Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: Aircrack-ng

In our series of Wireless Penetration Testing, this time we are focusing on a tool that has been around for ages. This is the tool that has given birth to many of the Wireless Attacks and tools. Aircrack-ng is not a tool but it is a suite of tools that all perform different types of attacks or activities related to Wireless Access Points. In this demonstration, we will be focusing on a few of the tools from the Aircrack-ng arsenal. Table of Content· Introduction· Enabling Monitor Mode· Sniffing Wireless Packets· Deauthencating Users· Capturing Handshake· Cracking Password· ConclusionAircrack-ng is a package of Wi-Fi network security assessment tools. It has a detector, a packet sniffer, WPA/WPA2-PSK, and a WEP cracker and analyzer for 802.11 Wireless LANs. With the help of Aircrack-ng, a penetration tester can focus on Monitoring, Attacking, Testing, and Cracking aspects of the Wi-Fi Security. Monitoring includes Packer Capturing and exporting the data to text files for processing by any third-party tool. Attacking includes replay attacks, deauthentication, evil-twin attacks, and packet injection attacks. Testing includes the testing of the Wi-Fi cards and driver capabilities based on the capture and injections. Finally Cracking includes the ability to crack the WEP and WPA PSK keys.airmon-ng:It is used to enabling Monitor Mode on Wi-Fi Cardairodump-ng:It is used for sniffing packets. It places the air traffic into a pcap file and shows information about the networkaireplay-ng:It is used for Packet Injection Attacksaircrack-ng:It is used for cracking the WEP keys using the Fluhrer, Mantin, and Shamir attack (FMS) attack, PTW attack, and dictionary attacks, and WPA/WPA2-PSK using dictionary attacks.Note: To perform attacks using Aircrack-ng, you need an external Wi-Fi card with monitoring mode.In general words, Monitor Mode is a mode that is supported by certain Wi-Fi devices. When enabled, the Wi-Fi card will stop sending any data and will be completely dedicated to monitoring the wireless traffic. It is not the only mode that is supported on Wi-Fi devices, there are a total of 6 modes. However, in this demonstration, we will be focusing on Monitor mode only. airmon-ng start wlan0https://1.bp.blogspot.com/-rl3EYD9hMP4/YOdOKO7Ug7I/AAAAAAAAxW0/EIRWCCBx_-AI6EjWbfLr8ubcuobmEC1cQCLcBGAsYHQ/s16000/1.png After using the airmon-ng, we can check the enabling of monitor mode by using the iwconfig command. It is a Linux command that can be used to configure a wireless network interface. It is similar to ifconfig which is used for general interface configurations. After running iwconfig we can see that the interface that we used with airmon-ng has now changed from wlan0 to wlan0mon. Here mon indicates the monitor mode.iwconfighttps://1.bp.b[...]

___________________________
@hacking_Attack
@Hacking_Video

logspot.com/-l-6F3_-Kceg/YOdOOeC9cKI/AAAAAAAAxW4/Xz4RaqQomDUWs57gezZBgqQ5DeiKL7kKACLcBGAsYHQ/s16000/2.png Sniffing Wireless PacketsAfter placing the Wi-Fi card in the Monitor mode, we can then move to sniff network packets. As discussed in the Introduction, airodump-ng can be used for this activity. To start sniffing, we need to provide the airodump-ng with the ESSID of the access point with other details. To get the information required run airodump-ng with the interface only as demonstrated below. airodump-ng wlan0monhttps://1.bp.blogspot.com/-2i9Zqh1qAOs/YOdOR8MwKhI/AAAAAAAAxW8/2yWg0o53qFMF_JS_-nU48RC2Jw9436u0wCLcBGAsYHQ/s16000/3.png As soon as we start the airodump-ng, we will see the list of Access Points with details such as their BSSID (MAC Address), Strength (PWR), Encryption (WPA/WPA2), Authentication Method, and ESSID (Name of Wireless Access Point) as demonstrated below. We will be targeting the wireless Access Point by the name of “raaj”. We can see that the access point is broadcasting on channel 3 and has WPA2-PSK.airodump-ng wlan0mon -c 3 --bssid 18:X:X:X:X:X -w pwdhttps://1.bp.blogspot.com/-6B-CPq1eUeM/YOdOZx_8qJI/AAAAAAAAxXI/YbSAM19RLJM_cL_ZKLqRuBHzGJ8Ws-OAACLcBGAsYHQ/s16000/5.png Since we want to crack the password for the targeted access point, we need the handshake that can be attacked. We will be using the airodump-ng for capturing that handshake. But since all the devices are already connected to the access point hence, there won’t be any authentication performed or we can say that we won’t be able to capture the handshake. So, we will be sending a deauthentication signal to all the devices so that they will be disconnected from the access point. Then they will try to reconnect and at that moment we will capture the handshake. We will be using the aireplay-ng for sending the deauthentication signal. We need to provide the BSSID of the access point to deauthenticate all devices as demonstrated below. Make sure to use a new terminal while running the aireplay and let the airodump-ng running. So that it can capture the handshake.aireplay-ng --deauth 0 -a 18:X:X:X:X:X wlan0monhttps://1.bp.blogspot.com/-F2P00rl-560/YOdOdvT0vyI/AAAAAAAAxXM/M15lq7H6swItEVztdxAJjLE69qaM9V0FACLcBGAsYHQ/s16000/6.png We go back to the terminal where we started the airodump-ng and we can see all the devices that attempted to reconnect to our targeted access point and on the top right-hand side, we can see that airodump-ng was able to capture the WPA handshake between the access point and one of its users. aircrack-ng pwd-01.cap -w dict.txthttps://1.bp.blogspot.com/-VE9alJ_fdy8/YOdOkvo1xvI/AAAAAAAAxXY/Wk9RsnJhy-4qQvPXjZsUg_IyvDW04MmUQCLcBGAsYHQ/s16000/8.png The time that aircrack-ng takes depends on your system configurations and the number of entries in the dictionary file that you provided. The dictionary that we provided had 7 keys. Hence, we were able to crack it in a matter of seconds. We can see the Master and Transient Key t[...]

