Kali Linux Wireless Penetration Testing Beginner???s Guide: Master wireless testing techniques to survey and attack wireless networks with Kali Linux, including the KRACK attack , Third Edition

What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

Kali Linux Wireless Penetration Testing Beginner???s Guide

Chapter 1. Wireless Lab Setup

	"If I had eight hours to chop down a tree, I'd spend six hours sharpening my axe."
	--Abraham Lincoln, 16th US President

Behind every successful execution is hours or days of preparation, and wireless penetration testing is no exception. In this chapter, we will create a wireless lab that we will use for our experiments in this book. Consider this lab as your preparation arena before you dive into real-world penetration testing!

Wireless penetration testing is a practical subject, and it is important to first set up a lab, where we can try out all the different experiments in this book in a safe and controlled environment. It is important that you set up this lab first before moving on in this book.

In this chapter, we will take a look at the following:

Hardware and software requirements
Installing Kali
Setting up an access point and configuring it
Installing the wireless card
Testing connectivity between the laptop and the access point

So let the games begin!

Time for action – installing Kali

Kali is relatively simple to install. We will run Kali by booting it as a live DVD, and then install it on the hard drive.

Perform the following instructions step by step:

Burn the Kali ISO (we are using the Kali 32-bit ISO) you downloaded, onto a bootable DVD.
Boot the laptop with this DVD and select the option Install from Boot menu:
If booting was successful, then you should see an awesome retro screen as shown in the following screenshot:
This installer is similar to the GUI-based installers of most Linux systems and should be simple to follow. Select the appropriate options on every screen and start the installation process. Once the installation is done, restart the machine as prompted and remove the DVD.
Once the machine restarts, a login screen will be displayed. Log in as root and the password is whatever you set it to during the installation process. You should now be logged into your installed version of Kali. Congratulations!
I will change the desktop theme and some settings for this book. Feel free to use your own themes and color settings!

What just happened?

We have successfully installed Kali on the laptop! We will use this laptop as the penetration tester's laptop for all other experiments in this book.

Have a go hero – installing Kali on VirtualBox

We can also install Kali within virtualization software such as VirtualBox. If you don't want to dedicate a full laptop to Kali, this is the best option. Kali's installation process in VirtualBox is exactly the same. The only difference is the pre-setup, which you will have to create in VirtualBox. Have a go at it! You can download VirtualBox from http://www.virtualbox.org.

One of the other ways in which we can install and use Kali is via USB drives. This is particularly useful if you do not want to install on the hard drive, but still want to store persistent data, such as scripts and new tools, on your Kali instance. We encourage you to try this out as well!

Time for action – configuring the access point

Let's begin! We will set the access point up to use Open Authentication (OAuth) with an SSID of Wireless Lab.

Follow these instructions step by step:

Power on the access point, and use an Ethernet cable to connect your laptop to one of the access point's Ethernet ports.
Enter the IP address of the access point configuration terminal in your browser. For TP-Link, it is by default 192.168.1.1. You should consult your access point's setup guide to find its IP address. If you do not have the manuals for the access point, you can also find the IP address by running the route –n command. The gateway IP address is typically the access point's IP. Once you are connected, you should see a configuration portal that looks like the following TP-LINK Wireless N Router WR841N emblazoned screenshot:
Explore the various settings in the portal after logging in, and find the settings related to configuring a new SSID.
Change the SSID to Wireless Lab. Depending on the access point, you may have to reboot it for the settings to change.
Similarly, find the settings related to Wireless Security and change the setting to Disable Security. Disable Security indicates that it is using the Open Authentication mode.
Save the changes to the access point and reboot it, if required. Now your access point should be up-and-running with an SSID, Wireless Lab.

An easy way to verify this is to use the wireless configuration utility in Windows and observe the available networks using the Windows laptop. You should find Wireless Lab as one of the networks in the listing:

Time for action – configuring the access point

What just happened?

We have successfully set up our access point with an SSID, Wireless Lab. It is broadcasting its presence, and this is being picked up by our Windows laptop and others within the Radio Frequency (RF) range of the access point.

Important to note is that we configured our access point in the Open mode, which is the least secure. It is advisable not to connect this access point to the internet for the time being, as anyone within the RF range will be able to use it to access the internet.

Have a go hero – configuring the access point to use WEP and WPA

Play around with the configuration options of your access point. Try to get it up-and-running using encryption schemes such as WEP and WPA/WPA2. We will use these modes in later chapters to illustrate attacks against them.

Time for action – configuring your wireless card

Here we go! Follow these steps to connect your wireless card to the access point:

Let's first see what wireless networks our adapter is currently detecting. Issue the iwlist wlan0 scanning command, and you will find a list of networks in your vicinity:
Keep scrolling down and you should find the Wireless Lab network in this list. In my setup, it is detected as Cell 05; it may be different in yours. The ESSID field contains the network name.
As multiple access points can have the same SSID, verify that the MAC address mentioned in the preceding Address field matches your access point's MAC. A fast and easy way to get the MAC address is underneath the access point or using web-based GUI settings.
Now, issue the iwconfig wlan0 essid "Wireless Lab" command and then iwconfig wlan0 to check the status. If you have successfully connected to the access point, you should see the MAC address of the access point in the Access Point field in the output of iwconfig.
We know that the access point has a management interface IP address 192.168.0.1 from its manual. Alternately, this is the same as the default router IP address when we run the route –n command. Let's set our IP address in the same subnet by issuing the ifconfig wlan0 192.168.0.2 netmask 255.255.255.0 up command. Verify that the command succeeded by typing ifconfig wlan0 and checking the output.
Now let's ping the access point by issuing the ping 192.168.0.1 command. If the network connection has been set up properly, then you should see the responses from the access point. You can additionally issue an arp –a command to verify that the response is coming from the access point. You should see that the MAC address of the IP 192.168.0.1 is the access point's MAC address we noted earlier. It is important to note that some of the more recent access points might have responses to the Internet Control Message Protocol (ICMP) echo request packets disabled. This is typically done to make the access point secure out of the box with only minimal configuration settings available. In such a case, you can try to launch a browser and access the web interface to verify that the connection is up-and-running:
On the access point, we can verify connectivity by looking at the connection logs. As you can see in the following log, the MAC address of the wireless card 4C:0F:6E:70:BD:CB has been logged making DHCP requests from the router:

What just happened?

