Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition
Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition

Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition: Master wireless testing techniques to survey and attack wireless networks with Kali Linux , Second Edition

Arrow left icon
Profile Icon Vivek Ramachandran Profile Icon Cameron Buchanan
Arrow right icon
Free Trial
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5 (44 Ratings)
Paperback Mar 2015 214 pages 2nd Edition
eBook
S$36.99 S$52.99
Paperback
S$66.99
Subscription
Free Trial
Arrow left icon
Profile Icon Vivek Ramachandran Profile Icon Cameron Buchanan
Arrow right icon
Free Trial
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5 (44 Ratings)
Paperback Mar 2015 214 pages 2nd Edition
eBook
S$36.99 S$52.99
Paperback
S$66.99
Subscription
Free Trial
eBook
S$36.99 S$52.99
Paperback
S$66.99
Subscription
Free Trial

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing
Table of content icon View table of contents Preview book icon Preview Book

Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition

Chapter 2. WLAN and its Inherent Insecurities

 

"The loftier the building, the deeper the foundation must be laid."

 
 --Thomas Kempis

Nothing great can be built on a weak foundation, and in our context, nothing secure can be built on something that is inherently insecure.

WLANs, by design, have certain insecurities that are relatively easy to exploit, for example, by packet spoofing, packet injection, and sniffing (this could even happen from far away). We will explore these flaws in this chapter.

In this chapter, we shall look at the following:

  • Revisiting WLAN frames
  • Different frame types and subtypes
  • Using Wireshark to sniff management, control, and data frames
  • Sniffing data packets for a given wireless network
  • Injecting packets into a given wireless network

Let's get started!

Revisiting WLAN frames

As this book deals with the security aspects of wireless, we will assume that you already have a basic understanding of the protocol and the packet headers. If not, or if it's been some time since you worked on wireless, this would be a good time to revisit this topic again.

Let's now quickly review some basic concepts of WLANs that most of you may already be aware of. In WLANs, communication happens over frames. A frame would have the following header structure:

Revisiting WLAN frames

The Frame Control field itself has a more complex structure:

Revisiting WLAN frames

The Type field defines three types of WLAN frame:

  1. Management frames: Management frames are responsible for maintaining communication between access points and wireless clients. Management frames can have the following subtypes:
    • Authentication
    • Deauthentication
    • Association request
    • Association response
    • Reassociation request
    • Reassociation response
    • Disassociation
    • Beacon
    • Probe request
    • Probe response
  2. Control frames: Control frames are responsible for ensuring...

Time for action – creating a monitor mode interface

Let's now set our wireless adapter into monitor mode.

Follow these instructions to get started:

  1. Boot Kali with your adapter connected. Once you are within the console, enter iwconfig to confirm that your card has been detected and the driver has been loaded properly.
    Time for action – creating a monitor mode interface
  2. Use the ifconfig wlan1 up command to bring the card up (where wlan1 is your adapter). Verify whether the card is up by running ifconfig wlan1. You should see the word UP in the second line of the output as shown in the following screenshot:
    Time for action – creating a monitor mode interface
  3. To put our card into monitor mode, we will use the airmon-ng utility that is available by default on Kali. First run airmon-ng command to verify whether it detects the available cards. You should see the wlan0 interface listed in the output:
    Time for action – creating a monitor mode interface
  4. Now enter airmon-ng start wlan1 command to create a monitor mode interface corresponding to the wlan0 device. This new monitor mode interface will be named mon0. (You can verify if it has been...

