CyberP3i Hands-on Lab Series - Columbus State University · 2018-01-18 · In this lab, students...

CyberP3i Hands-on Lab Series

Lab Series using NETLAB

Designer: Dr. Lixin Wang, Associate Professor

Hands-On Lab on Securing Wireless Networks

The NDG Security+ Pod Topology Is Used

1. Introduction

In this lab, students will decrypt WPA and WEP traffic and then analyze the 802.11

(wireless) packets.

2. Objectives

Upon completion training of this lab, students will

1) be able to examine and decrypt WPA wireless traffic

2) be able to examine and decrypt WEP wireless traffic

3) be familiar with using the Wireshark tool

3. POD Topology

4. Lab Settings

The information in the table below will be needed in order to log into the virtual machines

used in this lab. The task section (Section 5) below provide details on the use of this

information.

Pre-Lab Setup Before continuing to the tasks, log into the following system as instructed.

For the virtual machine Kali:

1. On the login screen, select Other

2. When presented with the username, type root. Press Enter

3. When prompted for the password, type toor. Press Enter

4. Minimize the PC viewer window

5. Lab Instructions

Part 1. Decrypt WPA traffic and analyze the 802.11 (wireless) packets

1) On the Kali virtual machine, open a terminal and type Wireshark. The Wireshark program

will open

2) On the Wireshark window, click FileOpen, the “Open Capture File” window opens

3) Select the File System on the left pane, then navigate to the directory tmp/captures on the right

pane

4) Select the file “WPA-01.cap” and then click Open on the bottom of the window

5) In the Filter pane of the Wireshark window, type http and then click Apply. You cannot see

any traffic because the wireless traffic is encrypted

6) Next we decrypt the capture file “WPA-01.cap” using the network software suite Aircrack-ng

with the option -w to set the WPA cracking path to a wordlist file named passlist under the

directory /tmp/wordlists. You may also use “-” without the quotes for standard input (stdin)

7) Change the focus to the terminal and run the following command

Aircrack-ng /tmp/captures/WPA01-cap -w /tmp/wordlists/passlist

8) The Extended Service Set Identification (ESSID) is one of two types of Service Set Identification

(SSID).

9) For Index of target network? Type 2 for the network with the ESSID boguswifi. Since no valid

WPA handshakes found, the result is listed below



11) For Index of target network? Type 5 for the network with the ESSID T4QY4. Since no valid WPA

handshakes found again, the result is the same as above



13) For Index of target network? Type 7 for the network with the ESSID Anthony98. Since no data

packets obtained from this network, the result is shown below



15) For Index of target network? Type 3 for the network with the ESSID TOWSON333. Since there is

one valid WPA handshake found in this case, the WPA passphrase is obtained as shown below

16) Decrypt the 802.11 traffic for the wireless network TOWSON333. Type the command below

to decrypt the traffic

Airdecap-ng /tmp/captures/WPA01-cap -e TOWSON333 -p breezeless

17) Airdecap-ng is a network software suite that can decrypt WEP/WPA/WPA2 capture files. As well,

it can also be used to remove the wireless headers from an unencrypted wireless capture. It outputs

a new file ending with “-dec.cap” which is the decrypted version of the input capture file

18) Total number of decrypted WPA data packets is 11401.

19) Navigate to the /tmp/captures directory and then select the file “WPA-01-dec.cap”

20) In the Filter pane on the Wireshark window, type http and then click Apply

21) Select the File menu option and navigate to Export Objects HTTP

22) A new window appears. Browser through the list and examine the image files downloaded.

Find the packet with packet number 4860 and select it. Click the Save As button on the

bottom

23) Accept the default and save the file in the directory /tmp/captures. Then click Save

24) View the image file by selecting the Places menu option from the top menu pane and click

Recent Documents, and the select the file “wireless-network-new-5.jpg”. The result is

shown below

25) Repeat the process from step 21 to 24 by selecting the packet number 10232, and save the

file in the directory /tmp/captures. You can view the image file by selecting the Places menu

option from the top menu pane and click Recent Documents, the result is shown below

