Hacking_and_Penetration_Testing_with_Low_Power_Devices

Penetration testing with a single beagle
107
Once a monitoring interface has been created, the command airodump-ng mon0
will bring up a list of nearby wireless network as shown in Figure 5.8. We can see two
networks that seem to be related to our target: PFE-Secure and PFE-Guest running
WPA2 personal and WEP security, respectively. We will first attempt to crack the
PFE-Secure password under the assumption that this will provide the best access to
our target network (many guest networks have only Internet access).
WPA2-protected networks are easily cracked provided you can capture the packets
from a client authentication. That is, if the password is in a dictionary. We can either
wait for a client to connect or knock someone off-line and hope they reconnect.
Because our wireless adapter can only listen on one channel at a time, the monitoring
interface should be locked to the channel used by the target access point using the command
iwconfig wlan0 channel 6. Airodump-ng should be run on channel 6 only
and the capture sent to a file. The appropriate command is airodump-ng –channel 6
–write PFE-secure. These commands are shown in Figure 5.9.
Given that you know most of the employees are connecting to the PFE network
with tablets, you could simply wait until someone connects to capture a handshake.
FIGURE 5.8
Wireless network sniffing.