Tutorial hacking Wi-Fi wireless networks with Wifislax
Wifislax is a Linux distro based on Slackware to audit wireless networks. In this tutorial we show you how to check the security of different Wi-Fi networks and connect to them with Windows, iOS, Android or the operating system you use
One of the ways that technology enthusiasts have to enter the world of security is by conducting audits of wireless networks. Okay, it's not the same as hacking an FBI database, but it's a start. It is also necessary to keep in mind that, the more we know about the weaknesses of Wi-Fi networks, the better we can protect our home. This should always be the premise when starting to perform these types of procedures: learning. It is good to know how they work and what weaknesses the different wireless networks have to implement better security measures, but all this knowledge should only be used for legitimate purposes.
There are different suites of scripts and programs with graphical interface that we can install in any Linux distribution to analyze the traffic of any network, wired or not. Some of the most famous are Wireshark or Ettercap, which together with other tools such as Angry IP Scanner can help us to know everything we want on any network. However, getting all these tools separately can be a small headache.
There are already different Linux distributions focused on computer security. Some are general purpose such as Kali Linux — formerly known as BackTrack — while others are much more specialized. This is the case of those that are directed solely and exclusively to the audit of wireless networks, although both in these and in the general purpose we will find the tools mentioned above.
In this article we will focus on wifislax, focused on wireless network auditing. We will try to show you what you need and what you must do to be able to hack a Wi-Fi network with it, of course, with the aim of learning and knowing what you should do to reinforce the security of your home wireless. Any misuse you make of this guide is solely and exclusively your responsibility.
What do you need to use wifislax?
First of all you need a wifi adapter with capacity for monitor mode and packet injection. Before getting an ISO image of the distribution, make sure that if you have a wireless network card - either internal or external - it can be used in monitor mode and can be used to perform packet injection. Later we will get to what these things are, but for now you are interested to know which cards can be used with wifislax and which not. You have a complete list of them in the Wireless Security forum.
The following is to download an ISO image of the latest version of wifislax. Once you have it, you have several options: decompress the ISO into a LiveUSB using programs like UNetbootin to use it on your PC, install it on your PC or install it on a virtual machine.
We personally recommend you install wifislax in a virtual machine, mainly for several reasons:
Although it can be used as a general purpose distro, what really interests us are the audit programs. They do not consume many resources, so it is not necessary to do a fresh install on your computer.
If you use your host computer and are using other tools in another operating system, in this way you can continue to make normal use while performing the audit.
Slackware is a veteran distro and wifislax is based on it, but for users unfamiliar with Linux it can be difficult to use and has a third party software library more limited than other distributions.
How to configure the wifislax virtual machine
To have wifislax configured in a virtual machine we first download VirtualBox and install it in our operating system. When we have done it, we open it and click on New. A dialog box will appear, in which we will have to name the virtual machine and specify the type of operating system. In our case we will call it wifislax. As for the type we select Linux and as other Linux version (64-bit).
We click next to assign the amount of RAM that our virtual machine will have. To avoid setbacks I have allocated 2 GB, but less volatile memory can be allocated if necessary.
The next step leads us to the creation of the virtual hard disk. We accept the default values in everything that has to do with this hard drive - there are several steps - and we continue.
The virtual machine will already be created. Now when we start it, the following dialog box will appear asking us for the location of the wifislax ISO image:
We indicate where we have saved it and we can start the system in live mode. This mode allows us to test the operating system without installing it, but it has a problem that we are interested in getting around in order to use wifislax correctly: a LiveUSB, LiveCD or LiveDVD does not have a persistent file system, so any changes we make do not will save.
To install wifislax we have to go to Menu> System> Installation of wifislax> wifislax Installer GUI. From here the process is fully automatic and the installer will do everything for us. First you will install the operating system and then the boot loader GRUB2. When you have finished installing everything, if we restart the virtual machine we will already have a perfectly operational wifislax.
How to use wifislax to audit wireless networks
Before getting into the subject of network auditing in wifislax, it should be clarified that there are two types of tools: manual and automatic. Some run in text mode, while others have a graphical interface itself. Next we will discuss how they work and how these tools are used.
Aircrack-ng, the best tool to audit Wi-Fi networks
The Linux terminal is a very powerful tool. Thanks to her we can perform administrative tasks spinning very, very fine. No graphical tool can go so far. It costs more to type an instruction in the terminal than to make a few clicks, okay, but you can go much further by typing than by clicking.
The same thing happens with wireless network auditing. Aircrack-ng is a network audit suite for the terminal, but it is incredibly powerful and allows us to perform a wide spectrum of tests to know how well or poorly protected a wireless network is.
To start using Aircrack-ng first it is necessary to place the Wi-Fi network card in monitor mode, something that we already mentioned before. This means that the card can scan your environment to detect as many networks as are within your reach. It is done by the following command:
airmon-ng start wlanX
Where X is the number assigned to our wlan wireless interface. If we have more than one the first one will be assigned zero, the second one 1 and so on. We can see our wireless network cards with the iwconfig command. The output that should be returned to us by airmon-ng would be something like this:
The next thing is to scan the environment for Wi-Fi networks. For this we use the following command:
airodump-ng monX
Where X is the number assigned to the monitor that the card is converted to - generally it is mon0. It is convenient to let the card scan the environment for a few minutes. Once we have enough information, we look at the one with the highest PWR parameter. This parameter appears with a negative value, which should be remembered that the closer to zero this value is, the greater it is - in other words, -1 is greater than -40. This allows us to know which network has the highest intensity, making it a good candidate to start an audit.
This means that we must look at the BSSID - MAC address of the wireless network - and the channel in which it is located. Now we will have to make a much more detailed scanner, including parameters such as the aforementioned BSSID or the network channel, as well as a capture file of all the data on that network. The command we will use will be such that:
airodump-ng -c --bssid -w monX
The output that should return the screen should be something similar to this:
The different types of Aircrack-ng attack
It is also convenient to let the scanner take its time so that as much data can be accumulated as possible, since this will make the task of running attack tests much easier. It should also be clarified that, depending on the type of encryption of the network password, we must proceed in different ways:
If it is a password encrypted using WEP, it will be necessary to unauthenticate a client and authenticate as a false client before attempting to attack by injecting ARP packets.
If it is an encrypted password using WPA or WPA2 we will not be able to resort to false authentication, so we will have to try to get ARP packets directly attacking a legitimate client.
That said, it is worth mentioning that Aircrack-ng has at its disposal five types of attack, each with different characteristics:
Attack 0: It is used to unauthenticate a client connected to the network we are attacking. It is used for networks with WEP and WPA encryption.
Attack 1: it is used to create a fake client that connects to the network in which we have disauthenticated a legitimate client. It is the gateway to the rest of attacks when dealing with a network with WEP encryption, since in WPA it does not work and it is necessary to try to attack using a legitimate client.
Attack 2: allows us to inject ARP packets into a network to try to get the encrypted wifi key. With this type of attack we choose which package we will try to reinject.
Attack 3: performs automatic injection of ARP packages and is the most effective when dealing with a legitimate connected client. When we launch the attack, you try to get an ARP package from that client, and as soon as you have it, it will start to re-inject it automatically.
Attack 4: What it does is launch a saturation attack on the target router. Today it is very ineffective, because the routers identify the attack as such and do not return any response.
To carry out these attacks we will have to open a new terminal, since airodump-ng will continue scanning until we tell it to stop and it is convenient for us to continue doing so while we carry out the different attacks so that it also captures how the target network responds.
How to perform attack tests on WEP ciphers
It should be clarified for those who do not know that WEP encryption is weaker than WPA. The security of Wi-Fi networks protected with this type of encryption is not very high, since they are “relatively easy” to break.
To be able to run an attack test on a network whose key is protected with WEP encryption, we must first unauthenticate a client connected to the access point we are attacking - it also serves with WPA networks. This is done with the following command:
aireplay-ng -0 X -a -c monX
Where -0 indicates the type of attack that we are going to carry out - a disconnection of a connected client - and X the number of times we are going to launch it. If we set the value to zero it will do so indefinitely.
The next thing is to authenticate as a fake client. For this we use this instruction:
aireplay-ng -1 0 -e -a -h monX
Once we have achieved it, we can begin to inject ARP packages. For this we use the following command
aireplay-ng -3 -b -h monX
The MAC of the fake client will be determined by that of our network card - which we can know using the ifconfig command. It is advisable to allow a reasonable amount of time to pass until we finally have ARP packets with which to try to decipher the network key, the more the better. As for how to get it, we'll talk about it later.
How to perform attack tests on WPA ciphers
As we stated before, WPA is a security encryption greater than WEP. Deciphering the password of a Wi-Fi network protected by this type of encryption takes a long time, which may require several attempts until it is finally achieved.
The procedure to follow is very similar to the one explained above. First we unauthenticate a connected client to obtain the handshake with the command that we already explained:
aireplay-ng -0 X -a -c monX
Now, if we try to authenticate a fake client, the script will return an error message. To try to decipher a WPA key, once the client has failed to authenticate, it is necessary to try to inject ARP packets into a legitimate one instead of a false one. For this we use attack 3 again, but with a slight variation:
aireplay-ng -3 -b -h monX
Again we let the script work for a while. The next step is to try to decipher the Wi-Fi network key, which we will now explain.
How to hack the Wi-Fi network password
We arrive at the crux of the matter: to know if all the work and the time invested have served for something. Your PC has stuck a few hours trying to get enough data to decipher the password of the Wi-Fi network on which you are running the tests, so you have to know if what we have is enough. For this we will use the following command for WEP encryption:
aircrack-ng -b .cap
The thing is a bit complicated in the case of WPA encryption but the command is basically the same:
aircrack-ng -b -w .cap
The really thorny issue is the generation of a dictionary for WPA encryption. In wifislax there are scripts that will generate one for you automatically, but they can take a long, long time. At the time of writing this guide, the script I used took more than a year to give me a complete dictionary to use. On the other hand, you can try to get one already created on the Internet that makes things easier for you.
If everything is as it should, Aircrack-ng should show you the Wi-Fi network key.
Automatic network auditing tools
wifislax is equipped with a multitude of automatic audit scripts that will solve in a few steps the entire process just discussed. Even Aircrack-ng has its own automatic process that eliminates the need to use all these commands, although I personally find that executing the commands manually is much more effective - we have already talked about how powerful the Linux terminal is.
In this sense, the automatic tool that worked best for me is wifi-Eye. The need to have a dictionary saved to decipher the WPA network key is imperative, there is no way to get rid of it. Now, it is a script adaptation of the entire Aircrack-ng suite very well done and that works great.
This tool not only allows audits of wireless networks, but also allows interception of communications through man-in-the-middle or MITM attacks. If you have a word dictionary to work with, WiFi-Eye will make your process much easier.