Time for action – sniffing wireless packets

Follow the following instructions to begin sniffing packets:

  1. Power up the Access Point Wireless Lab that we configured in Chapter 1, Wireless Lab Setup.
  2. Start Wireshark by typing Wireshark & in the console. Once Wireshark is running, navigate to Capture | Interfaces.
    Time for action – sniffing wireless packets
  3. Select packet capture from the mon0 interface by clicking on the Start button to the right of the mon0 interface as shown in the previous screenshot. Wireshark will begin the capture, and now you should see packets within the Wireshark window.
    Time for action – sniffing wireless packets
  4. These are wireless packets that your wireless adapter is sniffing off the air. In order to view any packet, select it in the top window and the entire packet will be displayed in the middle window.
    Time for action – sniffing wireless packets

    Click on the triangle in front of IEEE 802.11 Wireless LAN management frame to expand and view additional information.

Look at the different header fields in the packet and correlate them with the WLAN frame types and sub-types you have learned...

Time for action – viewing management, control, and data frames

Now we will learn how to apply filters in Wireshark to look at Management, Control and Data Frames.

Please follow the below instructions step by step:

  1. To view all the Management frames in the packets being captured, enter the filter wlan.fc.type == 0 into the filter window and click Apply. You can stop the packet capture if you want to prevent the packets from scrolling down too fast.
    Time for action – viewing management, control, and data frames
  2. To view Control Frames, modify the filter expression to read wlan.fc.type == 1.
    Time for action – viewing management, control, and data frames
  3. To view data frames, modify the filter expression to wlan.fc.type == 2.
    Time for action – viewing management, control, and data frames
  4. To additionally select a sub-type, use the wlan.fc.subtype filter. For example, to view all the Beacon frames among all Management frames, use the following filter:
    (wlan.fc.type == 0) && (wlan.fc.subtype == 8).
    Time for action – viewing management, control, and data frames
  5. Alternately, you can right-click on any of the header fields in the middle window and then select Apply as Filter | Selected to add it as a filter.
    Time for action – viewing management, control, and data frames
  6. This will automatically add the...

Time for action – sniffing data packets for our network

In this exercise, we will learn how to sniff data packets for a given wireless network. For the sake of simplicity, we will look at packets without any encryption.

Follow these instructions to get started:

  1. Switch on the access point we named Wireless Lab. Let it remain configured to use no encryption.
  2. We will first need to find the channel on which the Wireless Lab access point is running. To do this, open a terminal and run airodump-ng --bssid <mac> mon0 where <mac>, which is the MAC address of our access point. Let the program run, and shortly you should see your access point shown on the screen along with the channel it is running on.
  3. We can see from the preceding screenshot that our access point Wireless Lab is running on Channel 11. Note that this may be different for your access point.

    In order to sniff data packets going to and fro from this access point, we need to lock our wireless card on the same channel, that...

Revisiting WLAN frames


As this book deals with the security aspects of wireless, we will assume that you already have a basic understanding of the protocol and the packet headers. If not, or if it's been some time since you worked on wireless, this would be a good time to revisit this topic again.

Let's now quickly review some basic concepts of WLANs that most of you may already be aware of. In WLANs, communication happens over frames. A frame would have the following header structure:

The Frame Control field itself has a more complex structure:

The Type field defines three types of WLAN frame:

  1. Management frames: Management frames are responsible for maintaining communication between access points and wireless clients. Management frames can have the following subtypes:

    • Authentication

    • Deauthentication

    • Association request

    • Association response

    • Reassociation request

    • Reassociation response

    • Disassociation

    • Beacon

    • Probe request

    • Probe response

  2. Control frames: Control frames are responsible for ensuring a proper...

Time for action – creating a monitor mode interface


Let's now set our wireless adapter into monitor mode.

Follow these instructions to get started:

  1. Boot Kali with your adapter connected. Once you are within the console, enter iwconfig to confirm that your card has been detected and the driver has been loaded properly.

  2. Use the ifconfig wlan1 up command to bring the card up (where wlan1 is your adapter). Verify whether the card is up by running ifconfig wlan1. You should see the word UP in the second line of the output as shown in the following screenshot:

  3. To put our card into monitor mode, we will use the airmon-ng utility that is available by default on Kali. First run airmon-ng command to verify whether it detects the available cards. You should see the wlan0 interface listed in the output:

  4. Now enter airmon-ng start wlan1 command to create a monitor mode interface corresponding to the wlan0 device. This new monitor mode interface will be named mon0. (You can verify if it has been created by...

