What is actually happening in the background when using such things as airmon? [closed]

Question

Firstly: Apologies if this is not the relevant place to ask this, if not then some direction would be good (thank you).

I have been interested in Information Security for some years now, but have only really taken a proactive step on it recently using Kali Linux and learning the basics such as airmon. However I do not feel that I am truly learning anything, I feel that I am just calling in some commands to do all of the work for me... What I wanted to know is what is happening in the background of everything, on everything after I hit enter on a command. Are there any good extremely in-depth guides/tutorials/lessons that supply this knowledge? I am constantly asking how I am getting in to something, why I am doing it this way, what other ways are there to do this, am I able to do the same on my own with out these commands?

Answer 1

So to read deeply into your question, you ultimately want to improve your learning process as you encounter information about vulnerabilities and exploits.

Here's a way to learn on your own, and it might be more effective than just walking through a tutorial.

First, you need to deeply understand the vulnerability you're studying. In the case of WEP cracking, it's an old, known problem, and it's pretty easy to search for that vulnerability. Wikipedia often lists known vulnerabilities, so it's a good place to start your search, and generally has reliable information. When you find a good description, take the time to understand the content. For WEP cracking, this wiki page is pretty good: https://en.wikipedia.org/wiki/Cracking_of_wireless_networks. It explains the vulnerabilities in the insecure WEP protocol, and how those vulnerabilities can be exploited.

Next, find a tool that exploits the vulnerability. In this case the Wikipedia article lists a few tools, including aircrack-ng. (You've obviously found that tool already, but some vulnerabilities aren't as obvious.) Then search for a walk-through tutorial in using the tool.

Then, as you walk through the tutorial, tool in hand, try to map the activity you're performing to each of the steps needed to exploit the vulnerability. For example, the article says that WEP takes advantage of "weak IVs", so you know that at some point aircrack-ng must read packets with those weak IVs. Knowing that reading wireless packets requires connecting to a network interface, you can expect to have to configure the tool with which network interface to use -- conversely, if a tutorial says "type 'wlan0' as the last parameter," you know that tool is going to use a wireless network interface.

Further reading of the vulnerability mentions that the attacker can do something to generate millions of IVs in hopes of harvesting a few thousand weak ones that will reveal the key. Look for a command in the tutorial that corresponds to sending millions of packets, or perhaps you might recognize that sending a million packets could take an hour or more.

All the steps from the vulnerability should be visible in the tools you're using. If the tool hides steps from you, at least the sequence of events you can see will still match the vulnerability. You maybe won't know exactly which bits are flipped when, but you'll learn which steps correspond to which phases of exploiting the vulnerability.

Answer 2

Interesting question. Airmon-ng is used to enable monitoring mode on wireless interfaces.

You could do that through the following commands too:

> sudo ifconfig wlan1 down
> iw dev wlan1 set type monitor

Now if you check with iwconfig, you'll notice the change.

If you are interesting in knowing how the other tools in the Aircrack-ng suite work, you might want to take a look at https://github.com/aircrack-ng/aircrack-ng. It's an interesting read, but does require some understanding of programming.

Hope this helps!