CyberP3i Hands-on Lab Series Lab Series using NETLAB Designer: Dr. Lixin Wang, Associate Professor Hands-On Lab on Securing Wireless Networks The NDG Security+ Pod Topology Is Used
1. Introduction In this lab, students will decrypt WPA and WEP traffic and then analyze the 802.11 (wireless) packets. 2. Objectives Upon completion training of this lab, students will 1) be able to examine and decrypt WPA wireless traffic 2) be able to examine and decrypt WEP wireless traffic 3) be familiar with using the Wireshark tool 3. POD Topology 4. Lab Settings The information in the table below will be needed in order to log into the virtual machines used in this lab. The task section (Section 5) below provide details on the use of this information.
Pre-Lab Setup Before continuing to the tasks, log into the following system as instructed. For the virtual machine Kali: 1. On the login screen, select Other 2. When presented with the username, type root. Press Enter 3. When prompted for the password, type toor. Press Enter 4. Minimize the PC viewer window 5. Lab Instructions Part 1. Decrypt WPA traffic and analyze the 802.11 (wireless) packets 1) On the Kali virtual machine, open a terminal and type Wireshark. The Wireshark program will open 2) On the Wireshark window, click File Open, the Open Capture File window opens 3) Select the File System on the left pane, then navigate to the directory tmp/captures on the right pane 4) Select the file WPA-01.cap and then click Open on the bottom of the window 5) In the Filter pane of the Wireshark window, type http and then click Apply. You cannot see any traffic because the wireless traffic is encrypted 6) Next we decrypt the capture file WPA-01.cap using the network software suite Aircrack-ng with the option -w to set the WPA cracking path to a wordlist file named passlist under the directory /tmp/wordlists. You may also use - without the quotes for standard input (stdin) 7) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wpa01-cap -w /tmp/wordlists/passlist 8) The Extended Service Set Identification (ESSID) is one of two types of Service Set Identification (SSID).
9) For Index of target network? Type 2 for the network with the ESSID boguswifi. Since no valid WPA handshakes found, the result is listed below 10) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wpa01-cap -w /tmp/wordlists/passlist 11) For Index of target network? Type 5 for the network with the ESSID T4QY4. Since no valid WPA handshakes found again, the result is the same as above 12) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wpa01-cap -w /tmp/wordlists/passlist 13) For Index of target network? Type 7 for the network with the ESSID Anthony98. Since no data packets obtained from this network, the result is shown below
14) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wpa01-cap -w /tmp/wordlists/passlist 15) For Index of target network? Type 3 for the network with the ESSID TOWSON333. Since there is one valid WPA handshake found in this case, the WPA passphrase is obtained as shown below 16) Decrypt the 802.11 traffic for the wireless network TOWSON333. Type the command below to decrypt the traffic Airdecap-ng /tmp/captures/wpa01-cap -e TOWSON333 -p breezeless 17) Airdecap-ng is a network software suite that can decrypt WEP/WPA/WPA2 capture files. As well, it can also be used to remove the wireless headers from an unencrypted wireless capture. It outputs a new file ending with -dec.cap which is the decrypted version of the input capture file
18) Total number of decrypted WPA data packets is 11401. 19) Navigate to the /tmp/captures directory and then select the file WPA-01-dec.cap 20) In the Filter pane on the Wireshark window, type http and then click Apply 21) Select the File menu option and navigate to Export Objects HTTP 22) A new window appears. Browser through the list and examine the image files downloaded. Find the packet with packet number 4860 and select it. Click the Save As button on the bottom 23) Accept the default and save the file in the directory /tmp/captures. Then click Save 24) View the image file by selecting the Places menu option from the top menu pane and click Recent Documents, and the select the file wireless-network-new-5.jpg. The result is shown below
25) Repeat the process from step 21 to 24 by selecting the packet number 10232, and save the file in the directory /tmp/captures. You can view the image file by selecting the Places menu option from the top menu pane and click Recent Documents, the result is shown below
