0

In any residential building, there is a multitude of WPA2-protected wireless access points.

Yesterday I was at a friend's and attempted to launch aircrack-ng against their AP (with permission). I was assured that there is a linux laptop currently connected. However, I was unable to acquire the device's MAC, to pass to aircrack-ng.

I would like to acquire a list of all wireless devices inbound, with their respective MAC and IP. If this is possible. I do not have the WPA2 password.

I know that the first step is to put my network card in monitor mode.

# airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill> 
sudo airmon-ng start wlan0 2

As a second step, I attempted iwlist scan. However, this returned only a list of AP-s, that is, devices in Master mode.

Is there some communication between a connected device and the respective AP if no services are running, just to keep the connection alive? How do I monitor this traffic?

Can I use something line tcpdump wlan0 to do this? If yes, how can I get the MAC data out of the packets?

Improve this question
3
  • 1
    This question appears to be off-topic because it is asking for help regarding the usage and operation of specific tools in a specific case. Such information is freely available all over the Internet. Voted to close.
    – Adi
    Commented Sep 5, 2013 at 9:30
  • @Adnan, well, I am asking which tools to use. Reading manuals, while pedagogical, is very time consuming, if the manual refers to the wrong tool.
    – Vorac
    Commented Sep 5, 2013 at 11:54
  • Plus, I am asking if there exists ongoing communication between a (passive) authenticated device and the AP. If the answer is "no", then no tool would help me!
    – Vorac
    Commented Sep 5, 2013 at 11:55

2 Answers 2

Reset to default
1

You are searching for airodump-ng (interface) !

Main steps in short:

1) Put monitor mode

airmon-ng

2) Dump (This step is what you are searching for)

airodump-ng mon0

3) Generate some traffic

aireplay-ng

Wait for the handshake.

4) Crack it with a list

Use the John the Ripper as word list to crack the WPA/WP2 password.

aircrack-ng -w /pentest/passwords/john/password.lst wpacrack-01.ivs

Here is the full description! (I assume you use BT)

backtrack wep crack

HOWTO : WPA/WPA2 cracking with Back|Track 5

Improve this answer
3
  • I was using this tutorial where they assume I know the client's MAC. Will airodump-ng report a device, that is already authenticated prior to my arrival at the scene?
    – Vorac
    Commented Sep 5, 2013 at 12:05
  • According to this site link ! What's the meaning of the fields displayed by airodump-ng ? Airodump-ng will display a list of detected access points!
    – Raymond
    Commented Sep 5, 2013 at 12:17
  • Oh, I get it now - airodump listens to any packets, directed at the AP. Then, if I did not capture a valid handshake, use the listed MAC to de-authenticate the client. Got it.
    – Vorac
    Commented Sep 5, 2013 at 12:23
0

You can also use Kismet in order to passively scan for wireless devices, it comes with Kali Linux distribution (formerly Backtrack).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .