Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: Bettercap

IntroductionAccording to its official repository here,bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and attacking WiFi networks, Bluetooth Low Energy devices, wireless HID devices and Ethernet networks. In this article, we’d be seeing how to use bettercap to aid with Wi-Fi pentesting.Table of Content1. InstallationInstallationTo install bettercap, we’d use:apt install bettercap bettercaphelp wifi

Now, This tool requires an older version of the pcap library so, we’ll first download that using wget.wget http://old.kali.org/kali/pool/main/libp/libpcap/libpcap0.8_1.9.1-4_amd64.debhttps://1.bp.blogspot.com/-T5clTC7EnLw/YOshEDoWy2I/AAAAAAAAxbQ/PldkqifN8pg6D6Wa3ztumrQgczY17eoDACLcBGAsYHQ/s16000/4.png Monitor Mode and Wi-Fi discoveryMonitor mode is a promiscuous mode for your IEEE802.11x receiver (aka Wi-Fi adapter or Wi-Fi NIC) and lets you capture signals from not only your access point but others as well. To put your Wi-Fi adapter in promiscuous mode:bettercap -iface wlan0monTo start discovering Access Points around you:wifi.recon on Sorting filtersOften times knowing the vendor of an access points aid us in checking access point against known vulnerabilities. To do this we can use the following command:set wifi.show.manufacturer true set.wifi.show.sort clients desc ___________________________
@hacking_Attack
@Hacking_Video

APs have arranged themselves in descending order of number of clients connected.set.wifi.show.sort essid asc set wifi.show.limit 3 set wifi.deauth.open true Deauth attacks using BettercapWe have already seen how to recon, sort and filter. Let’s conduct a short deauth attack on an access point.events.stream off

events.stream is a logging feature in bettercap that shows logs, new hosts being found, etc. By default, it is enabled but to give a clear output we can turn it off.set wifi.recon.channel 5 onIt is operating on channel 5 and we’d first put our adapter to listen on channel 5. aircrack-ng bettercap-wifi-handshakes.pcap -w /root/dict.txtHere, dict.txt is a long password file containing the most commonly used passwords and passwords I generated given the knowledge I have about my target.___________________________
@hacking_Attack
@Hacking_Video

B_3QQwCLcBGAsYHQ/s16000/56.png <v:shape<v:imagedata<o:p

And just like that, we have cracked the Wi-Fi passphrase of “raaj.”<o:p PMKID Attack using Bettercap<o:pWe’ve discussed in detail about PMKID and PMKID attack in this article here. Now, let’s see a small tutorial where bettercap can be used to conduct PMKID attack. <o:p bettercap<o:pset wifi.interface wlan0mon<o:pwifi.recon on<o:phttps://1.bp.blogspot.com/-b_-ZmoQktfg/YOsiEnOcsVI/AAAAAAAAxcY/Hcvtppuxio0YQYtNdLlZeInBdCP9kAGhgCLcBGAsYHQ/s16000/105.png <v:shape<v:imagedata<o:p

Let’s see the target APs available<o:p wifi.show<o:phttps://1.bp.blogspot.com/-ibzNJ5FyG5I/YOsiLuD82uI/AAAAAAAAxcg/O58jthf_qpE6mM_xKjwXIktdJXGGCMV8wCLcBGAsYHQ/s16000/106.png <v:shape<v:imagedata<o:p

For PMKID attack to work we have to send an association request to the target Access Point. We do this with:<o:p wifi.assoc <bssid<o:phttps://1.bp.blogspot.com/-fw2FNZasIN8/YOsiRtPSbtI/AAAAAAAAxco/2Ozmy1kXugMDuPKCrE4KnAQlEdQRN23OACLcBGAsYHQ/s16000/107.1.png <v:shape<v:imagedata<o:p

As we can see, we have successfully received the RSN frame containing PMKID and it has been saved in a pcap format. What is I want to send an association request to all the Wi-Fis available. To do that the command is:<o:p wifi.assoc all<o:p<v:shape<v:imagedata<o:p

And yes, all the vulnerable routers returned the RSN frame containing PMKID and it got saved in a pcap file.<o:p

