Hello, aspiring ethical hackers. In our previous blogpost on wifi hacking, you learnt everything about wireless networks, their security and different types of attacks. In this article, you will learn about a tool named LinSSID.

LinSSID is a simple graphical tool that can be used to scan and find all the available wireless networks in the vicinity. Let’s see how this tool works. For this, we will be using Kali Linux, as this tool is available by default in its repositories. We will also be needing a wireless adapter that can monitor wireless packets. I am using ALFA AWVS036NHA adapter for this article.

Make sure that you don’t enable monitor mode on the wireless adapter.

When the GUI of LinSSID opens, start scanning by clicking on “Run” button.

Very soon LinSSID will display all the wireless access points available along with their MAC addresses, channel on which they are operatng, type of security they use used and the strength of their signal.

You can also see whether wifi access points are running on 2.4ghz and 5ghz.

From the “view” menu, you can also decide what information about the wifi access point you want to see.

After detecting the available wireless networks, the information can be used to select the wireless access point whose security you want to audit. You can audit its password strength using tools like aircrack, Fern wifi cracker, Besside or wifite. If you want to create a rogue access point or an evil twin, learn how to do them with wifipumpkin or wifi phisher.

Hello, aspiring ethical hackers. In our previous blogpost on Wifi hacking, you learnt about what is a evil twin attack. In this article, you will learn about wifiphisher. Wifi phisher is a rogue access point and evil twin creation framework for conducting wireless security testing. Let’s see how this tool works. For this, we will be using Kali Linux as wifiphisher is available by default in its repositories. We will also be needing a wireless adapter that can monitor wireless packets. I am using ALFA AWVS036NHA adapter for this article.

Note that Wifi phisher needs root privileges to work.

After starting, wifi phisher starts scanning for all the access points it can detect.

Select the wifi access point you want to target. For example, here I select “Hackercool Labs”. Then, this tool will display the available phishing scenarios (Actually, there’s only one here). Select it.

Then this tool will create a evil twin of this network.

This is how it looks for any client or users trying to to connect to “Hackercool_Labs” access point.

Wifi phisher tries to de-authenticate all clients connected to the genuine access point.

You can see the connected clients.

When any of the clients tries to connect to the evil twin instead of genuine access point, he will be asked to type password of the genuine access point as shown below.

Wifi phisher will log all HTTP requests. So you can see password the user is typing.

Next, learn about wifipumpkin, another powerful wifi rogue access point framework.

Hello, aspiring ethical hackers. In our previous blogpost on WiFi hacking, you learnt about different ways wireless networks are compromised. In this article, you will learn about airgeddon, a multi use bash script to audit wireless networks.

Using airgeddon, we can perform DoS stress testing, deacloaking, offline WPA/WPA 2 password cracking, evil twin attack, WPS attack and WEP attacks on target wireless network.

Let’s see how this tool works. For this, we will be using Kali Linux as airgeddon is available by default in its repositories. We will also need a wireless adapter that can monitor wireless packets. I am using ALFA AWVS036NHA adapter for this article.

If you get any error regarding “caplets” while installing airgeddon, you can install it from GitHub as shown below.

Note that airgeddon requires SUDO privileges to work. It can be started using command shown below.

sudo airgeddon

Airgeddon will check if all the essential tools it requires are present on the system.

Then, it will prompt you to select the interface you want to work with.

After selecting the network interface, menu of airgeddon is displayed.

First, let’s put our interface in monitor mode. That would be option 2.

As you can see in the Airgeddon’s menu, many attacks can be performed using this tool. For this article, let’s select the WPS pin attacks. This will display the sub menu of WPS attacks as shown below.

You can see various WPS pin attacks that you can perform using this tool. Let’s first scan the targets. Use option ‘1’.

After scanning and selecting your target, let’s crack the WPS pin using install Pixie dust attack with Bully.

Assign the BSSID, channel, timeout and other options as shown below.

This will start cracking the WPS pin. Note that cracking of WPS pin can sometimes take many hours. Next, learn about wifipumpkin, a wireless rogue access point creation framework.

Hello, aspiring ethical hackers. In our previous blogpost, you have learnt how to crack a WPA/WPA2 passphrase with aircrack. In this article, you will learn about another such tool cowpatty.

Cowpatty is a WPA-PSK, WPA2-PSK auditing tool that can be used to identify weak passphrases of an SSID with WPA, WPA2 enabled. Cowpatty does offline cracking of passwords and as it works offline, it needs packet capture file (pcap) with WPA handshake captured.

