Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Kali Linux Wireless Penetration Testing Beginner???s Guide
Kali Linux Wireless Penetration Testing Beginner???s Guide

Kali Linux Wireless Penetration Testing Beginner???s Guide: Master wireless testing techniques to survey and attack wireless networks with Kali Linux, including the KRACK attack , Third Edition

Arrow left icon
Profile Icon Dieterle Profile Icon Cameron Buchanan Profile Icon Vivek Ramachandran
Arrow right icon
€8.99 €23.99
Full star icon Full star icon Full star icon Full star icon Half star icon 4.6 (12 Ratings)
eBook Dec 2017 210 pages 3rd Edition
eBook
€8.99 €23.99
Paperback
€29.99
Subscription
Free Trial
Renews at €18.99p/m
Arrow left icon
Profile Icon Dieterle Profile Icon Cameron Buchanan Profile Icon Vivek Ramachandran
Arrow right icon
€8.99 €23.99
Full star icon Full star icon Full star icon Full star icon Half star icon 4.6 (12 Ratings)
eBook Dec 2017 210 pages 3rd Edition
eBook
€8.99 €23.99
Paperback
€29.99
Subscription
Free Trial
Renews at €18.99p/m
eBook
€8.99 €23.99
Paperback
€29.99
Subscription
Free Trial
Renews at €18.99p/m

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
OR
Modal Close icon
Payment Processing...
tick Completed

Billing Address

Table of content icon View table of contents Preview book icon Preview Book

Kali Linux Wireless Penetration Testing Beginner???s Guide

Chapter 2. WLAN and Its Inherent Insecurities

 

"The loftier the building, the deeper the foundation must be laid."

 
 --Thomas Kempis

Nothing great can be built on a weak foundation, and in our context, nothing secure can be built on something that is inherently insecure.

WLANs, by design, have certain insecurities that are relatively easy to exploit, for example, by packet spoofing, packet injection, and sniffing (this could even happen from far away). We will explore these flaws in this chapter.

In this chapter, we shall look at the following:

  • Revisiting WLAN frames
  • Different frame types and subtypes
  • Using Wireshark to sniff management, control, and data frames
  • Sniffing data packets for a given wireless network
  • Injecting packets into a given wireless network

Let's get started!

Revisiting WLAN frames

As this book deals with the security aspects of wireless, we will assume that you already have a basic understanding of the protocol and the packet headers. If not, or if it's been some time since you worked on wireless, this would be a good time to revisit this topic again.

Let's now quickly review some basic concepts of WLANs that most of you may already be aware of. In WLANs, communication happens over frames. A frame would have the following header structure:

Revisiting WLAN frames

The Frame Control field itself has a more complex structure:

Revisiting WLAN frames

The Type field defines three types of WLAN frame:

  • Management frames: Management frames are responsible for maintaining communication between access points and wireless clients. Management frames can have the following subtypes:
    • Authentication
    • Deauthentication
    • Association request
    • Association response
    • Reassociation request
    • Reassociation response
    • Disassociation
    • Beacon
    • Probe request
    • Probe response
  • Control frames: Control frames are responsible for ensuring...

Time for action – creating a monitor mode interface

Let's now set our wireless adapter to monitor mode.

Follow these instructions to get started:

  1. Boot Kali with your adapter connected. Once you are within the console, enter iwconfig to confirm that your card has been detected and the driver has been loaded properly:
    Time for action – creating a monitor mode interface
  2. Use the ifconfig wlan0 up command to bring the card up (where wlan0 is your adapter). Verify whether the card is up by running ifconfig wlan0. You should see the word UP in the first line of the output as shown in the following screenshot:
    Time for action – creating a monitor mode interface
  3. To put our card into monitor mode, we will use the airmon-ng utility that is available by default on Kali. First run the airmon-ng command to verify whether it detects the available cards. You should see the wlan0 or wlan1 interface listed in the output:
    Time for action – creating a monitor mode interface
  4. Now enter the airmon-ng start wlan0 command to create a monitor mode interface corresponding to the wlan0 device. This new monitor mode interface will be named wlan0mon. (You can verify...

