start	end	text
250	4890	Hello guys, welcome to the first ever virtual DEF CON event.
5010	14650	This workshop, Introduction to Wi-Fi Security, is a part of Wireless Village, which is a part of DEF CON as you know.
14890	19490	So in this workshop, we are going to talk about the basics of Wi-Fi security.
19810	28550	We will talk about the schemes that Wi-Fi uses to keep your traffic, your identity secure while you are using the Wi-Fi.
28550	31830	And we will also look at the ways to attack those.
32070	38050	My name is Nishant and I will be conducting this workshop along with my colleague Jaswin.
38050	40890	We both work for Pentester Academy.
41870	46450	So before moving forward, a little bit background about us.
46450	50450	I work as R&D Manager at Pentester Academy.
50450	54970	We work on developing labs and training contents for our customers.
54970	60190	When we are not doing that, we train around the world in different venues.
60490	62370	We present our research.
62910	67810	Jaswin also works at Pentester Academy. He is a researcher there.
67910	76390	And apart from doing all the lab work and the routine work, he also helps me as a co-trainer in the trainings.
76390	79910	And he also publishes his research.
81110	86890	So here are some cool logos from some conferences that we have been to.
88090	90730	This is the pentesteracademy.com.
90830	96390	We have a lot of courses, on-demand video courses on here.
96390	98310	You can go and take a look.
98590	103090	Similarly, we have a browser-based lab which is completely in cloud.
103090	104910	We call it Attack Defense.
106090	110530	Everything in this lab can be used using your browser.
110530	113210	You don't need any VPN. You don't need any plugin.
114110	117130	We have customers from over 90 plus countries.
117310	120290	And now coming to the workshop outline.
120630	124990	So as discussed before, we will talk about the basics of Wi-Fi.
124990	128270	And then we will talk about sniffing and recon.
128370	133270	We'll talk about WEP, WPA2-PSK, and WPA2-Enterprise.
133270	136830	What they are, how the authentication works in them,
136830	139530	and how we can actually attack them.
140530	144270	So first of all, you know, when you read about Wi-Fi,
144270	148710	you will see that it is referred by the name or this number.
148710	150990	That's 802.11.
150990	156850	So 802 is the committee that deals with the network-related norms.
156950	161690	And .11 is assigned to Wi-Fi or wireless LAN.
163350	166490	So 802.11 is the standard.
166490	171250	And then there are multiple amendments to the standard to support newer things.
171250	177250	So for example, you have your 802.11 A, B, G, N.
177430	180450	Similarly, you have I, W, and there's a list.
180450	182010	There's a list of this.
182010	186410	So all of these are amendments to the main standard.
187790	192350	Wi-Fi Alliance is the organization that actually holds the right
192350	195650	for this specific logo.
195650	198250	The Wi-Fi trademarks actually belong to them.
198310	203110	So if you are a vendor and if you want to use this logo on your product,
203110	205150	you have to take approval from them.
205150	208010	So you submit your product to them and then they go through it.
208010	211470	They check if it complies with whatever standards they have.
211470	213830	And then you're allowed to use this logo.
216650	219150	So there are multiple amendments.
219150	226130	But we are only going to talk about those which deal with the transmission of Wi-Fi,
227110	231510	especially the bands and the bandwidth and all.
231630	238050	So in that, you have A, B, G, N, and AC, which is the latest one.
238530	242870	So 802.11 A, it uses OFDM.
242870	247170	So all of this, because it's a basic class, we don't have that amount of time.
247170	252010	But just to give you an overview, there's a reason why these slides are here,
252010	254990	so that you can go back later and, you know,
254990	258810	if you are interested in this specific part, you can dig deeper into it.
258850	262550	So 11A is the first one. It was the basic one.
262550	264550	It used to use 5 GHz.
264650	270390	And at that time, OFDM was the way to propagate the wave of the data in this case.
270650	272890	And then the 11B came.
272890	276430	It used to work on a different way of modulation.
276430	279250	And 2.4 GHz was used for it.
279250	286470	Then came G. In G, they increased the data carrying capacity.
286650	288870	After that came N.
288910	293210	N actually allowed you to use two or more channels together.
293210	299350	So it's, you know, so what the idea here is to increase the throughput.
299430	303310	So, you know, from A, B, G, N, what we are trying to do,
303310	308390	we are trying to transmit more data using Wi-Fi, right?
308390	311370	Because, you know, it's not like the older times now.
311850	317070	If you talk about 10, 15 years back, you didn't have that kind of requirements
317070	319990	as well as that kind of equipment at your home.
320090	323990	So, for example, you didn't have 4K TV, right?
323990	327470	But now when you have 4K TV, which connects to your Internet
327470	332430	and you want to stream a movie or something, you need higher bandwidth, right?
332430	335930	So that's where all of these standards actually came in.
335930	340170	So, you know, 11 AC is the latest one, which is, you know,
340170	345090	being adopted by the market for the past few years now.
345090	350490	So it can actually give you up to 1.3 Gbps of data transmission
350490	352670	using your home Wi-Fi.
352950	357150	And if you talk about enterprise Wi-Fi, then the limit will increase.
357150	360330	So these standards will make sure that, you know,
360330	364150	it can accommodate your needs with the time.
365410	368490	So this is the 2.4 GHz channel.
368490	376050	So Wi-Fi, if we talk about the main Wi-Fi, not the newer ones like 11 AD or something,
376050	378750	it operates on two main channels.
378750	384010	First one is the 2.4 GHz channel and the second one is the 5 GHz channel.
384010	388990	So this is the layout for the channels on 2.4 GHz.
389170	395490	So you can see that there are 14 channels and all of these cannot be used in all of geographies.
395490	397050	You know, there are regulations.
397210	402350	So according to them, you can use 14 channels in some of the geographies,
402350	406590	some of the nations, and then you can use 12 or 13 in others.
406590	411510	So you can refer to the regulatory information for this.
411510	418050	Now, what you can observe here is these bands are very narrow and they overlap.
418150	422310	And this causes a lot of problems because, you know, then you have interference
422310	426730	and you have a lot of, you know, Wi-Fi networks operating
426730	430270	and there are a lot of clients in the vicinity.
430270	432170	It is going to cause problems.
432410	435950	So that's where people then move to 5 GHz.
435950	438730	So 5 GHz is more spread out.
438910	441190	It has non-overlapping channels.
441510	443150	So you can transmit more.
443150	445950	So that was the idea behind it.
446310	450890	Now, coming back to the sniffing and the connection part.
450890	455650	Obviously, if you want to connect to a Wi-Fi, everyone is doing it now.
455650	458750	So, you know, it's the part of daily routine now.
458750	461930	So you have your access point in your home, at your office,
461930	467330	and then you have a Wi-Fi card which you have connected to your desktop externally
467330	472510	or, you know, you can have a laptop which automatically comes with it,
472510	476550	your phones, all of these have internal Wi-Fi cards.