Part 2. Decrypt WEP traffic and analyze the 802.11 (wireless) packets 1) On the Kali virtual machine, open a terminal and type Wireshark. The Wireshark program will open 2) On the Wireshark window, click File Open, the Open Capture File window opens 3) Select the File System on the left pane, then navigate to the directory tmp/captures on the right pane 4) Select the file WEP1.cap and then click Open on the bottom of the window 5) In the Filter pane of the Wireshark window, type http and then click Apply. You cannot see any traffic because the wireless traffic is encrypted 6) Next we decrypt the capture file WEP1.cap using the network software suite Aircrack-ng 7) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wep1.cap 8) The result is shown below 9) For Index of target network? Type 1 for the network with the ESSID HUANGDOM. The decryption for this network fails and the result is shown below
10) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wep1.cap 11) For Index of target network? Type 2 for the network with the ESSID RP7J4. The decryption for this network fails and the result is shown below 12) Change the focus to the terminal and run the following command Aircrack-ng /tmp/captures/wep1.cap 13) For Index of target network? Type 5 for the network with the ESSID TOWSON333. The decryption for this network succeeded. The Aircrack-ng program can crack the 64-bit WEP encryption key
14) After the WEP encryption key is obtained, decrypt the network traffic with the Airdecap-ng program. 15) Change the focus to the terminal and run the following command Airdecap-ng -w AA:AA:AA:AA:AA /tmp/captures/wep1.cap 16) The decryption process is successful and totally 43220 WEP packets are decrypted 17) On the Wireshark window, click File Open, the Open Capture File window opens 18) Select the File System on the left pane, then navigate to the directory tmp/captures on the right pane 19) Select the file WEP1-dec.cap and then click Open on the bottom of the window 20) In the Filter pane of the Wireshark window, type http and then click Apply. Now you can see the HTTP requests within the 802.11 traffic because the WEP traffic has been decrypted using the program airdecap-ng 21) Select the File menu option and navigate to Export Objects HTTP 22) A new window appears. Browser through the list and examine the image files downloaded. Find the packet with packet number 238 and select it. Click the Save As button on the bottom 23) Accept the default and save the file in the directory /tmp/captures. Then click Save
24) View the image file by selecting the Places menu option from the top menu pane and click Recent Documents, and the select the file los-angeles-downtown-45.4.jpg. The result is shown below 25) Repeat the steps from 21 to 24 for the packet number 256 and save the file in the directory /tmp/captures. and save the file in the directory /tmp/captures. You can view the image file by selecting the Places menu option from the top menu pane and click Recent Documents, and the select the file Hampton-inn-los-angeles.jpg. The result is shown below
6. References Security+ Lab Series in NDG NETLAB+: Lab 4 Secure Implementation of Wireless Networking 7. Appendix In this appendix, we introduce the two network software suites Aircrack-ng and Airdecap-ng used in this lab. 7.1. Aircrack-ng Aircrack-ng is a network software suite consisting of a detector, packet sniffer, WEP and WPA/WPA2-PSK (pre-shared key) key cracking program and analysis tool for 802.11 wireless LANs. Aircrack-ng can recover the WEP key once enough encrypted packets have been captured with airodump-ng. The aircrack-ng suite is part of the BackTrack distribution. Usage of Aircrack-ng aircrack-ng [options] <capture file(s)> Here's a summary of all available options: Option Param. Description -a amode Force attack mode (1 = static WEP, 2 = WPA/WPA2-PSK). -b bssid Long version - -bssid. Select the target network based on the access point's MAC address. -e essid If set, all IVs from networks with the same ESSID will be used. This option is also required for WPA/WPA2-PSK cracking if the ESSID is not broadcasted (hidden). -p nbcpu On SMP systems: # of CPU to use. This option is invalid on non-smp systems. -q none Enable quiet mode (no status output until the key is found, or not). -c none (WEP cracking) Restrict the search space to alpha-numeric characters only (0x20-0x7F). -t none (WEP cracking) Restrict the search space to binary coded decimal hex characters. -h none (WEP cracking) Restrict the search space to numeric characters (0x30-0x39) These keys are used by default in most Fritz!BOXes. -d start (WEP cracking) Long version debug. Set the beginning of the WEP key (in hex), for debugging purposes. -m maddr (WEP cracking) MAC address to filter WEP data packets. Alternatively, specify - m ff:ff:ff:ff:ff:ff to use all and every IVs, regardless of the network. -M number (WEP cracking) Sets the maximum number of ivs to use.
