Preface

Wireless networks have become ubiquitous in today's world. Millions of people use it worldwide every day at their homes, offices, and public hotspots to log on to the internet and do both personal and professional work. Even though wireless makes life incredibly easy and gives us such great mobility, it comes with its risks. In recent times, insecure wireless networks have been used to break into companies, banks, and government organizations. The frequency of these attacks is only intensified, as network administrators are still clueless on how to secure wireless networks in a robust and fool proof way.

Kali Linux Wireless Penetration Testing Beginner's Guide, Third Edition, is aimed at helping the reader understand the insecurities associated with wireless networks, and how to conduct penetration tests to find and plug them. This is an essential read for those who would like to conduct security audits on wireless networks and always wanted a step-by-step practical guide for this. With this book, your learning will be complete, as every wireless attack explained is immediately followed by a practical demo.

We have chosen Kali Linux as the platform to test all the wireless attacks in this book. Kali Linux, as you might already be aware, is the world's most popular penetration testing distribution. It contains hundreds of security and hacking tools, some of which we will use in this book.

What this book covers

Chapter 1, Wireless Lab Setup, shows how to create a wireless testing lab using off-the-shelf hardware and open source software. In order to be able to try out the dozens of exercises in this book, you will need to set up a wireless lab. We will first look at the hardware requirements, which include wireless cards, antennas, access points, and other Wi-Fi enabled devices. Then we will shift our focus to the software requirements, which include the operating system, Wi-Fi drivers, and security tools. Finally, we will create a test bed for our experiments and verify the different wireless configurations on it.

Chapter 2, WLAN and Its Inherent Insecurities, focuses on inherent design flaws in wireless networks that make insecure out of the box. We will begin with a quick recap of the 802.11 WLAN protocols using a network analyzer called Wireshark. This will give us a practical understanding about how these protocols work. Most importantly, we will see how client and access point communication work at the packer level by analyzing management, control, and data frames. We will then learn about packet injection and packer sniffing in wireless networks, and look at some tools that enable us to do this.

Chapter 3, Bypassing WLAN Authentication, reveals how you can break WLAN authentication mechanism! We will go step by step, and explore how to subvert Open Authentication and Shared Key Authentication. While doing this, you will learn how to analyze wireless packets and figure out the authentication mechanism of the network. We will also look at how to break into networks with Hidden SSID and MAC Filtering enabled. These are two common mechanisms employed by network administrators to make wireless networks more stealthy and difficult to penetrate, however, these are extremely simple to bypass.

Chapter 4, WLAN Encryption Flaws, describes one of the most vulnerable parts of the WLAN protocol, which is the encryption schemas—WEP, WPA, and WPA2. Over the past decade, hackers have found multiple flaws in these schemas and have written publically available software to break them and decrypt the data. Also, even though WPA/WPA2 are secure by design, misconfiguring these opens up security vulnerabilities, which can be easily exploited. In this chapter, you will understand the insecurities in each of these encryption schemas, and you'll perform practical demos on how to break them.

Chapter 5, Attacks on the WLAN Infrastructure, shifts your focus to WLAN infrastructure vulnerabilities. We will look at vulnerabilities created due to both configuration and design problems. We will also do practical demos of attacks, namely access point MAC spoofing, bit flipping and replay attacks, rogue access points, fuzzing, and denial of service. This chapter will you a solid understanding of how to do a penetration test of the WLAN infrastructure.

Chapter 6, Attacking the Client, might open your eyes if you always believed that wireless client security was something you did not have to worry about! Most people exclude the client from their list when they think about WLAN security. This chapter will prove beyond doubt why the client is just as important as the access point when penetration testing a WLAN network. We will look at how to compromise the security using client-side attacks such as misassociation, Caffe Latte, disassociation, ad-hoc connections, fuzzing, and honeypots.

Chapter 7, Advanced WLAN Attacks, looks at more advanced attacks, now that we have already covered most of the basic attacks on both the infrastructure and the client. These attacks typically involve using multiple basic attacks in conjunction to break security in more challenging scenarios. Some of these attacks include wireless device fingerprinting, man-in-the-middle over wireless, evading wireless intrusion detection and prevention systems, and rogue access point operating using custom protocol. This chapter presents the absolute bleeding edge in wireless attacks out in the real world.

Chapter 8, KRACK Attacks, investigates the new set of vulnerabilities discovered in 2017, regarding the WPA2 handshake. Your knowledge of the WPA2 handshake is refreshed and examined in detail to see how these new attacks apply.

Chapter 9, Attacking WPA-Enterprise and RADIUS, graduates you to the next level by introducing advanced attacks on WPA-Enterprise and the RADIUS server set up. These attacks will come in handy when you have to penetration test large enterprise networks that rely on WPA-Enterprise and RADIUS authentication to provide them with security.

Chapter 10, WLAN Penetration Testing Methodology, is where all the learning from the previous chapters comes together, and we will look at how to do a wireless penetration test in a systematic and methodical way. You will learn about the various phases of penetrating testing—Planning, Discovery, Attack, and Reporting, and apply it to wireless penetration testing. We will also understand how to propose recommendations and best practices after a wireless penetration test.

Chapter 11, WPS and Probes, covers the two new attacks in the industry that have developed since the initial publication—WPS brute-force and probe sniffing for monitoring.

What you need for this book

To follow and recreate the practical exercises in this book, you will need two laptops with built in Wi-Fi cards, a USB wireless Wi-Fi adapter, Kali Linux, and some other hardware and software. We have detailed this in Chapter 1, Wireless Lab Setup.