476590	479370	So, you know, also they have antennas.
479490	482450	So using that, your device connects to the access point
482450	485570	and then you're able to exchange traffic with it, right?
485570	487810	So that's the basic thing about it.
487950	491970	Now, when in normal mode, these cards,
491970	496070	they don't actually look at the traffic of other cards.
496070	499810	So, you know, if you are sitting somewhere and there are multiple clients
499810	505530	and multiple routers or access points, as you like to call them,
505530	510970	if there are multiple of these pairs, they are transmitting data back and forth, right?
510970	515710	So, but the card that your machine is using in normal operation,
515710	520870	it will only consider or it will only show you the traffic that is, you know,
520870	522450	that is for your machine.
522450	527070	All the other, it, you know, it totally rejects that.
527070	528690	It totally ignores that.
529030	532610	So if you want to take a look at other people's traffic,
532610	535230	it can't be done in the normal mode.
535230	539050	So for that, you have something called as monitor mode.
539230	544170	If you guys have done a sniffing of other people's machine on LAN,
544170	546910	it's also known as promiscuous mode there.
547090	551930	So monitor mode allows you to look at the traffic in the vicinity.
552450	556810	You can do sniffing and then you can go for attacks and all of those things.
557470	562510	So first of the things that you need is a Wi-Fi card,
562510	567690	which allow you to sniff, which actually allow you to put it into monitor mode.
567930	572890	So here are some of the cards which actually allows monitor mode.
572890	577870	You can order one from Amazon or some other, you know, e-commerce market.
578510	580710	So this was the old way of doing it.
580710	582430	It was the conventional way of doing it.
582450	585730	Now, suppose you're dealing with something advanced, right?
586390	592190	You know, you're dealing with 11 AC points, which is transmitting data on a very high pace.
592190	597190	At that point, what you can do is you can go for an off-shelf access point.
597290	603310	You can write, you know, with your own firmware and then you can use it for sniffing.
603310	608990	The reason for doing that is for high performance access points.
608990	616190	Your cards will not be able to match the throughput or the capacity of those access points.
616230	622070	So if you have an access point, you have a better chance to not miss the traffic that is being transmitted
622070	625190	or received by that specific access point.
626370	631570	Now, you know, because firmware is not something that, you know, that is like Windows software.
631570	635250	It's not like you download it and you click run and it runs and installs.
635250	638970	It's not like that. And that's where a lot of people face problems.
638990	643650	So when you buy a router, you know, of the shelf routers from market
643650	649210	and you want to transform it into sniffer, you can use something like OpenWRT.
649210	654550	So OpenWRT is a Linux based project for these embedded devices,
654550	660270	which actually allow you to customize and, you know, customize your routers and access points.
660270	663630	You can use it in access point mode. You can make it something else.
663630	668170	You can make it a hacking gadget. So all of that, it actually allows you.
668170	674250	It has support for most of the hacking and recon tools, especially for Wi-Fi and all.
674370	678370	So you can use it if you want to go for the higher throughput ones.
678810	684050	So now let's talk about some basic terminology that will help us, you know,
684050	687830	in the workshop or the later parts of the workshop.
688070	694190	So first, station or STA in short is nothing but a wireless client.
694190	697010	It can be your mobile. It can be your laptop.
697170	701050	It can be a desktop, you know, with a Wi-Fi card on it.
701370	706110	Then comes BSS. BSS stands for Basic Service Set.
706790	713630	So BSS, when you will hear about it, it is to refer a set of access point and a client.
713750	717610	If you know they are operating in that or it can be ad hoc clients,
717610	720630	which, you know, do not need access point to connect.
721490	725770	ESS is a set which contains multiple BSS.
726210	733730	And similarly, then ESSID or SSID is the name which we use to identify that ESS.
733950	738330	So suppose you have a Wi-Fi network, you put some name on it, right?
738510	742630	Home Wi-Fi or something. So that is SSID, right?
742630	746250	It's important to remember. That's why, you know, I'm explaining it again.
746570	750370	SSID is the name of the Wi-Fi network that you are using.
751030	759470	And now ESSID refers to the MAC address of the access point that is giving you the Wi-Fi, right?
759630	766750	So ESSID will be the MAC address and you will be able to see it when you connect with that Wi-Fi.
766750	769570	Not in your Windows machine, you know, directly.
769630	773930	You have to do some dig through or you have to look at the packets to see it.
774470	776670	Then comes the distribution system.
776670	784890	So generally distribution system refers to the network which connects access point with the larger network.
786250	789490	So again, some examples of VSS.
789490	794470	You can see that in the first picture here, you have a VSSID.
795110	798410	You know, this AP, you have this access point.
798410	803790	And then there are two nodes which will be connected to this.
803790	808750	Similarly, in ad-hoc configuration, you can see that there is no access point.
808750	813910	But, you know, these machines are connecting with each other.
816870	821270	ESS is... it consists of DS, which is connecting to access points.
821270	825190	And then it consists of two VSS also.
825450	828510	Two or more actually. Two in this figure.
829370	831670	Now coming to WDS.
831670	834390	WDS is a wireless distribution system, right?
834390	841050	So suppose you want to deploy an access point in such a location where you don't have a wire, right?
841050	843490	You don't have an Ethernet connectivity there.
843490	851170	So what you can do is you can use an access point which has wired connectivity to extend the network.
851390	858670	And this bridge or this link between these two access points is known as WDS link.
858670	860330	And then you can cover more ground.
860330	866650	So it's also known as mesh networking in Wi-Fi, if you read about it.
867990	873510	So now there are three main type of packets in Wi-Fi.
873510	876250	First is the management packet.
876310	886390	Management packets are used to connect, to disconnect, or to manage the devices, if you want to say, on board.
886390	893830	Similarly, control packets are something which deal with the transmission control and other things.
893890	898550	But that is not something that we are going to look into a lot.
898650	906190	And the third one, data, as the name suggests, these are the packets which will actually carry the real data.
907070	910030	And then you have different subtypes in these.
910030	914310	You can read about these. This table is available on the Internet.
914310	917570	You can see that there are multiple management packets.
917570	922210	You have association request, association response.
922470	926370	And similarly, you have beacons and probes and whatnot.
929210	940970	So to summarize the Wi-Fi environment, you have an access point, which is currently operating a Wi-Fi network, which will be identified by its SSID.
940970	942670	That's the Wi-Fi network name.
942670	948930	And then the SSID will be there because the MAC address needs to be there on the access point.
949510	953470	And this SSID will then send the beacons out.
953470	965290	So beacons are the packets which your access point uses to advertise that, hey, I'm using or, you know, I'm providing you the specific Wi-Fi that you can use.