Let’s see how this tool works. For this, we will be using Kali Linux as cowpatty is installed by default on it. We will also need a wireless adapter that can monitor wireless packets. I am using ALFA AWVS036NHA adapter for this article.

The role of Cowpatty in Wi-Fi auditing starts after the wireless networks data is captured in a PCAP file. Notably, this data should include a WPA handshake, a process where a client connects to the wireless access point with WPA/WPA2 enabled. This can be done with airodump-ng (a tool included with aircrack) or kismet or Fern wifi cracker.

Before beginning to crack the passphrase, cowpatty can be used to check if the packet capture file has all the necessary data to start cracking against WPA2?PSK passphrases. For example, here we are trying to capture wireless traffic of a network named “Hackercool_Labs” and saving the capture data to a file named “wpa-crack-03.cap.

Once all necessary data is collected, we can crack the WPA2 passphrase as shown below. As you can see, the passphrase is “Snowwhite”.

Here is the explanation for the options specified in the above image.

-r: This option is used to specify the the packet capture file.

-f: path to the wordlist to be used for dictionary cracking (here we are using rockyou.txt).

-s: SSID of the wifi access point you are trying to crack.

If cowpatty succeeds is cracking WPA2 passphrase, it means the wifi security is weak and the password needs to be changed immediately.

Next, learn how to crack any WIFI password automatically with Besside.

Hello, aspiring ethical hackers. In our previous blogpost on wifi hacking, you learnt what is a rogue access point and why hackers or pentesters use it. In this article, you will learn about Wifipumpkin 3, a powerful framework for creating rogue access points. The features of wifipumpkin 3 are,

• 1. Creating Rogue access point attack
• 2. Performing Man-in-the-middle attack
• 3. Performing deauthentication attack
• 4. Module for extra-captiveflask templates
• 5. Creating Rogue DNS server
• 6. Performing captive portal attack (captiveflask)
• 7. Intercepting, inspecting, modifying and replay web traffic
• 8. WIFI networks scanning
• 9. DNS monitoring service
• 10. Credentials harvesting
• 11. Phishkin3 (Support MFA phishing attack via captive portal)
• 12. EvilQR3 (Support Phishing QR code attack)
• 13. Transparent Proxies
• 14. RestFulAPI (new)
• and more!

Let’s see how to create a rogue access point using this tool. For this, we will be using Kali Linux as this tool is present in its repositories by default in it. We will also need a wireless adapter that can monitor wireless packets. I am using ALFA AWVS036NHA adapter for this article.

It can be started using command as shown below.

sudo wifipumpkin3

Here’s its nice artwork once started.

To see all the commands that can be run using wifipumpki3, use the command shown below.

help

To see all the available modules of Wifipumpkin3, use the “show” command.

show

To use any module, we have to use the command “use” literally.

use <module name>

For example, let’s load the wifi-wifiscan module. As its name implies, this module of wifipumpkin scans for all wireless access points and devices trying to connect to them.

We can see all options of a module by using the “options” command as shown below.

This module just requires the name of the wireless interface which can be set as shown below.

After all options are set, we need to use “run” command to execute the module. Then, the module displays all access points as shown below.

Select the access point you want to target. For this blogpost, we will select “Hackercool_Labs” access point. We want to create a rogue access point for this access point. For this, go back and use “Proxies” command to see all the available proxies.

As you can see, a proxy named pumpkinproxy is enabled by default. A rogue access point should provide internet just as the original wifi access point of which we are creating a rogue in order not to raise suspicions. Use “ap” command to view all the settings for our rogue access point.

We can change any options we want as shown below. Let’s change the SSID to “Hackercool_Labss” from “Wifi Pumpkin”. The name of the rogue access point should be almost similar to the original one. Here, we added extra “s” so that you can differentiate easily.

We can use “start” command to start the access point. Note that this access point is “open” and has no password. When any client connects to the rogue access point assuming it as the original one, the tool identifies the device as shown below.

We can see their browsing data to some extent. For example, our client is trying to visit Facebook.

Instead of allowing clients to directly connect to our rogue access point, we can present a login page to the client. For this, we have to use the captiveflask proxy.

Now, as soon as anybody connects to our rogue access point, he/she will be presented with a login screen as shown below.

As soon as the user enters credentials assuming that he connected to the original access point and it was prompting for credentials for some reason,

wifipumpkin 3 captures and displays the credentials as shown below.

Thus, we can capture credentials using this. To see all the devices connected to our rogue access point, we can use “clients” command.

We can even see all the information about connected devices using “dump” command.