Time for action – sniffing wireless packets

Follow the following instructions to begin sniffing packets:

  1. Power up the access point Wireless Lab that we configured in Chapter 1, Wireless Lab Setup.
  2. Start Wireshark by typing Wireshark & in the console. Once Wireshark is running, navigate to Capture | Options:
    Time for action – sniffing wireless packets
  3. Select packet capture from the wlan0mon interface by clicking on the Start button at the bottom right of the interface as shown in the previous screenshot. Wireshark will begin the capture, and now you should see packets within the Wireshark window.
    Time for action – sniffing wireless packets
  4. These are wireless packets that your wireless adapter is sniffing off the air. In order to view any packet, select it in the top window and the entire packet will be displayed in the middle window.
    Time for action – sniffing wireless packets

    Click on the triangle in front of IEEE 802.11 Wireless LAN management frame to expand and view additional information.

Look at the different header fields in the packet and correlate them with the WLAN frame types and subtypes you learned...

Time for action – viewing management, control, and data frames

Now we will learn how to apply filters in Wireshark to look at management, control, and data frames.

Please follow these instructions step by step:

  1. To view all the management frames in the packets being captured, enter the filter wlan.fc.type == 0 into the filter window and hit Enter. You can stop the packet capture if you want to prevent the packets from scrolling down too fast.
    Time for action – viewing management, control, and data frames
  2. To view control frames, modify the filter expression to read wlan.fc.type == 1:
    Time for action – viewing management, control, and data frames
  3. To view data frames, modify the filter expression to wlan.fc.type == 2:
    Time for action – viewing management, control, and data frames
  4. To additionally select a subtype, use the wlan.fc.subtype filter. For example, to view all the beacon frames among all management frames, use the following filter:
    (wlan.fc.type == 0) && (wlan.fc.subtype == 8)
    Time for action – viewing management, control, and data frames
  5. Alternatively, you can right-click on any of the header fields in the middle window and then select Apply as Filter | Selected to add it as a filter:
    Time for action – viewing management, control, and data frames
  6. This will automatically add the correct...

Time for action – sniffing data packets for our network

In this exercise, we will learn how to sniff data packets for a given wireless network. For the sake of simplicity, we will look at packets without any encryption.

Follow these instructions to get started:

  1. Switch on the access point we named Wireless Lab. Let it remain configured to use no encryption.
  2. We will first need to find the channel on which the Wireless Lab access point is running. To do this, open a terminal and run airodump-ng --bssid <mac> wlan0mon, where <mac> is the MAC address of our access point. Let the program run, and shortly you should see your access point shown on the screen along with the channel it is running on.
  3. We can see from the preceding screenshot that our access point Wireless Lab is running on channel 11. Note that this may be different for your access point.

    In order to sniff data packets going to and from this access point, we need to lock our wireless card on the same channel, that is...

Time for action – packet injection

We will be using the aireplay-ng tool, which is available in Kali, for this exercise.

Follow these instructions carefully:

  1. In order to do an injection test, first start Wireshark and the filter expression (wlan.bssid == <mac>) && !(wlan.fc.type_subtype == 0x08). This will ensure that we only see non-beacon packets for our lab network.
  2. Now run the aireplay-ng -9 -e Wireless Lab -a <mac> wlan0mon command in a terminal.
  3. Go back to Wireshark and you should see a lot of packets on the screen now. Some of these packets have been sent by aireplay-ng, which we launched, and others are from the access point Wireless Lab in response to the injected packets.

What just happened?

We just successfully injected packets into our test lab network using aireplay-ng. It is important to note that our card injected these arbitrary packets into the network without being actually connected to the access point Wireless Lab.

Have a go hero – installing...

Important note on WLAN sniffing and injection

WLANs typically operate within three different frequency ranges—2.4 GHz, 3.6 GHz, and 4.9/5.0 GHz. Not all Wi-Fi cards support all these ranges and associated bands. For instance, older Alfa cards only support IEEE 802.11b/g. This would mean that these cards cannot operate in 802.11a/n. The key here is to sniff or inject packets in a particular band; your Wi-Fi card will need to support it.