966170	974890	If a client has already connected to this Wi-Fi, instead of waiting for a beacon frame, it can also do probing.
974890	985490	So by probing, it sends a probe message looking for that specific network, which it already connected to once or multiple times in the past.
985490	997710	So once your client discovers the Wi-Fi network, then it goes ahead, it exchanges some packets with the access point, and then it connects with the access point.
997710	1002970	And, you know, after that, you can transmit data, you can access Internet and other things.
1004470	1009510	So now, because, you know, it was not the wired thing, it's wireless, right?
1009510	1018290	Your packets are open, anyone with the monitor mode interfaces can capture it and then, you know, can look into what you are doing if it is not encrypted.
1018290	1029850	So that's the reason why we needed Wi-Fi encryption standards, so that we can protect our data from being sniffed by other people, right?
1030250	1040870	At your home, it might not matter. But, you know, especially if you are at a coffee shop, if you are at your office, if you're at an airport, all of this matters, right?
1041810	1048870	So here are some of the standards that we are going to talk about. We are going to talk about WEP. That was the oldest standard.
1049610	1061270	I hope that no one is using it now, but still, you know, you will find it somewhere in a CTF or in someone's home who is not very tech-savvy or, you know, old.
1061970	1074470	WPA, WPA2 are the ones that are currently used. These can be used in two different configurations. One is the PSK or pre-shared key.
1074470	1084810	It's also known as WPA or WPA2 personal, because it is meant to be personal use. And then there's enterprise one, which is meant for enterprise use.
1084970	1098930	WPA3 is the latest standard. It is something that you will see in mainstream, you know, within a year or maybe this year. In some places, you might have already been started seeing this.
1100170	1113250	So now to do the recon and the cracking for WEP and WPA, PSK, we are going to use Aircrack-NG suite of tools.
1113250	1130010	So it's a set of tools which allows you to do different things. So Aerodump-NG and Airmon-NG will allow you to capture the traffic, you know, to monitor the waves, to see the devices, access points that are in the vicinity.
1130590	1139430	Airbase-NG and Airreplay-NG allows you to create a honeypot to send deauthentication messages, to replay the messages.
1139430	1150150	And similarly, if you want to crack the key or the passphrase for WEP or WPA-PSK, you use Aircrack-NG.
1150270	1158730	So you can know more about these by searching about these on Google. This tool is used a lot. So you'll find multiple videos on it.
1159670	1166730	So now we'll talk about how to do basic recon with Airmon and Aerodump.
1168710	1176410	So now it's the demo time. And for that, we will shift to our demo setup.
1177150	1194130	So this is the portal that we are going to use to learn about these attacks. The URL is blurred. As of now, don't worry about it. We'll post the link to it in the YouTube description part.
1194850	1203150	So if you go down, you'll see that we have a course here which says Wi-Fi Basics Workshop.
1203150	1215670	You press start on it. It will show you four different scenarios. First is the Wi-Fi basics and then you have attacking WEP, you have attacking WPA2 Enterprise and PSK.
1216070	1220150	So we are going to start the Wi-Fi basics one.
1220690	1229310	So we chose this interface because, you know, as you can automatically see, you have commands on this side, you have lab on this side.
1229310	1235170	So it will help you to learn because, you know, you are the beginner people. So it really helps if you have guidelines ready.
1235170	1243270	Instead of searching on it on a blog and then coming back and then pasting and making mistakes and going back. Right. That actually wastes a lot of time.
1243930	1251730	So what we will do now, we will select a server from here. In your case, you might only see one option.
1252930	1265440	Solve this recapture. And then you start the lab.
1266460	1270820	It will take some time in starting the lab, so please be patient.
1272760	1281600	So the lab is ready now. What we have to do is on the left hand panel, we will read about the steps.
1281920	1286440	So first is check Wi-Fi interfaces present on this system.
1286540	1291300	And then to fire this, we will use this button.
1291740	1299300	Oh, please use Firefox for this exercise. It might feel it might face some issues on Chrome and others.
1299300	1309180	So if you click this, the command will execute and you will see that we have a WLAN0 interface, which is in managed mode.
1309180	1314300	So as we discussed before, managed mode is good for normal operation.
1314300	1321160	But if you want to do the recon and the sniffing and other things, this won't be enough.
1321320	1328100	So you have to put it in monitor mode. And that's what we are doing in step two.
1328100	1332160	So this is the command to put it in the monitor mode.
1332160	1340480	As you can observe, IWDEVWLAN0, the name of the interface, and then set monitor now.
1340480	1347480	So I'll press this. And it seems that the command has run.
1347840	1352900	Now, let's again run this command to see if it is in monitor mode.
1353600	1356540	Yes, it is. So we are ready now.
1356540	1362320	So now what we will do, we will run aerodump-ng on WLAN0.
1362400	1365640	And we will not define any other options for now.
1365640	1372200	We will let it jump on all the channels of 2.4 GHz and find what it can.
1372640	1383260	So press this. And as you can observe here, now it is looking for different ESSIDs or SSIDs.
1383260	1388420	You can also see the corresponding ESSIDs, corresponding channels.
1388520	1396340	And you can also see some of the stations, which means these are laptops or these can be phones.
1396340	1400460	In this case, this is emulated lab, so obviously these are none.
1400460	1409920	But in realistic scenario, you will see the phones, the laptops, other machines, sending probe requests, looking for the specific Wi-Fi.
1410800	1417860	Right. So this is how you can check which devices are in the vicinity.
1418340	1421720	So do a CTRL-C to stop it.
1421760	1425120	And then let's move to the next screen here.
1425880	1432680	Now suppose I am only interested in looking at traffic of channel 1.
1432680	1436000	So in that case, I can fire this command.
1436000	1442200	And here with argument-C, I have defined the channel number.
1443260	1447360	So what you will see here is this time this channel will not jump.
1447540	1453400	And you will only see the traffic which is coming on this specific channel. Right.
1454520	1461180	So this is how you use AeroDump to do basic recon.
1461700	1464980	And with this, our lab is done.
1466000	1467500	We will stop the lab after this.
1467900	1469900	And we will get back to the slides.
1473250	1479570	So now I will pass it over to my colleague Jaswin who will go through the WEP part.
1480070	1486430	And then I will meet you guys again when we will discuss WPA2-PSK and WPA2-Enterprise.
1486850	1492530	Hello everyone. Next we will take a look at WEP, Wired Equivalent Privacy.
1492530	1499510	When it comes to wired network, the physical proximity itself acts as a security mechanism.
1499650	1508370	That is, we need to get into the building physically, find a port, plug in our device and sniff the traffic or perform an attack.
1508450	1514470	Whereas in case of wireless networks, we have radio waves which are not bound by walls.
1514530	1517990	Therefore, it is very easy to intercept the traffic.
1517990	1524010	WEP was the original IEEE standard to add security to wireless network.
