-2

I am trying to attack my wireless router using Kali Linux for learning purposes. When I check the wireless router's logs after a successful attack, it doesn't show me the logs related to attacks which I made. The logs only reveales which devices requested IP addresses and which devices got the IP-addresses (DHCP DORA process), nothing more than this.

So I want to know a tool or a technique which tells me that there were many efforts to compromise the router, i.e. a tool which gives me a thorough view of everything about the router's logs. For example, if I make a DDoS attack or a WPA/WPA2 attack then I shoule be able to see that in the logs.

  • 2
    If your router does not log more than you see then this is a feature of the routers firmware and no tool can magically make some arbitrary router log more details. – Steffen Ullrich Apr 18 '18 at 7:22
  • As the other guys says there is no tool to make this possible. Im not entirely sure but maybe you can run a virtual wireless router and go trough the same steps. For example have a look at GNS3 gns3.com – toom Apr 18 '18 at 11:06
1

It depends on the log. If the only thing that your log stores are DHCP-related information, nothing can extract security warnings about DDoS or whatever out of it.

First, you have to see if your router can log all incoming and outgoing connections.

Then, you need a way to parse that log and preferably do it real-time. This is painful on normal SOHO routers.

If it is possible, you could SSH into your router, get logs and pass them to some kind of SIEM or real-time log analyzer.

If you can't, but you can access the file from the admin console (usually 192.168.1.1), you could do something similar by writing a script that periodically requests that file to the router via HTTP and sends it to the analyzer.

In the end, SOHO routers, especially in their standard Wi-Fi configuration, are not made to facilitate real-time security analysis. If you can, set up Wi-Fi Enterprise with a RADIUS server or use OpenWRT and forward logs to an external machine for analysis.

1

You didn't say what kind of router it is, but I agree with the above comments that you'll be limited to what your router is capable of.

Another solution is to install dd-wrt. It's a well known opensource router firmware with lots of options and much better logging as you can access the linux sub-system and it's corresponding logs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.