Wireless Attacks

Methodologie

# Detecting wireless card name
iwconfig
# Airmon-ng enabling monitor mode on wlan0
sudo airmon-ng start wlan0
# Scan 2.4GHz and 5GHz 
sudo airodump-ng wlan0mon --manufacturer --wps --band abg
# Targeted scan : fix chanel, see clients and encryption
sudo airmon-ng start wlan0 3
sudo airodump-ng -c 3 --bssid 34:08:04:09:3D:38 -w wifi-it wlan0mon
cat wifi-it.csv

Wi-Fi Attack Map

# Wi-Fi Encryption
WEP   => RC4
WPA   => Temporal Key Integrity Protocol (TKIP)
WPA 2 => Counter Mode with CBC-MAC (CCMP)

WPA encryption comes in two flavors:
- WPA Personal: Makes use of pre-shared key authentication WPA-PSK, a passphrase shared by all peers of the network.
- WPA Enterprise: Uses 802.1X and a Radius server for Authentication, Authorization, and Accounting AAA.

Wi-Fi Attack Map
├── WEP
│   ├── AUTH = OPN
│   │   ├── With client
│   │   │   ├── # ARP Request Replay Attack
│   │   │   ├── # Fragmentation Attack
│   │   │   ├── # Korek Chop Chop Attack
│   │   │   ├── # Interactive Packet Replay Attack
│   │   │   ├── # Cafe Latte Attack
│   │   │   └── # Deauthentication Attack
│   │   └── Without client
│   │       └── # Fake Authentication
│   │           ├── → Fragmentation Attack  → ARP Request Replay Attack
│   │           └── → Korek ChopChop Attack → ARP Request Replay Attack
│   └── AUTH = SKA
│       └── With client (required)
│           ├── # Deauthentication Attack        (capture SKA keystream)
│           ├── # Fake Shared Key Authentication (replay captured keystream)
│           └── # ARP Request Replay Attack      (generate IVs)
├── WPA2-PSK
│   ├── WPS enabled
│   │   └── # WPS PIN Attack (Reaver / Bully)
│   ├── With client
│   │   └── # Deauthentication Attack → capture 4-way handshake
│   ├── Without client
│   │   └── # PMKID Attack (hcxdumptool) → no handshake needed
└── WPA2-MGT (Enterprise)
    └── # Evil Twin / Rogue AP
        └── hostapd-mana / hostapd-wpe

Troubleshooting

- unloading/reloading the driver with : rmmod, modprobe
- check errors with : dmesg
- airmon-ng check kill
- Aireplay-ng does not Inject Frames : check monitor mode => iw dev wlan0 info , iwconfig wlan0
# start or stop NetworkManager
sudo systemctl start/stop NetworkManager
# Fixing the chanel
sudo airmon-ng start wlan0 3
sudo iwconfig wlan0mon channel 3
sudo iw dev wlan0mon set channel 3

# Manual Network Connections Troubleshooting
# Stop everything that may conflict
sudo systemctl stop NetworkManager
sudo systemctl stop wpa_supplicant
sudo killall wpa_supplicant
# Reset the interface
sudo ip link set wlan2 down
sudo ip addr flush dev wlan2
sudo ip link set wlan2 up

Ressource

https://wigle.net    # All the networks. Found by Everyone
# Tools

# Notes and cheatsheets for OSWP
https://github.com/iPhantasmic/OSWP
https://www.emmanuelsolis.com/oswp
https://github.com/TheH4ck3rDude/OSWP-Exam-Notes/
https://zeyadazima.com/notes/oswplaybook/
# Walkthrough WiFiChallenge Lab
https://r4ulcl.com/posts/walkthrough-wifichallenge-lab-2.0/