1524010	1529190	It provided security equivalent to that of wired network and hence the name.
1529990	1534910	WEP used RC4 stream cipher for generating the key stream.
1534910	1542370	It supported 40-bit shared key which is equivalent to 5 ASCII characters or 10 hexadecimal characters.
1542370	1548630	And a 104-bit shared key which is equivalent to 13 ASCII characters or 26 hex characters.
1549510	1562050	Now, if the same key is used to encrypt multiple plain text messages, what the attacker can do is analyze the ciphertext to generate the pattern and the attacker can ultimately find the key.
1562370	1566310	To prevent this, an initialization vector is added to the key.
1566310	1571570	In case of WEP, the initialization vector had length of 24 bits.
1571570	1577730	Therefore, the encryption key had the length of 64-bit or 0.28-bit.
1578230	1582770	WEP used CRC32 for generating the integrative check value.
1582770	1585430	Now, let's take a look at the encryption process.
1585590	1590370	So, here we have the initialization vector, key and the message.
1590370	1597690	The initialization vector and key is passed to the key scheduling algorithm and the pseudo random number generator.
1597690	1602470	It generates the key stream which will be used to encrypt the data.
1602470	1604850	For the second part, we have the message.
1604890	1614390	The integrity check value is generated of the message and is concatenated with the message and then it is encrypted.
1614450	1622690	The integrity check value is generated so that after decryption, we can verify that the message has not been tampered with.
1622690	1631830	So, finally, the message and the ICD is XORed with the key stream to generate the ciphertext.
1631830	1638670	In the end, the packet has initialization vector, 2-bit key ID, ciphertext and ICD.
1638670	1641510	Now, let's take a look at the decryption process.
1642070	1648590	In the decryption process, we have initialization vector, 2-bit key ID, ciphertext and ICD.
1648590	1656770	We'll get the key from the key ID and we'll feed it to the key scheduling algorithm along with the initialization vector.
1656870	1663860	This is further passed to the pseudo random number generator and the key stream is generated which will be used to decrypt the ciphertext.
1664290	1671610	The ciphertext is XORed with the key stream to generate the message and the ICD.
1671610	1679730	Now, the ICDs are compared and if both of them match, the packet is considered. Otherwise, it is discarded.
1680310	1684270	Now, the next question arises, what was the weakness of WEP?
1684370	1692570	The major weakness in WEP was the length of the initialization vector. 24-bit was not enough.
1692790	1698290	And as a result, when we have large number of packets, the ID will get repeated.
1698290	1707610	And once the attacker has all of these ciphertexts with repeated IDs, the attacker can easily find out the shared key.
1707610	1715190	Now, the attacker has two options. One is to wait and sniff all the traffic till we get enough number of IDs.
1715190	1725730	Or the attacker can inject a packet to force the access point to send more packets and therefore the attacker will get more number of IDs.
1725730	1732030	And this way, the second option fastened the process and made it possible to crack any WEP key.
1733710	1746410	Now, to crack a 64-bit WEP key, usually 250,000 IDs are required. And to crack a 128-bit WEP key, 1.5 million IDs are required.
1746410	1754090	But with the technique such as PDW, it is possible to crack WEP keys with a very less number of IDs.
1754090	1765850	So, to crack WEP keys, there are many methods. Few of the methods are break authentication, capillarity attack, chop-chop attack, fragmentation attack, and PDW attack.
1766770	1774790	Now, in order to crack the WEP key, we will start by sniffing the traffic, identifying the SSID, VSSID, and the channel number.
1775150	1782350	Now, in order to send packets to the access point, the MAC address of the attacker has to be authenticated with the access point.
1782350	1787370	Otherwise, any packet we send will get blocked and will get a deauthentication.
1788090	1793810	Now, in order to authenticate the MAC address, fake authentication can be used.
1793810	1804770	So, what happens in fake authentication is, we tell the access point that we can prove that we have the shared key, but we will not send the shared key yet.
1804770	1814650	This way, the access point will add the MAC address of the attacker to the list of clients who can send packets to the access point.
1815150	1822670	Now, since we have not sent the shared key to the access point, we cannot transmit data.
1822690	1830770	However, we can capture the data from the legitimate client connected to the network and then replay those packets.
1830770	1833310	Now, this is exactly what we are going to do.
1833310	1842490	First, we will capture the op request sent by the already connected client and then we will replay it to the access point.
1842870	1851470	So, when the access point gets the op request, it will rebroadcast the op request with a new initialization value.
1851470	1861670	This way, we can continuously send op requests to the access point to get more and more op requests with new initialization vectors.
1862050	1869190	Once we have enough number of initialization vectors, we can use aircrack-ng to crack the web key.
1869190	1872150	So, now let's take a look at a demo.
1872150	1876350	So, we will quickly select the server and install the capture.
1881040	1885540	Then we will start the lab. It should take a couple of seconds for the lab to come up.
1886940	1891140	The lab is now ready. Let's increase the size of the pond.
1891220	1894480	We will start testing the interfaces on the machine.
1894480	1899140	So, we have two interfaces. One is wlan1 and another is wlan2.
1899140	1905200	Both are in managed mode. So, we will set wlan0 into monitor mode.
1905720	1908280	And we will check the list of interfaces again.
1908780	1912800	So, now we can see wlan0 is in monitor mode.
1912900	1916760	Now, let's check the networks which are present in the vicinity.
1916980	1919800	We can do this with the help of aircrack-ng command.
1920260	1927140	So, now as you can see, we have epic-media-proc, which is using VIP on channel 6.
1927640	1934720	So, next, what we will do is we will start a capture in channel 6 and write these packets into capture file.
1934720	1940720	Now, if we just keep sniffing, it could take a lot of time to get enough number of packets.
1940780	1949200	So, what we are going to do is, we will start a pre-play attack in order to generate more number of packets.
1951950	1955530	So, we will start our pre-play attack.
1955910	1959870	And now we need around 10,000 data packets.
1961690	1966850	Currently, we can see we have 83,132 and the number increased.
1966910	1970430	So, now we have 10,000 data packets. We will stop the capture.
1970750	1975170	And we will also stop attacking the access point.
1975170	1980090	Now, we will use aircrack-ng command to crack the IP.
1980230	1983330	We will have to mention which network we want to target.
1983330	1989130	In this case, we have epic-media-proc, which is having the index of 4.
1989130	1991070	So, we will enter 4 now.
1991530	1993750	And then, we will start cracking.
1995410	1997730	So, we were able to find the key.
1998330	2001670	The key was 14332.
2006840	2012440	So, guys, welcome back. I hope you enjoyed the WEP session.
2012680	2016020	So, now we will talk about WPA2-PSK.
2016020	2020700	This is the scheme that is widely used. You will find this at your home.