As an alternative to the two laptop setup, you can also create a virtual machine housing Kali Linux and connect the card to it using the USB interface. This will help you get started with using this book much faster, but we would recommend that you use a dedicated machine running Kali Linux for actual assessments in the field.

From a prerequisite perspective, you should be aware of the basics of wireless networks. This includes having prior knowledge about the basics of the 802.11 protocol and client-access point communication. Though we will briefly touch upon some of this when we set up the lab, it is expected that you are already aware of these concepts.

Who this book is for

Though this book is a Beginner's series, it is meant for all levels of users, from amateurs to wireless security experts. There is something for everyone. The book starts with simple attacks and then moves on to explain the more complicated ones, and finally, discusses bleeding edge attacks and research. As all attacks are explained using practical demonstrations, it is very easy for readers at all levels to quickly try out the attacks by themselves. Please note that even though the book highlights the different attacks that can be launched against a wireless network, the real purpose is to educate the user to become a wireless penetration tester. An adept penetration tester will understand all the attacks here and will be able to demonstrate them with ease, if requested by his client.

Sections

In this book, you will find several headings that appear frequently (Time for action, What just happened?, Pop quiz, and Have a go hero).

To give clear instructions on how to complete a procedure or task, we use these sections as follows:

Time for action – heading

1. Action 1

2. Action 2

3. Action 3

Instructions often need some extra explanation to ensure that they make sense, so they are followed with these sections:

What just happened?

This section explains the working of the tasks or instructions that you have just completed.

You will also find some other learning aids in the book, for example:

Pop quiz – heading

These are short multiple-choice questions intended to help you test your own understanding.

Have a go hero – heading

These are practical challenges that give you ideas to experiment with what you have learned.

Conventions

You will also find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "Plug in the card to one of the Kali laptop's USB ports and boot it. Once you log in, open a console terminal and type in iwconfig."

A block of code is set as follows:

import subprocess
import datetime
results = open("results.txt", "a")
while 1:
    cmd = subprocess.check_output(["tshark –n –i wlan0mon –T fields -e wlan.sa –e wlan.ssid –c 100"], shell=True)
    split = cmd.split("\n")
    for value in split[:-1]:
           if value.strip():
                   splitvalue = value.split("\t")
                   MAC = str(splitvalue[0])
                   SSID = str(splitvalue[1])
                   time = str(datetime.datetime.now())
                   results.write(MAC+" "+SSID+" "+time+"\r\n")

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

import subprocess
import datetime
results = open("results.txt", "a")
while 1:
    cmd = subprocess.check_output(["tshark –n –i wlan0mon –T fields -e wlan.sa –e wlan.ssid –c 100"], shell=True)
    split = cmd.split("\n")
    for value in split[:-1]:
           if value.strip():
                   splitvalue = value.split("\t")
                   MAC = str(splitvalue[0])
                   SSID = str(splitvalue[1])
                   time = str(datetime.datetime.now())
                   results.write(MAC+" "+SSID+" "+time+"\r\n")

Any command-line input or output is written as follows:

ifconfig wlan0 up

New terms and important words are shown in bold. Words that you see on the screen, in menus, or dialog boxes, for example, appear in the text like this: "Boot the laptop with this DVD and select the Install from Boot menu option."

Note

Warnings or important notes appear in a box like this.

Note

Tips and tricks appear like this.

Reader feedback

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of.

To send us general feedback, simply email <[e-mail]>, and mention the book's title in the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.

Customer support

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.

Downloading the example code

You can download the example code files for this book from your account at http://www.packtpub.com. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you.

You can download the code files by following these steps:

1. Log in or register to our website using your e-mail address and password.

2. Hover the mouse pointer on the SUPPORT tab at the top.

3. Click on Code Downloads & Errata.

4. Enter the name of the book in the Search box.

5. Select the book for which you're looking to download the code files.

6. Choose from the drop-down menu where you purchased this book from.

7. Click on Code Download.

You can also download the code files by clicking on the Code Files button on the book's webpage at the Packt Publishing website. This page can be accessed by entering the book's name in the Search box. Please note that you need to be logged in to your Packt account.

Once the file is downloaded, please make sure that you unzip or extract the folder using the latest version of:

• WinRAR / 7-Zip for Windows

• Zipeg / iZip / UnRarX for Mac

• 7-Zip / PeaZip for Linux

The code bundle for the book is also hosted on GitHub at https://github.com/PacktPublishing/Kali-Linux-Wireless-Penetration-Testing-Beginners-Guide-Third-Edition. We also have other code bundles from our rich catalog of books and videos available at https://github.com/PacktPublishing/. Check them out!

Downloading the color images of this book

We also provide you with a PDF file that has color images of the screenshots/diagrams used in this book. The color images will help you better understand the changes in the output. You can download this file from https://www.packtpub.com/sites/default/files/downloads/KaliLinuxWirelessPenetrationTestingBeginnersGuideThirdEdition_ColorImages.pdf.

Errata

Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title.

To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear under the Errata section.

Piracy

Piracy of copyrighted material on the internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the internet, please provide us with the location address or website name immediately so that we can pursue a remedy.

Please contact us at <[e-mail]> with a link to the suspected pirated material.

We appreciate your help in protecting our authors and our ability to bring you valuable content.

Questions

If you have a problem with any aspect of this book, you can contact us at <[e-mail]>, and we will do our best to address the problem.