___________________________
@hacking_Attack
@Hacking_Video

hat would be used while forming the PSK-PTK combination. The password for the access point was cracked to be raj12345.ConclusionThe collection of tools in the Aircrack-ng suite is useful in testing the Wireless Access Point Security. With the help of just 4 tools, we were able to crack the password required to connect the targeted Access Point. Aircrack-ng is one of the oldest tools that is used in the domain but we were still able to crack the authentication of a device today. ___________________________
@hacking_Attack
@Hacking_Video

Process Creation is Dead, Long Live Process Creation — Adding BOFs Support to PEzor
https://www.reddit.com/r/redteamsec/comments/ogfoeq/process_creation_is_dead_long_live_process/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://iwantmore.pizza/posts/PEzor4.html) [comments] (https://www.reddit.com/r/redteamsec/comments/ogfoeq/process_creation_is_dead_long_live_process/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Network Tracking using Wireshark and Google Maps

https://external-preview.redd.it/ye4UqtaM6Gr1qiyuNmko3MUjkuB5HcHvdoNqbeaBH0E.jpg?width=320&crop=smart&auto=webp&s=8af92600d8101a9b06fbe32c747097a1ecdd2cf0 submitted by /u/Long_Cheek_8405
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Broken Access Control — Beyond The Basics
https://thexssrat.medium.com/broken-access-control-beyond-the-basics-6e15078392b7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Take a deep dive in this often overlooked issue typeContinue reading on Medium » (https://thexssrat.medium.com/broken-access-control-beyond-the-basics-6e15078392b7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Wireless Penetration Testing: Aircrack-ng

In our series of Wireless Penetration Testing, this time we are focusing on a tool that has been around for ages. This is the tool that has given birth to many of the Wireless Attacks and tools. Aircrack-ng is not a tool but it is a suite of tools that

The post Wireless Penetration Testing: Aircrack-ng appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
New WildPressure Malware Capable of Targeting Windows and MacOS

The Trojan sends information back to the attackers' servers about the programming language of a target device.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Morgan Stanley Discloses Data Breach

Attackers were able to compromise customers' personal data by targeting the Accellion FTA server of a third-party vendor.

___________________________
@hacking_Attack
@Hacking_Video

Ipa-Medit - Memory Search And Patch Tool For Resigned Ipa Without Jailbreak
http://www.kitploit.com/2021/07/ipa-medit-memory-search-and-patch-tool.html