2020700	2027060	And even in the smaller coffee shops or the restaurants or even the small offices.
2027400	2031680	So, WPA2 came after WPA.
2031680	2037740	WPA was a transitional scheme to move from WEP to WPA2.
2037740	2043020	So, WPA2 uses dynamic keys unlike WEP.
2043020	2048840	It uses AES encryption standard with CCMP mode in the CCMP mode.
2048840	2051800	And the protocol is still secure.
2051800	2058960	It is prone to passphrase brute forcing or the dictionary attacks if your password is not strong.
2058960	2062680	But apart from that, the scheme is still secure.
2062680	2070880	There were crack attacks that were discovered last year, which was for this specific scheme.
2070880	2076280	But again, it is very important to understand that the problem was not in the scheme itself.
2076280	2078020	It was in the implementation.
2078020	2084540	So, the scheme, theoretically, if you choose a good strong password, it is good to go.
2084540	2088580	But WPA2 also had its own shortcomings.
2088580	2098140	It doesn't have forward secrecy, which means if I'm capturing all of your traffic today and if you're using WPA2-PSK,
2098140	2106720	even if I don't have the password today, if I somehow manage to get the password two months after or two years after,
2106720	2110300	I can still go back and decrypt all of your traffic.
2110360	2114340	So, that is not good from security point of view.
2114400	2117140	Similarly, there is no management frame protection.
2117420	2126500	So, your receiver, when he receives a management frame, he doesn't have any way to tell that if it is coming from a real source
2126500	2131780	or it is something which is sent by a hacker or a malicious user.
2131780	2142480	And that's the reason why the deauthentication attacks, which are used widely for Wi-Fi DOS, the denial of service, work.
2142480	2145040	So, you can read about deauthentication attacks.
2145040	2146300	It's very common now.
2146300	2148920	It's been used for quite some years now.
2149180	2154560	And also, WPA2-PSK or personal is supposed to be personal.
2154560	2157400	It is supposed to be used in a personal network.
2157400	2167980	So, if you use it in a work environment or some place which you don't count as a personal space, it is also prone to insiders.
2168140	2175000	So, if you have a malicious insider, he can actually see the traffic of all the people on that specific Wi-Fi.
2176160	2181420	So, as we mentioned before, there are no static keys like WEP.
2181420	2184500	So, idea is you generate a dynamic key.
2184500	2188680	You use that to decrypt the traffic or encrypt the traffic.
2188920	2193600	And then, you know, next time when you do this, you again generate the keys again.
2194220	2202220	In saying it's very easy, but you need some way in which both the parties can have the keys.
2202220	2205480	And then they can use them to encrypt and decrypt stuff.
2205480	2208040	And obviously, this key needs to be the same, right?
2208040	2210680	Because we are going to use the symmetric encryption.
2210680	2211800	We have a lot of data.
2211920	2216540	So, what we do in this case is we use something called PSK.
2216540	2218640	That's where the PSK terms come.
2218640	2220060	It's pre-shared key.
2220060	2228880	So, you have a passphrase, which is, you know, between 8 to 63 letters long or characters long.
2228880	2230320	And you use it.
2230320	2232860	You feed it to pbkdf2.
2233040	2235420	pbkdf2 is a function.
2235420	2239460	It stands for password-based key derivation function.
2239460	2244680	And it will actually give you a pre-shared key of 256 bit.
2244800	2249420	The reason of doing this is passphrases are easier for human beings.
2249420	2252540	Just like you have IP to domain mappings.
2252540	2256700	Similarly, you can use passphrase to generate the pre-shared key.
2256700	2263220	It's easier to remember something meaningful than, you know, than a chunk of random hex characters.
2264000	2269700	So, when your access point is configured, it already knows the passphrase.
2269700	2273480	When you connect to that network, you also know the passphrase.
2273520	2274980	And that's how it works.
2274980	2281920	So, both the parties, they can calculate the same PSK and then they can use it for connection.
2282120	2289620	But again, as you can observe, PSK is not transient or not temporary in nature, right?
2289620	2291260	It's not directly generated.
2291260	2297560	You are converting it from the passphrase to the PSK, but that's not dynamic nature, right?
2297740	2301860	It will remain same till the time you will not change the password, right?
2301860	2309880	So, that's where we have to generate something else, which we refer to PTK from this.
2310320	2314560	So, PMK is derived using this specific function here.
2314560	2316580	You use PBKDF.
2316580	2319220	You pass it the secret passphrase.
2319240	2321240	You pass it the SSID name.
2321860	2324640	And then the SSID name length.
2324880	2328680	And then these numbers are there, which is 4096.
2328680	2331260	It's the number of iteration that will happen.
2331280	2336500	And then 256 is the intended key length for the PMK key that we are going to get.
2336500	2341260	So, you can read more about PBKDF and all of this in RFC 2898.
2342260	2349100	So, what will happen in WPA2 or even in WPA, we have this handshake.
2349100	2350740	We call it four-way handshake.
2351260	2361040	And this handshake is used to generate this specific temporary key that you use to pass the traffic on securely, obviously.
2361460	2366160	So, when you have a client, it wants to connect to the access point.
2366160	2368560	First of all, it will locate the access point.
2368560	2370760	It will locate the Wi-Fi network.
2370760	2378140	And after that, there are authentication and association messages, which are part of Wi-Fi protocol.
2378140	2383980	But here, please don't confuse authentication with the thing that we are going to do now.
2384140	2389260	So, it's more of a compatibility kind of thing rather than security.
2389440	2392460	So, first four steps are pretty much the same.
2392460	2397080	Your client, it will ask the AP that, hey, I want to connect.
2397080	2399360	And your AP will say, okay, go ahead.
2399380	2400660	So, this much is done.
2400660	2404080	After this, both of them have pre-shared key.
2404080	2406700	Why? Because both of them had passphrases.
2406700	2411100	And when you have passphrases, you can derive PSK of 256-bit format.
2411100	2413720	We just saw it in the previous slides.
2414320	2417620	Now, your access point will send message 1.
2417620	2418780	It's the first message.
2418780	2419880	There are four messages.
2419880	2421940	That's why it is four-way handshake.
2422040	2428340	So, in first message, it will generate a random number or a random string.
2428860	2430780	It will call it anons.
2430820	2436460	And it will send it in a packet in plain text to the supplicant.
2436700	2438560	Supplicant here is the client.
2438560	2441460	Your mobile, laptop, you know, whatever it is.
2441580	2445620	Now, what your client will do, it will take these anons,
2445620	2451080	and it will also generate a random number or random string called snons.
2451080	2454860	So, A here denotes to the authenticator or the access point.
2454980	2459500	S here denotes the supplicant or this station.
2459940	2465000	So, when you have snons and anons, which are randomly generated,
2465000	2470020	you can use this specific function here to generate the PTK.