Time for action – sniffing wireless packets


Follow the following instructions to begin sniffing packets:

  1. Power up the Access Point Wireless Lab that we configured in Chapter 1, Wireless Lab Setup.

  2. Start Wireshark by typing Wireshark & in the console. Once Wireshark is running, navigate to Capture | Interfaces.

  3. Select packet capture from the mon0 interface by clicking on the Start button to the right of the mon0 interface as shown in the previous screenshot. Wireshark will begin the capture, and now you should see packets within the Wireshark window.

  4. These are wireless packets that your wireless adapter is sniffing off the air. In order to view any packet, select it in the top window and the entire packet will be displayed in the middle window.

    Click on the triangle in front of IEEE 802.11 Wireless LAN management frame to expand and view additional information.

Look at the different header fields in the packet and correlate them with the WLAN frame types and sub-types you have learned earlier...

Time for action – viewing management, control, and data frames


Now we will learn how to apply filters in Wireshark to look at Management, Control and Data Frames.

Please follow the below instructions step by step:

  1. To view all the Management frames in the packets being captured, enter the filter wlan.fc.type == 0 into the filter window and click Apply. You can stop the packet capture if you want to prevent the packets from scrolling down too fast.

  2. To view Control Frames, modify the filter expression to read wlan.fc.type == 1.

  3. To view data frames, modify the filter expression to wlan.fc.type == 2.

  4. To additionally select a sub-type, use the wlan.fc.subtype filter. For example, to view all the Beacon frames among all Management frames, use the following filter:

    (wlan.fc.type == 0) && (wlan.fc.subtype == 8).
  5. Alternately, you can right-click on any of the header fields in the middle window and then select Apply as Filter | Selected to add it as a filter.

  6. This will automatically add the correct...

Time for action – sniffing data packets for our network


In this exercise, we will learn how to sniff data packets for a given wireless network. For the sake of simplicity, we will look at packets without any encryption.

Follow these instructions to get started:

  1. Switch on the access point we named Wireless Lab. Let it remain configured to use no encryption.

  2. We will first need to find the channel on which the Wireless Lab access point is running. To do this, open a terminal and run airodump-ng --bssid <mac> mon0 where <mac>, which is the MAC address of our access point. Let the program run, and shortly you should see your access point shown on the screen along with the channel it is running on.

  3. We can see from the preceding screenshot that our access point Wireless Lab is running on Channel 11. Note that this may be different for your access point.

    In order to sniff data packets going to and fro from this access point, we need to lock our wireless card on the same channel, that is channel...

Time for action – packet injection


We will be using the aireplay-ng tool, which is available in Kali, for this exercise.

Follow the instructions below carefully:

  1. In order to do an injection test, first start Wireshark and the filter expression (wlan.bssid == <mac>) && !(wlan.fc.type_subtype == 0x08). This will ensure that we only see non-beacon packets for our lab network.

  2. Now run the following command aireplay-ng -9 -e Wireless Lab -a <mac> mon0 on a terminal.

  3. Go back to Wireshark and you should see a lot of packets on the screen now. Some of these packets have been sent by aireplay-ng, which we launched, and others are from the access point Wireless Lab in response to the injected packets.

What just happened?

We just successfully injected packets into our test lab network using aireplay-ng. It is important to note that our card injected these arbitrary packets into the network without being actually connected to the access point Wireless Lab.

Have a go hero – installing...

Left arrow icon Right arrow icon
Download code icon Download Code

Description

If you are a security professional, pentester, or anyone interested in getting to grips with wireless penetration testing, this is the book for you. Some familiarity with Kali Linux and wireless concepts is beneficial.