___________________________
@hacking_Attack
@Hacking_Video

SBProcess: pid = 926, state = running, threads = 37, executable = tap1000000
State: Running
thread #1: tid = 0x545ee, 0x00000001bd6552d0 libsystem_kernel.dylib`mach_msg_trap + 8, queue = 'com.apple.main-thread'
thread #3: tid = 0x54619, 0x00000001bd67a184 libsystem_kernel.dylib`__workq_kernreturn + 8
thread #4: tid = 0x5461a, 0x00000001bd67a184 libsystem_kernel.dylib`__workq_kernreturn + 8
thread #5: tid = 0x5461b, 0x00000001bd67a184 libsystem_kernel.dylib`__workq_kernreturn + 8
thread #6: tid = 0x5461c, 0x00000001bd67a184 libsystem_kernel.dylib`__workq_kernreturn + 8
thread #7: tid = 0x5461d, 0x00000001bd6552d0 libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.apple.uikit.eventfetch-thread'
thread #8: tid = 0x5461e, 0x00000001bd6791ac libsystem_kernel.dylib`__psynch_cvwait + 8, name = 'GC Finalizer'
thread #9: tid = 0x5461f, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Job.Worker 0'
th read #10: tid = 0x54620, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Job.Worker 1'
thread #11: tid = 0x54621, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Job.Worker 2'
thread #12: tid = 0x54622, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Job.Worker 3'
thread #13: tid = 0x54623, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Job.Worker 4'
thread #14: tid = 0x54624, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 0'
thread #15: tid = 0x54625, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 1'
thread #16: tid = 0x54626, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 2'
thread #17: tid = 0x54627, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 3'
thread #18: tid = 0x54628, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 4'
thread #19: tid = 0x54629, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 5'
thread #20: tid = 0x5462a, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 6'
thread #21: tid = 0x5462b, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 7'
thread #22: tid = 0x5462c, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 8'
thread #23: tid = 0x5462d, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 9'
thread #24: tid = 0x5462e, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 10'
thread #25: tid = 0x5462f, 0x00000001bd65530c libsystem_kernel.dylib`semap hore_wait_trap + 8, name = 'Background Job.Worker 11'
thread #26: tid = 0x54630, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 12'
thread #27: tid = 0x54631, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 13'
thread #28: tid = 0x54632, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 14'
thread #29: tid = 0x54633, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Background Job.Worker 15'
thread #30: tid = 0x54634, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'BatchDeleteObjects'
thread #31: tid = 0x54635, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Loading.AsyncRead'
thread #32: tid = 0x5463f, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'UnityGfxDeviceWorker'
thread #33: tid = 0x54641, 0x000 00001bd6552d0 libsystem_kernel.dylib`mach_msg_trap + 8, name = 'AVAudioSession Notify Thread'

___________________________
@hacking_Attack
@Hacking_Video

thread #34: tid = 0x54658, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8
thread #35: tid = 0x54659, 0x00000001bd6552d0 libsystem_kernel.dylib`mach_msg_trap + 8, name = 'AURemoteIO::IOThread'
thread #36: tid = 0x54662, 0x00000001bd679814 libsystem_kernel.dylib`__semwait_signal + 8
thread #37: tid = 0x54663, 0x00000001bd6552d0 libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.apple.CoreMotion.MotionThread'
thread #38: tid = 0x54664, 0x00000001bd65530c libsystem_kernel.dylib`semaphore_wait_trap + 8, name = 'Loading.PreloadManager'

attach
Attach to the target process. attach Success to halt process ">> attach
Success to halt process

detach
Detach from the attached process. detach Success to continue process ">> detach
Success to continue process

exit
To exit medit, use the exit command or Ctrl-D. exit Bye! ">> exit
Bye!

Trouble shooting

Failed to get reply to handshake (https://www.kitploit.com/search/label/Handshake) packet
If you get the error /private/var/containers/Bundle/Application/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/hoge.app: error: failed to get reply to handshake packet and can't communicate properly with iOS device and lldb, launch Xcode and build some app, and it will work.
Could not connect to lockdownd
If you get the error Could not connect to lockdownd. and can't communicate properly with iOS device and ideviceinstaller, launch Xcode and build some app, and it will work. If this does not solve the problem, please update ideviceinstaller and libimobiledevice to the latest versions using the example of commands in the Requirements (https://www.kitploit.com/search/label/Requirements) section.
Could not start com.apple.debugserver
This can be fixed by installing the latest unversioned code of libimobiledevice and ideviceinstaller by adding the --HEAD option when doing brew install. Reference: Could not start com.apple.debugserver! ios 14.1 xcode 12.2 MacOS 10.15.4 iphone12 · Issue #1104 · libimobiledevice/libimobiledevice (https://github.com/libimobiledevice/libimobiledevice/issues/1104)

Download Ipa-Medit (https://github.com/aktsk/ipa-medit)

___________________________
@hacking_Attack
@Hacking_Video

Hey guys! I'm carrying out a dissertation in ethical hacking and would love your response to the form below
https://www.reddit.com/r/Pentesting/comments/ogisom/hey_guys_im_carrying_out_a_dissertation_in/

___________________________
@hacking_Attack
@Hacking_Video