We just connected to our access point successfully from Kali using our wireless adapter as the wireless device. We also learned how to verify that a connection has been established at both the wireless client and the access point side.

Have a go hero – establishing a connection in a WEP configuration

Here is a challenging exercise for you: set up the access point in a WEP configuration. For each of these, try establishing a connection with the access point using the wireless adapter. Hint: check the manual for the iwconfig command by typing man iwconfig to see how to configure the card to connect to WEP.

Pop quiz – understanding the basics

Q1. After issuing the ifconfig wlan0 command, how do you verify that the wireless card is up and functional?

Q2. Can we run all our experiments using the Kali live CD alone? Can we not install the CD to the hard drive?

Q3. What does the arp –a command show?

Q4. Which tool should we use in Kali to connect to WPA/WPA2 networks?

Key benefits

• Learn wireless penetration testing with Kali Linux

• Detect hidden wireless networks and discover their names

• Explore advanced Wi-Fi hacking techniques including rogue access point hosting and probe sniffing

• Develop your encryption cracking skills and gain an insight into the methods used by attackers and the underlying technologies that facilitate these attacks

Description

As wireless networks become ubiquitous in our lives, wireless penetration testing has become a key skill in the repertoire of the professional penetration tester. This has been highlighted again recently with the discovery of the KRACK attack which enables attackers to potentially break into Wi-Fi networks encrypted with WPA2. The Kali Linux security distribution comes with a myriad of tools used for networking attacks and detecting security loopholes. Kali Linux Wireless Penetration Testing Beginner's Guide, Third Edition has been updated to Kali Linux 2017.3 with the latest methodologies, including full coverage of the KRACK attack and how to defend against it. The book presents wireless pentesting from the ground up, introducing all elements of penetration testing with each new technology. You'll learn various wireless testing methodologies by example, from the basics of wireless routing and encryption through to detailed coverage of hacking methods and attacks such as the Hirte and Caffe Latte.

What you will learn

• Understand the KRACK attack in full detail

• Create a wireless lab for your experiments

• Sniff out wireless packets, hidden networks, and SSIDs

• Capture and crack WPA-2 keys

• Sniff probe requests and track users through their SSID history

• Attack radius authentication systems

• Sniff wireless traffic and collect interesting data

• Decrypt encrypted traffic with stolen keys

What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

Frequently bought together

€32.99

Kali Linux Wireless Penetration Testing Beginner???s Guide

€29.99

Kali Linux Wireless Penetration Testing Cookbook

€32.99

Total € 95.97

Filter reviews by

All

Amazon verified reviews

Amazon Customer Sep 16, 2018

For basic technical fact it's amazing book

Amazon Verified review

Ninos I. Jul 14, 2021

Sehr lehrreiches Buch, mit step für step Erklärungen für nahezu alle WiFi hacks

M Jan 25, 2018

I would definitely recommend this book. It is well explained and easy to follow.

Sandesh More Nov 24, 2018

Really a good book with great contents ....Really helpful for beginner's

A. Marx Jan 24, 2021

Wenn man sein Kali schon am Laufen hat und den passenden Wirelessadapter hat (z.B. von Alfa) dann kann es losgehen. Man sollte nicht erwarten, dass man alle Netzwerke in der Nachbarschaft mitlesen kann. Aber man bekommt eine gute Anleitung, was man sehen kann und was andere sehen könn(t)en.

Kali Linux Wireless Penetration Testing Beginner???s Guide: Master wireless testing techniques to survey and attack wireless networks with Kali Linux, including the KRACK attack , Third Edition

What do you get with eBook?

Kali Linux Wireless Penetration Testing Beginner???s Guide

Chapter 1. Wireless Lab Setup

Hardware requirements

Software requirements

Note

Installing Kali

Time for action – installing Kali

What just happened?

Have a go hero – installing Kali on VirtualBox

Setting up the access point

Time for action – configuring the access point

What just happened?

Have a go hero – configuring the access point to use WEP and WPA

Setting up the wireless card

Time for action – configuring your wireless card

What just happened?

Connecting to the access point

Time for action – configuring your wireless card

What just happened?

Have a go hero – establishing a connection in a WEP configuration

Pop quiz – understanding the basics

Summary

Page 1 of 12

Key benefits

Description

Who is this book for?

What you will learn

Product Details

What do you get with eBook?

Product Details

Frequently bought together

Table of Contents

Recommendations for you

Customer reviews

Filter reviews by

People who bought this also bought

About the 3 authors

FAQs

Kali Linux Wireless Penetration Testing Beginner???s Guide: Master wireless testing techniques to survey and attack wireless networks with Kali Linux, including the KRACK attack , Third Edition

What do you get with eBook?

Contact Details

Billing Address

Key benefits

Description

Who is this book for?

What you will learn

Product Details

What do you get with eBook?

Contact Details

Billing Address

Product Details

Packt Subscriptions

Frequently bought together

Table of Contents

Recommendations for you

Customer reviews

Filter reviews by

People who bought this also bought

About the 3 authors

FAQs