Another interesting aspect of Wi-Fi is that, in each of these bands, there are multiple channels. It is important to note that your Wi-Fi card can only be on one channel at any given moment. It is not possible to tune into multiple channels at the same time. The best analogy I can give you is your car radio. You can tune it to only one of the available channels at any given time. If you want to hear something else, you will have to change the channel. The same principle applies to WLAN sniffing. This brings us to an important conclusion—we cannot...

Revisiting WLAN frames


As this book deals with the security aspects of wireless, we will assume that you already have a basic understanding of the protocol and the packet headers. If not, or if it's been some time since you worked on wireless, this would be a good time to revisit this topic again.

Let's now quickly review some basic concepts of WLANs that most of you may already be aware of. In WLANs, communication happens over frames. A frame would have the following header structure:

The Frame Control field itself has a more complex structure:

The Type field defines three types of WLAN frame:

  • Management frames: Management frames are responsible for maintaining communication between access points and wireless clients. Management frames can have the following subtypes:

    • Authentication

    • Deauthentication

    • Association request

    • Association response

    • Reassociation request

    • Reassociation response

    • Disassociation

    • Beacon

    • Probe request

    • Probe response

  • Control frames: Control frames are responsible for ensuring a proper...

Time for action – creating a monitor mode interface


Let's now set our wireless adapter to monitor mode.

Follow these instructions to get started:

  1. Boot Kali with your adapter connected. Once you are within the console, enter iwconfig to confirm that your card has been detected and the driver has been loaded properly:

  2. Use the ifconfig wlan0 up command to bring the card up (where wlan0 is your adapter). Verify whether the card is up by running ifconfig wlan0. You should see the word UP in the first line of the output as shown in the following screenshot:

  3. To put our card into monitor mode, we will use the airmon-ng utility that is available by default on Kali. First run the airmon-ng command to verify whether it detects the available cards. You should see the wlan0 or wlan1 interface listed in the output:

  4. Now enter the airmon-ng start wlan0 command to create a monitor mode interface corresponding to the wlan0 device. This new monitor mode interface will be named wlan0mon. (You can verify if it has...

Left arrow icon Right arrow icon

Key benefits

  • • Learn wireless penetration testing with Kali Linux
  • • Detect hidden wireless networks and discover their names
  • • Explore advanced Wi-Fi hacking techniques including rogue access point hosting and probe sniffing
  • • Develop your encryption cracking skills and gain an insight into the methods used by attackers and the underlying technologies that facilitate these attacks

Description

As wireless networks become ubiquitous in our lives, wireless penetration testing has become a key skill in the repertoire of the professional penetration tester. This has been highlighted again recently with the discovery of the KRACK attack which enables attackers to potentially break into Wi-Fi networks encrypted with WPA2. The Kali Linux security distribution comes with a myriad of tools used for networking attacks and detecting security loopholes. Kali Linux Wireless Penetration Testing Beginner's Guide, Third Edition has been updated to Kali Linux 2017.3 with the latest methodologies, including full coverage of the KRACK attack and how to defend against it. The book presents wireless pentesting from the ground up, introducing all elements of penetration testing with each new technology. You'll learn various wireless testing methodologies by example, from the basics of wireless routing and encryption through to detailed coverage of hacking methods and attacks such as the Hirte and Caffe Latte.

Who is this book for?

Kali Linux Wireless Penetration Testing Beginner's Guide, Third Edition is suitable for anyone who wants to learn more about pentesting and how to understand and defend against the latest wireless network attacks.