2470100	2473840	PTK is the Pairwise Transient Key.
2474220	2478020	And as you can observe here, we passed PMK to it.
2478020	2486760	PMK is nothing but a key that we derived using the passphrase and SSID and SSID name length.
2486820	2490020	And then you have anons and snons.
2490020	2493800	These are randomly generated by access point and the client.
2493800	2498380	And then you have access point MAC and the client MAC.
2498380	2504240	So, this is the information which is now used to generate a temporary key.
2504300	2509640	This is temporary because anons and snons are randomly generated.
2510980	2513840	So, now this happens.
2513840	2516660	So, this guy can generate a PTK.
2516660	2521900	Now, what it will do, it will send snons plus MIC.
2521900	2526960	MIC or Michael is used to verify the integrity of a message.
2527220	2528740	And it is signed by a key.
2528740	2535460	So, in this case, the key that we have used, that we have generated, is used to sign this message.
2535780	2539640	And again, anons and snons are in plain text.
2539820	2542200	So, it will be sent to the access point.
2542340	2544680	Now, access point has all the information.
2544680	2546580	So, it will also generate PTK.
2546660	2549580	So, what it will do, it will generate its PTK.
2549580	2551480	It will check this MIC.
2551480	2557340	And then it will generate MIC for this specific packet and match the MIC to MIC.
2557620	2565200	Now, if this MIC matches, it means the PTK is same with the both parties.
2565280	2569740	In that case, access point will go ahead, install the key for use.
2569740	2575240	And it will also send a message to the client that, you know, this key is good.
2575240	2576820	Please go ahead with it.
2576820	2584520	And then client will also say, okay, I have installed the key and now we can use this key for encrypting the traffic.
2584560	2586100	And then the encryption starts.
2586540	2600720	Now, if suppose the access point, if it does not have the same PMK, you know, the passphrase is different for access point and the client, then the PTK will be different.
2600720	2603560	Because, you know, it depends on PMK, right?
2603560	2605480	Then the MIC check will fail.
2605480	2609480	And in that case, access point will reject it and it will not connect.
2609840	2614960	So this is how the authentication works in WPA four-way handshake.
2617410	2621150	So again, to reiterate, you have the PF passphrase.
2621150	2622930	You use PBKDF.
2622930	2628870	You put it, you gave it SSID name, length, and you generated a pre-shared key.
2628870	2630910	That is 256 bit in length.
2630990	2635070	And then from four-way handshake, you get all of this information.
2635210	2639770	You get S-nones, A-nones, because again, these are transmitted in plain text.
2639770	2640990	There is no encryption.
2641450	2645890	And then APMAC and ClientMAC is something that you can easily see.
2646310	2648510	And from there, you will generate the PTK.
2648510	2651050	You will use the PTK to encrypt the traffic.
2651330	2662110	So now, from an attacker's angle, if you want to perform an attack, a dictionary attack to guess the PTK, how you will do it?
2662110	2663770	You will take a dictionary.
2663770	2668210	You will take one passphrase from dictionary at one time.
2668450	2676410	And you will generate the PTK, because obviously, you also need to have this information, which will come from four-way handshake.
2676410	2679930	Once you have this, you can generate the PTK.
2679930	2685430	You have a packet from the real access point on client, which has MIC.
2685430	2687230	You will generate the MAC.
2687230	2690250	You will generate the MIC.
2690250	2692590	And then you will compare the MIC.
2692590	2697590	If MIC is correct, then you have done it.
2697590	2700790	You have got the right passphrase for it.
2700790	2702970	So this is how the dictionary attack will work.
2703530	2706490	Now, look at the information what we need, right?
2706490	2711690	So all packets will have AP and ClientMAC, because, you know, one is sender, one is a receiver.
2712470	2716270	A-nonce is going in packet one and packet three.
2716510	2719350	And S-nonce is going in packet two.
2719350	2728190	So now, what you can do here is, you can either take all four packets, or you can either take packet one or two.
2728190	2733650	And you will have all the information that you need to crack WPA2-PSK.
2734290	2737670	And again, deauthentication, we already talked about it.
2737670	2742090	It's a packet that you send, you know, you spoof it.
2742090	2746910	You send it to client from posing as, you know, access point.
2746910	2750810	If you are sending it to access point, you will pose as, you know, one of the clients.
2750910	2756270	And then you will tell the other party that, you know, I don't want to be connected to you anymore.
2756930	2763850	So in that case, the other party will think that this message is being sent by the real party and, you know, it will disconnect.
2764430	2773430	So this comes handy when you have access point connected with a client and you want this to move so that you can capture the four-way handshake.
2773430	2779790	Because remember, four-way handshake will only take place when you are connecting to the device first time.
2779810	2784390	When you are connecting to the access point, only then your client will do the four-way handshake.
2784390	2787910	If it's already connected, there is no need to do the four-way handshake.
2788010	2795190	So if we want to capture four-way handshake for our device, which is already connected, we have to do a deauthentication.
2797050	2801470	So now it's the demo time. We will do this using the same lab.
2801470	2808230	The principles are very simple. WPA-PSK is using a weak passphrase, which is present in our dictionary.
2808510	2812610	We will capture the four-way handshake and then we will attack it.
2813310	2815530	So let's move to the lab.
2817290	2820890	So let's go to attacking WPA-2-PSK.
2822130	2825510	Again, you have to select a zone from here.
2827470	2830770	Prove to this guy that you are not a robot, you are a human.
2832410	2835290	And then start the lab and wait.
2835690	2839050	And the lab is ready. We'll follow the same drill.
2839310	2843230	First, let's check the Wi-Fi interface.
2843250	2849090	There is a Wi-Fi interface in managed mode and its name is WLAN0.
2849530	2851610	We'll put it in monitor mode.
2852050	2854410	Let's check if it is there.
2854670	2856650	Yes, it is in monitor mode.
2856650	2862630	Now let's run AeroDump on WLAN0.
2862870	2873610	And here we can observe that this is the SSID protected network, which is using WPA-2-PSK.
2873910	2879770	So let's press CTRL-C and move to the next step.
2881840	2887360	SSID protected network is the one that we want to do the attack on.
2888020	2893680	So for that, what we want to do is we need to capture the four-way handshake, right?
2893980	2897480	So it is running on channel 4.
2897480	2906280	So what we will do, we will run AeroDump packet capture on channel 4 using this command.
2907200	2910680	And as you can observe, it is now doing that.
2913770	2922170	If you wait for some time, it will also find the client that is attached to this specific machine.
2922430	2925730	If you are not able to see it, don't worry.
2925730	2931750	We will do a broadcast deauthentication on this VSSID and then also it will work.
2931750	2940310	But, you know, as you can observe here, AeroDump has found one client that is this client connected to this VSSID.
2940310	2946490	Now, if you remember to capture the four-way handshake, we need to disconnect it, right?
