www.PacktPub.com

eBooks, discount offers, and more

Why subscribe?

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Downloading the color images of this book

Errata

Piracy

Questions

1. Wireless Penetration Testing Fundamentals

Wireless communication

Wireless standards

The 2.4 GHz spectrum

The 5 GHz spectrum

Choosing the right equipment

Supported wireless modes

Wireless adapters

Ralink RT3070

Atheros AR9271

Ralink RT3572

Antennas

Omnidirectional antennas

Patch antennas

Yagi antennas

Kali Linux for the wireless pentester

Downloading Virtual Box

Installing Virtual Box

Kali Linux deployment

Mapping the wireless adapter into Kali

Summary

2. Wireless Network Scanning

Wireless network discovery

802.11 network terminology

802.11 configuration modes

802.11 frames

Management frame

Control frames

Data frames

The scanning phase

Passive scanning

Active scanning

Tools of the trade

Airodump-ng

Adding a location to Airodump-ng with GPS

Visually displaying relationships with Airgraph-ng

Discovering Client Probes with Hoover

WPS discovery with Wash

Kismet

Wireshark

Summary

3. Exploiting Wireless Devices

Attacking the firmware

Authentication bypass

CVE-2013-7282

CVE-2013-6026

CVE-2015-7755

Cross-Site Request Forgery

CVE-2014-5437

CVE-2014-8654

CVE-2013-2645

Remote code execution

CVE-2014-9134

Command injection

CVE-2008-1331

Denial of Service

OSVDB-102605

CVE-2009-3836

Information disclosure

CVE-2014-6621

CVE-2014-6622

CVE-2015-0554

Attacking the services

Attacking Telnet

Attacking SSH

Attacking SNMP

CVE-2014-4863: Arris Touchstone DG950A SNMP information disclosure

CVE-2008-7095: Aruba Mobility Controller SNMP community string dislosure

Attacking SNMP

Attacking UPnP

Discovery

Description

Control

UPnP attacks

CVE-2011-4500

CVE-2011-4499

CVE-2011-4501

CVE-2012-5960

Checks on misconfiguration

Summary

4. Wireless Cracking

Overview of different wireless security protocols

Cracking WPA

WPA Personal

Cracking WPA2

Generating rainbow tables

Generating rainbow tables using genpmk

Generating rainbow tables using airolib-ng

Cracking WPS

Cracking 802.1x using hostapd

Summary

5. Man-in-the-Middle Attacks

MAC address Spoofing/ARP poisoning

Rogue DHCP server

Name resolution spoofing

DNS spoofing

Configuring Ettercap for DNS spoofing

NBNS spoofing

Summary

6. Man-in-the-Middle Attacks Using Evil Twin Access Points

Creating virtual access points with Hostapd

Creating virtual access points with airbase-ng

Session hijacking using Tamper Data

An example of session hijacking

Performing session hijacking using Tamper Data

Credential harvesting

Using Ettercap to spoof DNS

Hosting your fake web page

Web-based malware

Creating malicious payload using msfpayload

Hosting the malicious payload on SET

SSL stripping attack

Setting up SSLstrip

Browser AutoPwn

Setting up Metasploit's Browser Autopwn attack

Summary

7. Advanced Wireless Sniffing

Capturing traffic with Wireshark

Decryption using Wireshark

Decrypting and sniffing WEP-encrypted traffic

Decrypting and sniffing WPA-encrypted traffic

Analyzing wireless packet capture

Determining network relationships and configuration

Extracting the most visited sites

Extracting data from unencrypted protocols

Extracting HTTP objects

Merging packet capture files

Summary

8. Denial of Service Attacks

An overview of DoS attacks

Management and control frames

Authentication flood attack

An attack scenario

Scanning for access points

MDK3 setup for authentication flood

The attack summary

The fake beacon flood attack

MDK3 fake beacon flood with a random SSID

MDK3 fake beacon flood with the selected SSID list

The attack summary

Metasploit's fake beacon flood attack

Configuring packet injection support for Metasploit using lorcon

Creating a monitor mode interface

The Metasploit deauthentication flood attack

Identifying the target access points

Attacking the wireless client and AP using Metasploit

The attack summary

The Metasploit CTS/RTS flood attack

The Metasploit setup for an RTS-CTS attack

The attack summary

Summary

9. Wireless Pentesting from Non-Traditional Platforms

Using OpenWrt for wireless assessments

Installing the aircrack-ng suite on OpenWrt

Using Raspberry Pi for wireless assessments

Accessing Kali Linux from a remote location

Using AutoSSH for reverse shell

Powering and concealing your Raspberry Pi or OpenWrt embedded device

Running Kali on Android phones and tablets

Wireless discovery using Android PCAP

Summary

Index

Mastering Kali Linux Wireless Pentesting

Copyright © 2016 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the comp...

Table of contents

• Mastering Kali Linux Wireless Pentesting