What you will learn

  • Create a wireless lab for your experiments
  • Sniff out wireless packets and hidden networks
  • Capture and crack WPA2 keys
  • Discover hidden SSIDs
  • Explore the ins and outs of wireless technologies
  • Sniff probe requests and track users through SSID history
  • Attack radius authentication systems
  • Sniff wireless traffic and collect interesting data
  • Decrypt encrypted traffic with stolen keys

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : Mar 30, 2015
Length: 214 pages
Edition : 2nd
Language : English
ISBN-13 : 9781783280414
Category :
Tools :

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing

Product Details

Publication date : Mar 30, 2015
Length: 214 pages
Edition : 2nd
Language : English
ISBN-13 : 9781783280414
Category :
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
$19.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
$199.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just S$6 each
Feature tick icon Exclusive print discounts
$279.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just S$6 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total S$ 208.97
Web Penetration Testing with Kali Linux 2.0, Second Edition
S$74.99
Kali Linux: Wireless Penetration Testing Beginner's Guide, Second Edition
S$66.99
Python Web Penetration Testing Cookbook
S$66.99
Total S$ 208.97 Stars icon
Banner background image

Table of Contents

12 Chapters
1. Wireless Lab Setup Chevron down icon Chevron up icon
2. WLAN and its Inherent Insecurities Chevron down icon Chevron up icon
3. Bypassing WLAN Authentication Chevron down icon Chevron up icon
4. WLAN Encryption Flaws Chevron down icon Chevron up icon
5. Attacks on the WLAN Infrastructure Chevron down icon Chevron up icon
6. Attacking the Client Chevron down icon Chevron up icon
7. Advanced WLAN Attacks Chevron down icon Chevron up icon
8. Attacking WPA-Enterprise and RADIUS Chevron down icon Chevron up icon
9. WLAN Penetration Testing Methodology Chevron down icon Chevron up icon
10. WPS and Probes Chevron down icon Chevron up icon
A. Pop Quiz Answers Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon

Customer reviews

Top Reviews
Rating distribution
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5
(44 Ratings)
5 star 75%
4 star 15.9%
3 star 2.3%
2 star 2.3%
1 star 4.5%
Filter icon Filter
Top Reviews

Filter reviews by




John Johnson Dec 06, 2015
Full star icon Full star icon Full star icon Full star icon Full star icon 5
learning a lot from this book
Amazon Verified review Amazon
Hacker-Inside Aug 19, 2016
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Excellent book , a must having book in your shelf if you are a Kali Linux user and interested in wireless penetration testing. I can crack any kind of WiFi security after reading this book and also this book changes the way of your's to see how hacking actually works that there's lots of way to hack or crack something , all depends on your brain. Must purchase this book.
Amazon Verified review Amazon
Pete Jan 17, 2017
Full star icon Full star icon Full star icon Full star icon Full star icon 5
As always, Vivek doesn't disappoint. This is a great primer/resource for OSWP and covers pretty much everything you need to know at a high level, you'll probably want to do some additional research to fill in the gaps.
Amazon Verified review Amazon
Amazon Customer Jan 10, 2017
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Covers a lot of material and is pretty easy to follow.
Amazon Verified review Amazon
Tony P Apr 17, 2015
Full star icon Full star icon Full star icon Full star icon Full star icon 5
As with most cookbooks, this one is a great example of how to do things correctly. Anyone can install an OS and since it boots, we believe that is running the properly. After I started to read the book, I noticed that I did not do nearly enough to hide / protect myself. This book with get you going from start to finish with what to do and more importantly why we should do it. I did learn a lot with this book and I would recommend it to anyone wanting to start-up with KALI Linux and grasp an fuller understanding of it.I have always enjoyed Packt Publishing book and this one is also a hit !
Amazon Verified review Amazon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is included in a Packt subscription? Chevron down icon Chevron up icon

A subscription provides you with full access to view all Packt and licnesed content online, this includes exclusive access to Early Access titles. Depending on the tier chosen you can also earn credits and discounts to use for owning content

How can I cancel my subscription? Chevron down icon Chevron up icon

To cancel your subscription with us simply go to the account page - found in the top right of the page or at https://subscription.packtpub.com/my-account/subscription - From here you will see the ‘cancel subscription’ button in the grey box with your subscription information in.