Now we can use the hcxpcaptool to convert this pcap file in Hashcat crackable format and use Hashcat to crack the PMK hash.<o:p hcxpcaptool -z hashpmkid bettercap-wifi-handshakes.pcap<o:phashcat -m 16800 --force hashpmkid /usr/share/wordlists/rockyou.txt --show<o:pHere, 16800 is the code for PMKID WPA/WPA2 hash type. We have used rockyou dictionary here.<o:p https://1.bp.blogspot.com/-zMHc0XWseN4/YOsiZOY1KRI/AAAAAAAAxcw/2BosnmRcdGM3UtuFlW1nWqLR_qtJO8DMgCLcBGAsYHQ/s16000/108.png <v:shape<v:imagedata<o:p

And it’s so simple. Bettercap is a sniffer with many other such functionalities beside Wi-Fi packet sniffing. We hope that this article helped you in developing opinions about tools available in the market today and forging your own Wi-Fi security audit toolkit. Thanks for reading. Have a nice day.<o:p

hacking: security in practice
Beginner

Okay so I’m a beginner and only got my first pc back in April but wanted to get into some things like this. What forums are the best for learning and getting software and combos etc

submitted by /u/o_hunt204
[link] [comments]

hacking: security in practice
How do you set a static arp Ip entry for the gateway on Android?

I know how to do it on computer, but I'm not very familiar with androids, you don't seem to find the right tools or resources for android if I'm not mistaken. I'm getting cut off wifi in a coffee shop with netcut, It doesn't work on me with the laptop but I need to use my phone... Do I need root for this? Thank you very much.

submitted by /u/Virtual-Avocado-9946
[link] [comments]

Dom Invader — Burp Suite tool to Find DOM Based XSS Easily
https://hacksheets.medium.com/dom-invader-burp-suite-tool-to-find-dom-based-xss-easily-3cb09adf4d44?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Continue reading on Medium » (https://hacksheets.medium.com/dom-invader-burp-suite-tool-to-find-dom-based-xss-easily-3cb09adf4d44?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pentesting Experience and How to Get It
https://phillip-wylie.medium.com/pentesting-experience-and-how-to-get-it-2dd2560e0e2a?source=rss------bug_bounty-5

For several years even predating my starting my teaching career as an adjunct professor teaching ethical hacking and web app pentesting, I…Continue reading on Medium » (https://phillip-wylie.medium.com/pentesting-experience-and-how-to-get-it-2dd2560e0e2a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Wireless Penetration Testing: Bettercap

Introduction According to its official repository here, bettercap is a powerful, easily extensible and portable framework written in Go that aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and attacking

The post Wireless Penetration Testing: Bettercap appeared first on Hacking Articles.

Automating Burp Suite -3 | Creating Macro To Replace CSRF Token From Response Body To Request With…

This is 3rd part of Automating Burp Suite, where we will try to replace the CSRF token generated from the response body to request the body…
Read more...

Kali Linux Tutorials
GDir-Thief : Red Team Tool For Exfiltrating The Target Organization’S Google People Directory That You Have Access To, Via Google’s API

GDir-Thief is a Red Team tool for exfiltrating the target organization’s Google People Directory that you have access to, via Google’s People API. HOW TO Create a new Google Cloud Platform (GCP) project Steps to get the Google API Access Token needed for connecting to the API Create a burner gmail/google account Login to said […]

The post GDir-Thief : Red Team Tool For Exfiltrating The Target Organization’S Google People Directory That You Have Access To, Via Google’s API appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Dom Invader — Burp Suite tool to Find DOM Based XSS Easily

Continue reading on Medium »
Read more...

Pentesting Experience and How to Get It

For several years even predating my starting my teaching career as an adjunct professor teaching ethical hacking and web app pentesting, I…Continue reading on Medium »
Read more...

Hacking on Medium
Heist (HackTheBox)

https://cdn-images-1.medium.com/max/600/1*cdt1hBjs-w4sUabZZ5UFHA.jpeg
Heist is an easy-rated HackTheBox machine. I did password cracking and username enumeration. Privilege escalation was very common firefox…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How google and other companies know your location all the time

https://cdn-images-1.medium.com/max/600/1*c5vSVlizmAF62z9fDhFdkw.jpeg
In this article we are talking about how google and other companies always know your location and how to prevent that!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video