How to hack Wi-Fi networks ( Educational )

No matter where you go, if you switch on WiFi you're going to find a ton of networks which probably use WPA-PSK encryption. Now since you clicked on this video, you probably know that these kinds of networks are easily hackable. But do remember, this is entirely for educational purposes and you should never do this on strangers' networks as it is illegal. Now with that out of the way, I'm going to explain why and how it works, how to actually do it and how to protect yourself against it. So every time you connect to a network from a wireless device, a handshake is sent from the device to the router. This handshake just happens to contain the encrypted password. Now it's not possible to reverse the encrypted password, but what you can do is use something called a word list attack. A word list is basically a huge text file containing thousands of passwords and if you happen to encrypt all of these passwords and compare both the actual handshake password and the encrypted password, whenever they match you'll know what the real password is. So now that you know how it works, how do you actually do it? So the first thing you're going to need is a computer running Linux. The operating system I'll be using is Kali Linux since it comes with all the tools I need pre-installed and if you want to run it on another Linux distribution, all you need to do is download these packages. Another thing you might need if your computer's network card doesn't support modern mode is an external network card like this cheap TP-Link adapter. You'll know if you need it with the next step. So now I need to know which network I want to attack, which in my case is Angelus Network, but simply having the name is not enough. To figure out more information about the target, first you need to figure out what the name of your wireless interface is. To do this, open up a terminal and write IPA. Now here are all of your network interfaces. The wireless ones will start with WLAN something. For example, mine is WLAN0 which stands for Wireless Local Area Network 0. What I want to do now is turn on man-air mode for this network card so that I can start receiving all of the traffic that's around me. To do this, I'm going to use a tool called airman.ng. The specific command is airman-ng start followed by the wireless network interface which in my case is WLAN0. So if you happen to have WLAN1, then you would use WLAN1. This command will switch the mode of your network card from managed to monitor, which also means that your internet will break so you won't be able to look anything up on YouTube or on Google. I'll show you how to fix this later by turning off monitor mode and restarting the network services. Now if you write iwconfig on any console, you're going to be able to see that the network's card mode has been turned into monitor. If this isn't the case, that means that your network card doesn't support monitor mode and you're going to need the adapter I showed earlier or some other alternative. Also do note that turning on monitor mode is going to change the name of your wireless interface. So for example, a quick IPA shows that mine changed from WLAN0 to WLAN0-mon. Now that monitor mode is on, I want to start listening to all of the networks that are around me with the command airdump-ng followed by the network's interface that has monitor mode turned on. So in my case, WLAN0-mon. Here you can see all of the networks that are nearby and you can see that my network is here as well. Now what you want to keep from here is the channel of your network and the BSS ID, which in my case is this. To exit this mode, you can press CTRL-C on the keyboard. Now with the BSS ID and the channel of my network saved, I can use airdump-ng, minus D followed by the BSS ID, minus C followed by the channel number, minus W followed by the name of the file that's going to be exported that's going to contain the handshake we're going to need to crack the password, and finally the network interface which is WLAN0-mon. Running this command will show you all of the devices that are currently connected to that network and you can see that if I look up a video on YouTube, the amount of packets being sent to a device increase a lot. So this would be the iPad for example. So as I previously explained, I want to capture the handshake when the device connects to the internet, but this device is already connected, so what I want to do is do a deauthentication attack to force it to reconnect again so I can capture the handshake. I now want to keep this window with airdump open and open a second terminal to run more commands. I personally use Terminator, which let me split a single terminal into multiple windows. 10 out of 10 would recommend. To deauthenticate, I can use the ireplay-ng package. So the parameters here are going to be ireplay-ng followed by minus zero which means deauthentication, we're going to send 10 deauthentication packets, minus A followed by the BSSID of the router, minus C followed by the victim's ESSID, and then finally the network interface. So here we are sending a total of 10 deauthentication packets to the iPad, and now if you press enter you can see that the iPad gets forcefully disconnected, connects again, and a handshake is captured. Though keep in mind that handshakes sometimes aren't captured the first time, so you might need to do this a couple of times. Now that the handshake is captured, I can stop airdump with CTRL-C and you can see that a file has been saved in the current directory with the name I gave it before. Now Kaldi Linux has a couple of wordlists already pre-installed in this directory. The one I'll be using is the rawq.txt, which is the biggest file containing the most passwords in the world. The command used to crack is aircrack-ng minus w followed by the location of the wordlist, which is here, followed by the name of the capture file. After letting that run for a while, you can see that a match was found and that this is the password for my network. Now your internet connection will still be broken after this, and to fix that you can either restart your computer or do airmon minus ng stop followed by the monair interface, which in my case is wlan0mon, but then it will still be broken. So now you need to restart the network services with systemctl restart net followed by an asterisk, which means that it will restart everything that starts with net, so like network something. So now that we've gone through how it works and how to do it, how do you actually protect yourself against this? There's unfortunately nothing you can do against the deauthentication, but to prevent the wordlist attack, you simply have to choose a very long random password that is unlikely to be found in any wordlist. And yeah, that's about it for this video. If you enjoyed, feel free to leave a like. I'm Tian, and thank you for watching.