Time for action – enumerating wireless security profiles

1. We will assume that the wireless client has a network Wireless Lab configured on it and it actively sends Probe Requests for this network, when it is not connected to any access point. In order to find the security configuration of this network, we will need to create multiple access points. For our discussion, we will assume that the client profile is either—an open network, WEP protected, WPA-PSK or WPA2-PSK. This would mean we would have to create four access points. To do this we will first create four virtual interfaces—mon0 to mon3 using the airmon-ng start wlan0 command multiple times:

   

2. You could view all these newly created interfaces using the ifconfig –a command:

   

3. Now we will create the Open AP on mon0:

   

4. Let's create the WEP-protected AP on mon1:

   

5. The WPA-PSK AP will be on mon2:

   

6. WPA2-PSK AP will be on mon3:

   

7. We can run airodump-ng on the same channel to ensure all the four access points are up and running as shown:

   

8. Now let's switch the...