2946490	2950330	And for that, we are going to use deauthentication packet.
2950970	2956090	And so we can launch it from the next tab, open a new tab.
2956370	2966950	You can use the same WLAN0 interface to do this because, you know, you have set WLAN0 on channel 4 and you want to send this packet on channel 4 as well.
2966950	2970010	So click on this.
2970090	2980910	And you will see that AeroPlayNG is sending deauthentication packets, 100 packets, to this specific VSSID.
2981170	2984970	Let's do control-C because I think these are enough.
2985770	2989170	And let's go back here.
2989210	2995930	And now what happened when we did this is this guy here, it was disconnected.
2996590	3001510	And then it reconnected once we stopped the deauthentication attack.
3001510	3006410	And when it did that, we captured handshake for it.
3006870	3008850	So now we have handshake.
3010030	3013530	You can also, you know, run commands on it if you like to.
3014730	3019070	So you can observe that we have the file, the capture file here.
3019070	3023610	We also have this specific dictionary here, which we will use to crack it.
3023610	3029430	So now we can go ahead and try to crack it.
3029430	3038750	We'll use AeroPlayNG with this dictionary and test-01.cap is the capture file.
3038750	3041990	So run it. Attack is running.
3042010	3045130	And we have found the right key.
3045450	3048790	So the right passphrase is Raspberry.
3049190	3052170	So with that, this demo is done.
3052170	3060170	This is how easy it is to attack it if you are using a weak passphrase.
3063750	3069470	So after WPA2-PSK, now we will talk about WPA2-Enterprise.
3070150	3076010	We already learned about the shortcomings of WPA2-Personal.
3076030	3080730	These are not really shortcomings, but it was designed in such a way.
3080730	3083470	It was designed for personal spaces.
3083470	3091510	So it was assumed that whoever is using the network, you don't need to hide your information from them.
3092130	3100250	So that's the reason why same password was there and all the other people on the network had the capability to decrypt your traffic.
3100310	3107670	But if you want to use this for your enterprise or for your company, this is going to be a problem, right?
3107670	3110930	Because first thing is this insider threat.
3110930	3116530	And the second thing is it is difficult to maintain the credentials because everyone is using the same passphrase.
3116530	3120530	Now, suppose if this passphrase gets leaked, you have to change it.
3120530	3125530	You have to inform everybody and you have to keep doing this again and again, right?
3125730	3131590	So for that, these people came up with WPA2-Enterprise.
3131590	3139930	So in WPA2-Enterprise, instead of using a passphrase, a RADIUS server is used for authentication.
3140330	3145650	So this RADIUS server will maintain the credential list for all the authorized users.
3145650	3152070	And then users can use their username, passwords to authenticate with the Wi-Fi.
3152910	3155850	So it looks like this.
3155850	3162030	So you have your Wi-Fi client, that is, you know, a laptop or a PC.
3162030	3166550	And then you have the access point which is connected to the RADIUS server.
3167130	3170530	So this RADIUS server is the authentication backend here.
3173240	3176060	And then this is the handshake flow.
3176060	3180040	So four-way handshake will be there because, again, it's WPA.
3180340	3187180	But in this case, because there is no passphrase, EAP will be used.
3187800	3190540	EAP is Extended Authentication Protocol.
3190900	3197050	So EAP will be used to do authentication with the authentication server, that is, the RADIUS server in the backend.
3197700	3205260	So your client, after doing the connection ritual, it will send a EAP poll start, which is the first packet.
3205380	3208220	And then access point will ask it for its identity.
3208220	3213540	So, you know, if you're using credentials, the username will be the identity.
3213540	3218320	And this username will be then forwarded to the authentication server.
3218440	3226980	So after this, the access point, you know, will be in the path, but it's not really doing anything.
3226980	3230880	Your client and the authentication server will exchange some packets.
3231100	3241260	And once it is proved to the authentication server that this guy or this client is the real client, it will generate a PMK.
3241260	3247960	It's randomly generated, and then it will send this PMK to the access point and to the client.
3248280	3251520	So you can observe the difference from the PSK here.
3251520	3257240	It is not being generated from the passphrase that was known to both parties.
3257680	3266080	And after, you know, you have PMK on both the parties, you will do the same four-way handshake and then, you know, data transfer will continue.
3266080	3273600	Now, the scheme that we are going to talk about in this demo is a PEEP-MSCHAP-V2.
3273600	3278120	So PEEP stands for Protected Extensible Authentication Protocol.
3278180	3292920	It is known as protected or it is being referred as protected because all the EAP packets that will be exchanged between your client and your authentication server will go through a TLS tunnel.
3292920	3297300	So even access point cannot look into it, right, what it is sending.
3297740	3306880	And then MSCHAP, MS obviously stands for Microsoft, and then CHAP is Challenge Handshake Authentication Protocol.
3307020	3316060	So it's a challenge response authentication protocol where one party will send a challenge and then the other party will send response and then, you know, they'll verify each other.
3316140	3317400	So it's like that.
3317400	3324000	So the user account credentials, the password and the username will be used.
3324000	3332360	A TLS certificate will be used to create the tunnel and to make sure that the client is connecting to the correct authentication server.
3334650	3337450	So this is how it looks.
3338270	3347610	So till here, you can see that the request identity is asked by the RADIUS server or the access point, and then the username is provided.
3347610	3352250	After that, it requests for the PEEP. RADIUS server is initiating PEEP.
3352250	3355270	And then a TLS tunnel will be set up.
3355270	3359450	So this certificate will be sent by the authentication server to the client.
3359490	3365590	And the client, if it accepts it, after that, it will do the MSCHAP challenge.
3365590	3368850	So the challenge will be sent by the RADIUS server.
3369250	3374530	Your client is supposed to provide a response and send it to the RADIUS server.
3374530	3382990	The RADIUS server will check it. If it is good, then EAP success will be conveyed and the PMK will be shared with the station.
3383370	3394130	And on the same time, it will also share the PMK with the access point because PTK is the key that will be generated by the station and the access point.
3394130	3396270	So RADIUS has nothing to do there.
3397930	3401610	So now if you want to attack it, what are the ways?
3401850	3413690	So what you can do is, instead of making the client connect to the real access point, you can create your own honeypot or fake access point or evil twin.
3414070	3420590	And when the client will connect to it, obviously, because you don't have access to the real RADIUS server.
3420590	3425390	Because if you had that, you could have taken credentials from there, right? You don't have that.
3425550	3429350	So what you will do, you will emulate a fake RADIUS server.
3429850	3436790	Which will say yes to all the credentials, right? And then here you are relying on the client that it will provide the real credentials.
3437170	3442470	But before that, there is a problem with EAP, right? Because there is a TLS tunnel.
3442470	3451210	And because the certificate that your fake access point or fake RADIUS will send, it will not match the real certificate.