What are credits? Chevron down icon Chevron up icon

Credits can be earned from reading 40 section of any title within the payment cycle - a month starting from the day of subscription payment. You also earn a Credit every month if you subscribe to our annual or 18 month plans. Credits can be used to buy books DRM free, the same way that you would pay for a book. Your credits can be found in the subscription homepage - subscription.packtpub.com - clicking on ‘the my’ library dropdown and selecting ‘credits’.

What happens if an Early Access Course is cancelled? Chevron down icon Chevron up icon

Projects are rarely cancelled, but sometimes it's unavoidable. If an Early Access course is cancelled or excessively delayed, you can exchange your purchase for another course. For further details, please contact us here.

Where can I send feedback about an Early Access title? Chevron down icon Chevron up icon

If you have any feedback about the product you're reading, or Early Access in general, then please fill out a contact form here and we'll make sure the feedback gets to the right team. 

Can I download the code files for Early Access titles? Chevron down icon Chevron up icon

We try to ensure that all books in Early Access have code available to use, download, and fork on GitHub. This helps us be more agile in the development of the book, and helps keep the often changing code base of new versions and new technologies as up to date as possible. Unfortunately, however, there will be rare cases when it is not possible for us to have downloadable code samples available until publication.

When we publish the book, the code files will also be available to download from the Packt website.

How accurate is the publication date? Chevron down icon Chevron up icon

The publication date is as accurate as we can be at any point in the project. Unfortunately, delays can happen. Often those delays are out of our control, such as changes to the technology code base or delays in the tech release. We do our best to give you an accurate estimate of the publication date at any given time, and as more chapters are delivered, the more accurate the delivery date will become.

How will I know when new chapters are ready? Chevron down icon Chevron up icon

We'll let you know every time there has been an update to a course that you've bought in Early Access. You'll get an email to let you know there has been a new chapter, or a change to a previous chapter. The new chapters are automatically added to your account, so you can also check back there any time you're ready and download or read them online.

I am a Packt subscriber, do I get Early Access? Chevron down icon Chevron up icon

Yes, all Early Access content is fully available through your subscription. You will need to have a paid for or active trial subscription in order to access all titles.

How is Early Access delivered? Chevron down icon Chevron up icon

Early Access is currently only available as a PDF or through our online reader. As we make changes or add new chapters, the files in your Packt account will be updated so you can download them again or view them online immediately.

How do I buy Early Access content? Chevron down icon Chevron up icon

Early Access is a way of us getting our content to you quicker, but the method of buying the Early Access course is still the same. Just find the course you want to buy, go through the check-out steps, and you’ll get a confirmation email from us with information and a link to the relevant Early Access courses.

What is Early Access? Chevron down icon Chevron up icon

Keeping up to date with the latest technology is difficult; new versions, new frameworks, new techniques. This feature gives you a head-start to our content, as it's being created. With Early Access you'll receive each chapter as it's written, and get regular updates throughout the product's development, as well as the final course as soon as it's ready.We created Early Access as a means of giving you the information you need, as soon as it's available. As we go through the process of developing a course, 99% of it can be ready but we can't publish until that last 1% falls in to place. Early Access helps to unlock the potential of our content early, to help you start your learning when you need it most. You not only get access to every chapter as it's delivered, edited, and updated, but you'll also get the finalized, DRM-free product to download in any format you want when it's published. As a member of Packt, you'll also be eligible for our exclusive offers, including a free course every day, and discounts on new and popular titles.