Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In any residential building, there is a multitude of WPA2-protected wireless access points.

Yesterday I was at a friend's and attempted to launch aircrack-ng against their AP (with permission). I was assured that there is a linux laptop currently connected. However, I was unable to acquire the device's MAC, to pass to aircrach-ng.

I would like to acquire a list of all wireless devices inbound, with their respective MAC and IP. If this is possible. I do not have the WPA2 password.

I know that the first step is to put my network card in monitor mode.

# airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill> 
sudo airmon-ng start wlan0 2

As a second step, I attempted iwlist scan. However, this returned only a list of AP-s, that is, as far as I understand, devices in Master mode.

Is there some communication between a connected device and the respective AP if no services are running, just to keep the connection alive? How do I monitor this traffic?

Can I use something line tcpdump wlan0 to do this? If yes, how can I get the MAC data out of the packets?

share|improve this question
1  
This question appears to be off-topic because it is asking for help regarding the usage and operation of specific tools in a specific case. Such information is freely available all over the Internet. Voted to close. –  Adnan Sep 5 '13 at 9:30
    
@Adnan, well, I am asking which tools to use. Reading manuals, while pedagogical, is very time consuming, if the manual refers to the wrong tool. –  Vorac Sep 5 '13 at 11:54
    
Plus, I am asking if there exists ongoing communication between a (passive) authenticated device and the AP. If the answer is "no", then no tool would help me! –  Vorac Sep 5 '13 at 11:55
add comment

1 Answer

up vote 1 down vote accepted

You are searching for airodump-ng (interface) !

Main steps in short:

1) Put monitor mode

airmon-ng

2) Dump (This step is what you are searching for)

airodump-ng mon0

3) Generate some traffic

aireplay-ng

Wait for the handshake.

4) Crack it with a list

Use the John the Ripper as word list to crack the WPA/WP2 password.

aircrack-ng -w /pentest/passwords/john/password.lst wpacrack-01.ivs

Here is the full description! (I assume you use BT)

backtrack wep crack

HOWTO : WPA/WPA2 cracking with Back|Track 5

share|improve this answer
    
I was using this tutorial where they assume I know the client's MAC. Will airodump-ng report a device, that is already authenticated prior to my arrival at the scene? –  Vorac Sep 5 '13 at 12:05
    
According to this site link ! What's the meaning of the fields displayed by airodump-ng ? Airodump-ng will display a list of detected access points! –  Raymond Sep 5 '13 at 12:17
    
Oh, I get it now - airodump listens to any packets, directed at the AP. Then, if I did not capture a valid handshake, use the listed MAC to de-authenticate the client. Got it. –  Vorac Sep 5 '13 at 12:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.