Option Param. Description -n nbits (WEP cracking) Specify the length of the key: 64 for 40-bit WEP, 128 for 104-bit WEP, etc. The default value is 128. -i index (WEP cracking) Only keep the IVs that have this key index (1 to 4). The default behaviour is to ignore the key index. -f fudge (WEP cracking) By default, this parameter is set to 2 for 104-bit WEP and to 5 for 40-bit WEP. Specify a higher value to increase the bruteforce level: cracking will take more time, but with a higher likelyhood of success. -H none Long version - -help. Output help information. -l file name (Lowercase L, ell) logs the key to the file specified. Overwrites the file if it already exists. -K none Invokes the Korek WEP cracking method. (Default in v0.x) -k korek (WEP cracking) There are 17 korek statistical attacks. Sometimes one attack creates a huge false positive that prevents the key from being found, even with lots of IVs. Try -k 1, -k 2, -k 17 to disable each attack selectively. -p threads Allow the number of threads for cracking even if you have a non-smp computer. -r database Utilizes a database generated by airolib-ng as input to determine the WPA key. Outputs an error message if aircrack-ng has not been compiled with sqlite support. -x/-x0 none (WEP cracking) Disable last keybytes brutforce. -x1 none (WEP cracking) Enable last keybyte bruteforcing (default). -x2 none (WEP cracking) Enable last two keybytes bruteforcing. -X none (WEP cracking) Disable bruteforce multithreading (SMP only). -y none (WEP cracking) Experimental single bruteforce attack which should only be used when the standard attack mode fails with more than one million IVs -u none Long form - -cpu-detect. Provide information on the number of CPUs and MMX support. Example responses to aircrack-ng - -cpu-detect are Nb CPU detected: 2 or Nb CPU detected: 1 (MMX available). -w words (WPA cracking) Path to a wordlist or - without the quotes for standard in (stdin). -z none Invokes the PTW WEP cracking method. (Default in v1.x) -P none Long version - -ptw-debug. Invokes the PTW debug mode. -C MACs Long version - -combine. Merge the given APs to a virtual one. -D none Long version - -wep-decloak. Run in WEP decloak mode. -V none Long version - -visual-inspection. Run in visual inspection mode. -1 none Long version - -oneshot. Run in oneshot mode. -S none WPA cracking speed test.
Option Param. Description -s none Show the key in ASCII while cracking -E file> (WPA cracking) Create EWSA Project file v3 -J file (WPA cracking) Create Hashcat Capture file 7.2. Airdecap-ng Airdecap-ng is a network software suite that can decrypt WEP/WPA/WPA2 capture files. As well, it can also be used to remove the wireless headers from an unencrypted wireless capture. It outputs a new file ending with -dec.cap which is the decrypted version of the input file. Usage of Airdecap-ng airdecap-ng [options] <pcap file> Option Parameter Description -l don't remove the 802.11 header -b bssid access point MAC address filter -k pmk WPA/WPA2 Pairwise Master Key in hex -e essid target network ascii identifier -p pass target network WPA/WPA2 passphrase -w key target network WEP key in hexadecimal Usage Examples The following removes the wireless headers from an open network (no WEP) capture: airdecap-ng -b 00:09:5B:10:BC:5A open-network.cap The following decrypts a WEP-encrypted capture using a hexadecimal WEP key: airdecap-ng -w 11A3E229084349BC25D97E2939 wep.cap The following decrypts a WPA/WPA2 encrypted capture using the passphrase: airdecap-ng -e 'the ssid' -p passphrase tkip.cap The Extended Service Set Identification (ESSID) is one of two types of Service Set Identification (SSID). In an ad hoc wireless network with no access points, the Basic Service Set Identification (BSSID) is used.
8. Review Questions 1) Should I use WPA2, WPA or WEP network encryption on my own 802.11 wireless LAN? 2) Why WPA is more secure than WEP? 3) What are security enhancements made on WPA2 over its predecessor WPA? 4) What is the program aircrack-ng used for? 5) What is the program airdecap-ng used for?