Hack to the Future

day four. kali linux and other pentesting tools

{ Kali Linux }

• Kali Linux is a Debian-based distribution
• Comes loaded with pentesting and digital forensics tools
  • Penetration testing is the testing of computer/system security by hacking into it
  • Very advanced and difficult to use for a GNU/Linux beginner
• We'll be installing it in a virtual machine
  • Follow along and do everything I do EXACTLY as I do it

Reality check!

:)

{ REAL-life programming }

• Very difficult
• Takes very long
• Critical thinking/problem solving
• Lots of hard work and frustration
• Nothing like what you've done so far. :)
  • Especially not in Minecraft class or SYWMAA
• Usually not fun until you reach a high level

{ but wait! what if all i want to do is make games??? }

{ demonstration time! }

{ pseudo-programmers }

• Don't understand how anything actually works 
• Just knows how to code and "make things happen"
• Not a lot of money
• Difficulty finding jobs because there's so many of them out there
  • ex.  Someone we all know ...

{ real hackers vs. script kiddies }

• Real hackers have to be good at programming
• The difference between real hackers and script kiddies is that hackers can actually make their own tools
  • ​This is why you have to actually learn Python
• Script kiddies just use the tools that others have made
  • When you hack your way into a system, those tools won't be available and you'll have to code your own

{ Team Function Review! }

Write a function overlapping() that takes in two lists as parameters. If the two lists have any elements in common, the function returns True. False if there are no common elements.

{ Team Function Review! }

Write a function that takes in a list of numbers that must be at least size 4 (the function should not continue if there aren't at least 4 elements). Return the mean (average) of the numbers in the list.

{ pipelines }

• Pipe operator | (vertical bar) pipes the standard output of one command into the standard input of another
• command1 | command2
• Commands used on the pipeline to change the input before outputting it are called filters
  • sort combines multiple outputs into a single, sorted one
    • ls /bin /usr/bin | sort | less
  • uniq omits/reports repeated lines
    • ls /bin /usr/bin | sort | uniq | less
    • ls /bin /usr/bin | sort | uniq -d | less
  • wc prints the number of lines, words, and bytes
  • grep searches a file and prints lines matching a pattern
    • grep "full name" thisIsAFile.py
    • ls /bin /usr/bin | grep zip

{ WiFi security }

• Most WiFi networks are secured with different password algorithms
• Wired Equivalent Privacy (WEP)
  • Uses a single shared key among users
  • 40 bit encryption key
  • Very insecure (FBI cracked it in less than 3 minutes with publicly available tools)
    • Any kid with a laptop == gg ez no re
  • Make sure you don't use it

{ aircrack-ng }

• aircrack-ng is a WiFi password key cracking program
  • Works best with WEP keys
  • Captures encrypted packets and uses them to crack the pre-shared key
• Network packets
  • Unit of collection of data that is transferred over a wireless network (for example, the internet)

{ aircrack-ng }

• Find out the name of your wireless adapter interface
  • ifconfig and look for the wireless interface
    • ex. wlan0 or wlp3s0
• Enable monitor mode

  • sudo airmon-ng start interface

  • Creates a virtual interface named mon0 to capture packets

{ aircrack-ng }

• Start capturing packets

  • sudo airodump-ng mon0​

  • Captures packets in the air to show list of wireless networks (find the name of the WiFi you want to hack)
  • This step is not necessary
• Store the captured packets in a file
  • sudo airodump-ng wlan0mon --write filename
  • Captures packets which will be stored in filename.cap
  • Wait until you have enough data (10000 minimum)

{ aircrack-ng }

• Crack the WiFi

  • sudo aircrack-ng filename.cap

  • The program will prompt you to select the name of the WiFi
    • Choose it and aircrack-ng will do its job
  • If the password isn't weak enough, the program will need to obtain more packets
• You'll obtain the key, usually in this format:
  • xx:xx:xx:xx:xx
  • Remove the colons:
    • xxxxxxxxxx is the password of the network

{ troubleshooting issues }

• If the monitor isn't working, reset it and turn on the monitoring:
  • ifconfig wlan0mon down
  • iwconfig wlan0mon mode monitor
  • ifconfig wlan0mon up
  • ALSO
  • ifconfig to find mon#
  • airmon-ng stop mon#

{ WPA l & ll }

• WiFi Protected Access (WPA/WPA2)
  • Uses a more complex passphrase algorithm
  • 128 bit encryption key
  • Message integrity check so packets can't be altered
  • Dictionary attack could take days, or even years depending on the password
  • Incredibly difficult to configure or use

{ WPA l & ll }

• WiFi Protected Setup (WPS)
  • Supposed to make it tougher to crack
  • Easier for the users to configure
  • Push a button on router and device connects
  • Modern routers enable it by default
• WPS has the user send 8 digit pins (numbers) to connect
  • Normally it would take years to crack
  • However, the pin number's setup makes it easier to brute force; split verification in half

{ reaver }

• Reaver is a tool that performs a brute force attack against WPS
  • Cracks the WPS pin within hours
  • Recovers the WPA/WPA2 passphrase from that WPS pin
  • Only takes 11,000 attempts to guess the pin
    • Instead of 364,000 - 100,000,000 attempts
• Change your password around every 3 months

{ reaver }

• If you have already have the information you need:

  • reaver -i <interface-name> -b <BSSID of target>

  • Take a (very long) nap and it'll be done in 6 - 16 hours on average
• However, you most likely won't have the info so follow along!

{ reaver }

• Find out if the network has WPS enabled
  • Start wireless interface in monitor mode

    • sudo airmon-ng start interface

  • ​​sudo wash -i mon0

    • If it doesn't work: sudo airodump-ng mon0
      • Assume WPS is enabled for WPA/WPA2
  • Regardless of which command you use, there'll be a BSSID column (format: XX:XX:XX:XX:XX:XX)
    • Copy it

{ reaver }

• Now use Reaver to crack it

  • sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -w

  • -i indicates the interface used (we created mon0)
  • -b specifies the BSSID of the network
    • BSSID is the MAC address of the wireless access point (unique identifier on the network for the hardware)
  • -w increases the verbosity of the tool, so it tells you what's going on
  • Wait a few hours and then we'll continue

{ what have we learned? }

{ more bash! }

• Basic networking
  • ping <IP Address/domain name> to send a special packet to a network host to check if your computer can establish a connection
    • Interrupt to check if there is any packet data loss
  • traceroute to trace the path of a network packet as it tries to get to the host
    • Packets usually "hops" through network traffic to reach its destination
  • netstat to examine network settings & statistics
    • -ie option for local, -r for routing table

{ TFR }

Write a function that takes in an integer as a parameter, and returns True if a number is prime and False if it is not.

{ survey time! }

https://www.surveymonkey.com/r/DWLHWKC