What you will learn

  • • Understand the KRACK attack in full detail
  • • Create a wireless lab for your experiments
  • • Sniff out wireless packets, hidden networks, and SSIDs
  • • Capture and crack WPA-2 keys
  • • Sniff probe requests and track users through their SSID history
  • • Attack radius authentication systems
  • • Sniff wireless traffic and collect interesting data
  • • Decrypt encrypted traffic with stolen keys

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : Dec 28, 2017
Length: 210 pages
Edition : 3rd
Language : English
ISBN-13 : 9781788622745
Vendor :
Offensive Security
Category :
Tools :

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
OR
Modal Close icon
Payment Processing...
tick Completed

Billing Address

Product Details

Publication date : Dec 28, 2017
Length: 210 pages
Edition : 3rd
Language : English
ISBN-13 : 9781788622745
Vendor :
Offensive Security
Category :
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
€18.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
€189.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts
€264.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total 95.97
Kali Linux Wireless Penetration Testing Cookbook
€32.99
Kali Linux Wireless Penetration Testing Beginner???s Guide
€29.99
Digital Forensics with Kali Linux
€32.99
Total 95.97 Stars icon
Banner background image

Table of Contents

13 Chapters
1. Wireless Lab Setup Chevron down icon Chevron up icon
2. WLAN and Its Inherent Insecurities Chevron down icon Chevron up icon
3. Bypassing WLAN Authentication Chevron down icon Chevron up icon
4. WLAN Encryption Flaws Chevron down icon Chevron up icon
5. Attacks on the WLAN Infrastructure Chevron down icon Chevron up icon
6. Attacking the Client Chevron down icon Chevron up icon
7. Advanced WLAN Attacks Chevron down icon Chevron up icon
8. KRACK Attacks Chevron down icon Chevron up icon
9. Attacking WPA-Enterprise and RADIUS Chevron down icon Chevron up icon
10. WLAN Penetration Testing Methodology Chevron down icon Chevron up icon
11. WPS and Probes Chevron down icon Chevron up icon
A. Pop Quiz Answers Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon

Customer reviews

Top Reviews
Rating distribution
Full star icon Full star icon Full star icon Full star icon Half star icon 4.6
(12 Ratings)
5 star 75%
4 star 8.3%
3 star 16.7%
2 star 0%
1 star 0%
Filter icon Filter
Top Reviews

Filter reviews by




Amazon Customer Sep 16, 2018
Full star icon Full star icon Full star icon Full star icon Full star icon 5
For basic technical fact it's amazing book
Amazon Verified review Amazon
Ninos I. Jul 14, 2021
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Sehr lehrreiches Buch, mit step für step Erklärungen für nahezu alle WiFi hacks
Amazon Verified review Amazon
M Jan 25, 2018
Full star icon Full star icon Full star icon Full star icon Full star icon 5
I would definitely recommend this book. It is well explained and easy to follow.
Amazon Verified review Amazon
Sandesh More Nov 24, 2018
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Really a good book with great contents ....Really helpful for beginner's
Amazon Verified review Amazon
A. Marx Jan 24, 2021
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Wenn man sein Kali schon am Laufen hat und den passenden Wirelessadapter hat (z.B. von Alfa) dann kann es losgehen. Man sollte nicht erwarten, dass man alle Netzwerke in der Nachbarschaft mitlesen kann. Aber man bekommt eine gute Anleitung, was man sehen kann und was andere sehen könn(t)en.
Amazon Verified review Amazon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

How do I buy and download an eBook? Chevron down icon Chevron up icon

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

  • You may make copies of your eBook for your own use onto any machine
  • You may not pass copies of the eBook on to anyone else
How can I make a purchase on your website? Chevron down icon Chevron up icon

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

  1. Register on our website using your email address and the password.
  2. Search for the title by name or ISBN using the search option.
  3. Select the title you want to purchase.
  4. Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title. 
  5. Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)
Where can I access support around an eBook? Chevron down icon Chevron up icon
  • If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
  • To view the errata for the book, see www.packtpub.com/support and view the pages for the title you have.
  • To view your account details or to download a new copy of the book go to www.packtpub.com/account
  • To contact us directly if a problem is not resolved, use www.packtpub.com/contact-us
What eBook formats do Packt support? Chevron down icon Chevron up icon

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks? Chevron down icon Chevron up icon
  • You can get the information you need immediately
  • You can easily take them with you on a laptop
  • You can download them an unlimited number of times
  • You can print them out
  • They are copy-paste enabled
  • They are searchable
  • There is no password protection
  • They are lower price than print
  • They save resources and space
What is an eBook? Chevron down icon Chevron up icon

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.