3451210	3458850	So your client will actually get a warning that this certificate doesn't match or we don't know this certificate.
3458850	3471110	So at that point, if your client or if your user, he accepts this fake certificate, a non-real certificate, then you are in a problem.
3471110	3474330	If you don't do this, then you are again safe.
3474470	3480970	So you can say that this attack is a combination of technical as well as social engineering angles, right?
3481090	3489270	So we are going to do this attack, but to keep it simple, what we will do instead of creating an evil twin, we will create a honeypot.
3489270	3494630	So you don't have to do the deauth and all those things.
3495810	3499590	So for that, we are going to use Hosteo PD Mana Toolkit.
3499690	3503950	So it's a tool which can be used to create the rogue access point.
3505030	3514050	It is generally used mainly for the enterprise networks because, you know, it will keep the hassle of creating a RADIUS and all, you know, away from you.
3514050	3519850	You can directly go, you can fire three or four commands and, you know, you are good to go. You are good to do attack.
3521590	3523870	So let's go for the demo now.
3524630	3529510	So here, go for the attacking WPA2 enterprise.
3530150	3536130	Same drill. You have to select the server. You have to prove that you are a human.
3536770	3540770	And you might have to solve this, a recapture.
3545420	3547640	So now the lab is ready.
3548360	3553100	So let's see what interfaces are there on the lab.
3553220	3558360	So here we can observe that there are two interfaces, WLAN0 and WLAN1.
3558400	3562580	Let's put WLAN0 into monitor mode.
3562960	3565580	And let's run aerodump on it.
3566880	3575200	So what we can observe here is there is a client which is looking for AMAZE underscore LLC.
3575620	3581720	So if we go to next step, we will see that the challenge is regarding this only.
3581720	3585140	A client is probing for AMAZE underscore LLC.
3585140	3591340	We have to create a honeypot and then we have to steal the credential for it.
3591340	3595700	And this guy is using peepmschapv2.
3597240	3600280	So let's do a control C here.
3601080	3605080	We will also need the fake certificates as we talked about before.
3605820	3610500	And there you go. We have provided you all the things that you need for this.
3610500	3612920	If you scroll down.
3613500	3619540	You will also see the configuration for the hosted PD mana.
3620160	3622520	So what you have to do here is.
3622520	3625760	First, you have to create this file.
3626580	3628800	So I'm using VIM.
3629140	3634660	VIM is mostly available in most environments, so you can use that.
3636220	3638660	And let's copy this.
3639460	3640920	And paste it here.
3643640	3646540	And you have to format it.
3646540	3650640	You have to make sure that everything is in separate lines.
3650640	3652100	Let me do that.
3652100	3654720	So now I have done the formatting for this file.
3654720	3657020	Let's go over the configuration file.
3657240	3658920	So first is the interface.
3658920	3660900	We are using WLAN1.
3662200	3664000	SSID is mentioned.
3664000	3668020	We want to host a honeypot with AMAZE underscore LLC.
3668660	3670980	And you can choose channel as per your liking.
3670980	3672880	I have chosen 6 here.
3673560	3677840	Hardware mode is G, which indicates the 11G.
3678580	3682960	And then WPA3 means WPA2.
3683680	3688520	And here we are using management TKE.
3688960	3690600	Here you can put CCMP.
3690600	3691980	You can put something else.
3692520	3695140	So yeah, there's a mistake.
3696030	3703340	When you put TKCCMP, which means you support both WPA and WPA2-PSK.
3704400	3709020	And then, you know, for 1X, 1X is the EAP.
3709020	3714000	And you're also hosting a fake backend server.
3714000	3722450	And for that, we'll provide a special configuration in this file, which can be then used by our hosted PD Mana.
3722450	3726570	And here you can observe the certificate, the key.
3726590	3736990	All of that is provided so that when the tunnel forms, you know, the setup can get the information and then show us what it is.
3738030	3748210	Mana EAP success actually signifies that doesn't matter what kind of credentials the user provides, we will always tell him that these are the correct ones.
3748690	3750730	So this file is done.
3750730	3753030	Let's create the second file.
3756920	3763640	Let's move a little low and copy it from here.
3766030	3767330	Paste it.
3769230	3778310	So to know more details about these configurations, I'll suggest you visit hosted PD Mana's GitHub page.
3778490	3781430	The link to the documentation is also given here.
3781430	3782490	So check that out.
3782490	3784630	You will be able to understand these better.
3785090	3794290	So this configuration will make sure that doesn't matter what kind of scheme or what kind of method your EAP is using.
3794290	3803250	It will support it, even if it is a PEEP or a TTLS or TLS, or even if it is using MSCHAP or GTC or something inside.
3803250	3805070	So all of that will be supported.
3805070	3807430	So it's a catch all kind of thing.
3808160	3817520	So once it is done, we can move forward and we can launch this to start our honeypot.
3817990	3828470	So what we can observe here is on interface WLAN1, we have created a maze underscore LLC SSID.
3831090	3840230	Here, what we are observing is a client which was roaming has tried to connect to this, you know, access point.
3840470	3846250	And in that process, we are able to see the information that it was passing.
3846250	3849650	So if you remember, we talked about CHAP, right?
3849650	3851190	The challenge response.
3851190	3860030	So here, hosted PD Mana is actually giving us the challenge, the response so that we can crack it.
3860030	3862670	And the username here is Sean.
3863010	3868670	So this is the command that we need to use with asleep to crack it.
3869270	3873990	So if we move down, we have actually written this command for you.
3874110	3876350	Let's clear the screen a little bit.
3876790	3879330	And let's run this command.
3880110	3889930	So what we did here is because we had the challenge and the response captured, we used a dictionary file that is given here.
3889930	3894150	And from that, we recovered the password for it.
3894150	3897230	The password is chocolate in this case.
3897230	3910050	So this is how using a honeypot, you can attack enterprise networks, the WPA2 enterprise in this case, which was using a PMS CHAP version 2.
3910690	3915270	The attack will work similarly for the other schemes as well.
3916010	3919890	So with this, we are going to conclude this workshop.
3919890	3925910	I hope you learned about the basics of Wi-Fi and schemes and how to attack them.
3925910	3932430	And if you face these in real world or in a CTF somewhere, you will be able to solve it.
3932630	3939150	So with that, thanks again for attending our workshop in Wireless Village.
3939150	3947870	We also thanks Wireless Village and the DEF CON team to make all of this possible in this tough time.
3947970	3950910	It doesn't matter how bad it is.
3950910	3952590	The learning should continue.
3952590	3955070	And with that, I'll say thanks.
3955070	3961170	If you have any follow up questions, any comments, any feedbacks, here's my email ID.
3961170	3964890	You can drop me a mail and I'll try to help you out.
3964970	3966030	Thank you.