Hacking WiFi!

Due Date: Friday of Week 10 23:59:59

• Hacking WiFi!
  • Before you start
  • Introduction
  • What you must do
  • Submission

Before you start

This assignment applies the WiFi cracking methodology from the Cracking WiFi page. Read that page first if you haven’t already — it explains monitor mode, the 4-way handshake, and why capturing it enables offline cracking.

Tool mapping: hw3 uses a different toolchain than crack_wifi.md:

Install hcxtools if not already present:

sudo apt install hcxtools

Convert a bettercap capture (.pcapng) to hashcat format:

hcxpcapngtool -o capture.hc22000 capture.pcapng
hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt

nmtui is a text-mode UI for NetworkManager — run nmtui in a terminal, choose “Activate a connection”, select the network, and enter the password you cracked.

RTSP (Real Time Streaming Protocol) is a network control protocol for media servers, similar in structure to HTTP. Cameras and video servers expose streams via URLs like rtsp://192.168.1.x:554/stream. You can view them with VLC (File → Open Network Stream) or ffplay rtsp://.... Authentication, if required, typically uses HTTP Basic auth embedded in the URL: rtsp://user:pass@192.168.1.x:554/stream. Default credentials on IoT devices are frequently admin/admin, admin/ (blank), or the device’s serial number.

Introduction

So you’ve followed the instructions to break into WiFi networks. Well, at least you watched me walk through it. Now, what should we do with that?

What you must do

1. Using the bettercap tool, crack the NetSec WiFi network password. This is a WPA2 network, and is currently living in FAB 140 (the lab next to the fishbowl). It is accessible from various points in the near vicinity of that room. You have already seen how the aircrack suite does this, so you may know the password. But let’s pretend we don’t. You can potentially use your own hardware for this task. If you have a raspberry pi, are running macOS or Linux on your laptop, or have a USB WiFi adapter that supports monitor mode, you can use that. If you don’t have any of these, you can use your Windows host, though you’ll need to make arrangements with me to attach a USB wifi adapter to your workstation.
   1. Use bettercap to find the BSSID and connected clients of the NetSec network.
   2. Use bettercap to perform a deauth attack on the network and capture the 4-way handshake.
   3. Use the hcx toolsuite to convert the captured handshake to a format that hashcat can understand.
   4. Crack the password using hashcat. You should use the rockyou.txt wordlist.
2. Once you have documented all of the above (commands, output, everything you would need to walk through it again) in your hw3.md file, connect your workstation to the wireless network. You should be able to do this with the password you just cracked. Take a screenshot showing the connection to the network. The easiest way is to the use the nmtui tool.
3. Now that you have access to the network, use the nmap tool to scan the network. You should be able to find the IP address of the router and the IP addresses of the associated clients. Document this in your hw3.md file.
4. For each associated client, use the nmap tool to scan the client. You should be able to find the open ports and services running on the client. Document this in your hw3.md file.
5. There are multiple RTSP streams active on the network. Find them, access them, and take a screenshot of what it’s looking at. What is it? What’s the title? Who wrote it? Document this in your hw3.md file. It may require authentication. This is normal, but is often set to really stupid defaults…

Submission

Everything above should be documented in a markdown file in your repo called hw3/hw3.md. Commit and push this to your repo. Once you have done this, you can consider the assignment submitted.