Ethical Hacking and Penetration Testing Guide

298
◾ 
Ethical Hacking and Penetration Testing Guide
Command
:
ifconfig wlan0 up
We can verify that our MAC address has been spoofed by executing “
iwconfig
” command 
and matching the HWaddr field.
So far, we have only discussed bypassing a low-level security on wireless networks like uncover-
ing hidden SSIDs and bypassing MAC filters. Now we will dive into the main part of this chapter, 
where we will discuss cracking WEP, WPA, and WP2 keys.
Cracking a WEP Wireless Network with Aircrack-ng
WEP (Wired Equivalent Privacy) was one of the first authentication and encryption used for wire-
less networks; it’s been known to be insecure for a decade due to some cryptographic weaknesses 
related to initialization vectors, key management, etc., which we won’t discuss in this book, since 
it’s a completely different topic.
Though it’s deprecated and should never be used, we still see it being used in lots of home 
networks, one of the reasons being the usage of very old routers that don’t support WPA, WPA2 
encryption, the other reason being lack of awareness.
So in this section, we will use aircrack-ng to demonstrate how easy it is to crack a WEP key no 
matter how complex it is.
Placing Your Wireless Adapter in Monitor Mode
Step 1
—First things first: we need to make sure that our network card is placed into monitor 
mode, we have already learnt that we can use the “airmon-ng start wlan0” command to 
accomplish this task. We can use “iwconfig” to verify that our wireless adapter is now able 
to sniff in monitor mode.

---

Wireless Hacking
◾ 
299
Determining the Target with Airodump-ng
Step 2
—Next, we will use airodump-ng to discover our neighbor networks with WEP encryp-
tion enabled. We can see our target with an essid (same as ssid) of “Linksys” and with BSSID 
of 98:FC:11:C9:14:22 and it’s on the channel 6. We should make a note of the essid, bssid, 
and channel because we will need them in future.