Part 2. Decrypt WEP traffic and analyze the 802.11 (wireless) packets

1) On the Kali virtual machine, open a terminal and type Wireshark. The Wireshark program

will open



pane

4) Select the file “WEP1.cap” and then click Open on the bottom of the window

5) In the Filter pane of the Wireshark window, type http and then click Apply. You cannot see

any traffic because the wireless traffic is encrypted

6) Next we decrypt the capture file “WEP1.cap” using the network software suite Aircrack-ng


Aircrack-ng /tmp/captures/WEP1.cap

8) The result is shown below

9) For Index of target network? Type 1 for the network with the ESSID HUANGDOM. The

decryption for this network fails and the result is shown below



11) For Index of target network? Type 2 for the network with the ESSID RP7J4. The decryption for

this network fails and the result is shown below



13) For Index of target network? Type 5 for the network with the ESSID TOWSON333. The

decryption for this network succeeded. The Aircrack-ng program can crack the 64-bit WEP

encryption key

14) After the WEP encryption key is obtained, decrypt the network traffic with the Airdecap-ng

program.


Airdecap-ng -w AA:AA:AA:AA:AA /tmp/captures/WEP1.cap

16) The decryption process is successful and totally 43220 WEP packets are decrypted



pane

19) Select the file “WEP1-dec.cap” and then click Open on the bottom of the window

20) In the Filter pane of the Wireshark window, type http and then click Apply. Now you can see

the HTTP requests within the 802.11 traffic because the WEP traffic has been decrypted using

the program airdecap-ng

21) Select the File menu option and navigate to Export Objects HTTP

22) A new window appears. Browser through the list and examine the image files downloaded.

Find the packet with packet number 238 and select it. Click the Save As button on the bottom

23) Accept the default and save the file in the directory /tmp/captures. Then click Save

24) View the image file by selecting the Places menu option from the top menu pane and click

Recent Documents, and the select the file “los-angeles-downtown-45.4.jpg”. The result is

shown below

25) Repeat the steps from 21 to 24 for the packet number 256 and save the file in the directory

/tmp/captures. and save the file in the directory /tmp/captures. You can view the image file

by selecting the Places menu option from the top menu pane and click Recent Documents,

and the select the file “Hampton-inn-los-angeles.jpg”. The result is shown below

6. References

Security+ Lab Series in NDG NETLAB+: Lab 4 – Secure Implementation of Wireless

Networking

7. Appendix

In this appendix, we introduce the two network software suites Aircrack-ng and

Airdecap-ng used in this lab.

7.1. Aircrack-ng Aircrack-ng is a network software suite consisting of a detector, packet sniffer, WEP and

WPA/WPA2-PSK (pre-shared key) key cracking program and analysis tool for 802.11 wireless

LANs. Aircrack-ng can recover the WEP key once enough encrypted packets have been captured

with airodump-ng. The aircrack-ng suite is part of the BackTrack distribution.

Usage of Aircrack-ng

aircrack-ng [options] <capture file(s)>

Here's a summary of all available options:

Option Param. Description

-a amode Force attack mode (1 = static WEP, 2 = WPA/WPA2-PSK).

-b bssid Long version - -bssid. Select the target network based on the access point's MAC

address.

-e essid If set, all IVs from networks with the same ESSID will be used. This option is also

required for WPA/WPA2-PSK cracking if the ESSID is not broadcasted (hidden).

-p nbcpu On SMP systems: # of CPU to use. This option is invalid on non-SMP systems.

-q none Enable quiet mode (no status output until the key is found, or not).

-c none (WEP cracking) Restrict the search space to alpha-numeric characters only (0x20

- 0x7F).

-t none (WEP cracking) Restrict the search space to binary coded decimal hex characters.

-h none (WEP cracking) Restrict the search space to numeric characters (0x30-0x39)

These keys are used by default in most Fritz!BOXes.

-d start (WEP cracking) Long version –debug. Set the beginning of the WEP key (in hex),

for debugging purposes.

-m maddr (WEP cracking) MAC address to filter WEP data packets. Alternatively, specify -

m ff:ff:ff:ff:ff:ff to use all and every IVs, regardless of the network.

-M number (WEP cracking) Sets the maximum number of ivs to use.


-n nbits (WEP cracking) Specify the length of the key: 64 for 40-bit WEP, 128 for 104-bit

WEP, etc. The default value is 128.

-i index (WEP cracking) Only keep the IVs that have this key index (1 to 4). The default

behaviour is to ignore the key index.

-f fudge (WEP cracking) By default, this parameter is set to 2 for 104-bit WEP and to 5 for

40-bit WEP. Specify a higher value to increase the bruteforce level: cracking will

take more time, but with a higher likelyhood of success.

-H none Long version - -help. Output help information.

-l file

name

(Lowercase L, ell) logs the key to the file specified. Overwrites the file if it already

exists.

-K none Invokes the Korek WEP cracking method. (Default in v0.x)

-k korek (WEP cracking) There are 17 korek statistical attacks. Sometimes one attack

creates a huge false positive that prevents the key from being found, even with lots

of IVs. Try -k 1, -k 2, … -k 17 to disable each attack selectively.

-p threads Allow the number of threads for cracking even if you have a non-SMP computer.

-r database Utilizes a database generated by airolib-ng as input to determine the WPA key.

Outputs an error message if aircrack-ng has not been compiled with sqlite support.

-x/-x0 none (WEP cracking) Disable last keybytes brutforce.

-x1 none (WEP cracking) Enable last keybyte bruteforcing (default).

-x2 none (WEP cracking) Enable last two keybytes bruteforcing.

-X none (WEP cracking) Disable bruteforce multithreading (SMP only).

-y none (WEP cracking) Experimental single bruteforce attack which should only be used

when the standard attack mode fails with more than one million IVs

-u none Long form - -cpu-detect. Provide information on the number of CPUs and MMX

support. Example responses to “aircrack-ng - -cpu-detect” are “Nb CPU detected:

2” or “Nb CPU detected: 1 (MMX available)”.

-w words (WPA cracking) Path to a wordlist or “-” without the quotes for standard in (stdin).

-z none Invokes the PTW WEP cracking method. (Default in v1.x)

-P none Long version - -ptw-debug. Invokes the PTW debug mode.

-C MACs Long version - -combine. Merge the given APs to a virtual one.

-D none Long version - -wep-decloak. Run in WEP decloak mode.

-V none Long version - -visual-inspection. Run in visual inspection mode.

-1 none Long version - -oneshot. Run in oneshot mode.

-S none WPA cracking speed test.


-s none Show the key in ASCII while cracking

-E file> (WPA cracking) Create EWSA Project file v3

-J file (WPA cracking) Create Hashcat Capture file

7.2. Airdecap-ng

Airdecap-ng is a network software suite that can decrypt WEP/WPA/WPA2 capture files. As well,

it can also be used to remove the wireless headers from an unencrypted wireless capture.

It outputs a new file ending with “-dec.cap” which is the decrypted version of the input file.

Usage of Airdecap-ng

airdecap-ng [options] <pcap file>

Option Parameter Description

-l

don't remove the 802.11 header

-b bssid access point MAC address filter

-k pmk WPA/WPA2 Pairwise Master Key in hex

-e essid target network ascii identifier

-p pass target network WPA/WPA2 passphrase

-w key target network WEP key in hexadecimal

Usage Examples

The following removes the wireless headers from an open network (no WEP) capture:

airdecap-ng -b 00:09:5B:10:BC:5A open-network.cap

The following decrypts a WEP-encrypted capture using a hexadecimal WEP key:

airdecap-ng -w 11A3E229084349BC25D97E2939 wep.cap

The following decrypts a WPA/WPA2 encrypted capture using the passphrase:

airdecap-ng -e 'the ssid' -p passphrase tkip.cap

The Extended Service Set Identification (ESSID) is one of two types of Service Set

Identification (SSID). In an ad hoc wireless network with no access points, the Basic Service Set

Identification (BSSID) is used.

8. Review Questions

1) Should I use WPA2, WPA or WEP network encryption on my own 802.11 wireless

LAN?

2) Why WPA is more secure than WEP?

3) What are security enhancements made on WPA2 over its predecessor WPA?

4) What is the program aircrack-ng used for?

5) What is the program airdecap-ng used for?

CyberP3i Hands-on Lab Series - Columbus State University · 2018-01-18 · In this lab, students...

Documents

Transcript of CyberP3i Hands-on Lab Series - Columbus State University · 2018-01-18 · In this lab, students...