A MAC address is the hardware address of a network card (e.g. WLAN stick, WLAN chip integrated in the notebook or also for LAN) and serves as a unique identifier of a network-compatible device.
Every new hacker loves to Google the words “How to hack WiFi passwords?” So i thought why not make a blog post on it.
PS Every professional hacker was a script kiddie at some point
Before we start lets look at some terminology.
BSSID- It is the MAC addrses of a device
ESSID- It is the name of a device.
AP- Access Point, example a router.
There are a few types of WiFi encryption:
- WEP (Wired Equivalency Privacy)
- WPA(Wi-Fi Protected Access)
- WPA2(Wi-Fi Protected Access 2)
- WPA2 with WPS(Wireless Protected Setup)
- WPA3(Wi-Fi Protected Access)
For this post we will only be focusing on WPA2 because that’s the one most commonly used.
After opening the tool just select monitor mode wlan0, and start scanning for near by WiFi networks. And select any network from the available networks, then use a good password list, It will take some time to crack, If successeed then you will see the password. As for him being able to hack your network because he knows your mac address. Well, as long as you are not being stupid and using MAC based security. Some routers allow you to have no password on your Wifi and 'secure' it by only allowing certain mac addresses. MAC addresses can easily be spoofed, so this is not secure. Recently posted Second Method to hack wifi password. How to Hack Wifi Password – First Method: First of all you need to scan for available wireless networks. You can use“NetStumbler” or “Kismet” for Windows and Linux and KisMacfor Mac. It’ll also show how the Wi-fi network is encrypted. The two most common encryption techniques are.
WPA2 uses the Advanced Encryption Standard (AES) and Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), respectively.
Developed by the U.S. government to protect classified data, AES comprises three symmetric block ciphers. Each encrypts and decrypts data in blocks of 128 bits using 128-bit, 192-bit and 256-bit keys. Although the use of AES requires more computing power from APs and clients, ongoing improvements in computer and network hardware have mitigated performance concerns.
CCMP protects data confidentiality by allowing only authorized network users to receive data, and it uses cipher block chaining message authentication code to ensure message integrity.
WPA2 also introduced more seamless roaming, allowing clients to move from one AP to another on the same network without having to reauthenticate, using Pairwise Master Key caching or preauthentication. How to track phone number location in pakistan provinces.
WPA2 Password Hacking
Okay, so hacking WPA-2 PSK involves 2 main steps-
- Getting a handshake (it contains the hash of password, i.e. encrypted password)
- Cracking the hash.
What we need is:
- An attacker (you)
- A client
- An AP (Access point)
- A network adapter capable of packet injection. (i recommend ALFA AWUS036NH)
When the client and the AP communicate in order to authenticate the client, they have a 4 way handshake that we can capture. This handshake has the hash of the password. Now there’s no direct way of getting the password out of the hash, and thus hashing is a robust protection method. But there is one thing we can do. We can take all possible passwords that can exists, and convert them to hash. Then we’ll match the hash we created with the one that’s there in the handshake. Now if the hashes match, we know what plain text password gave rise to the hash, thus we know the password. If the process sounds really time consuming to you, then its because it is. WPA2 hacking (and hash cracking in general) is pretty resource intensive and time taking process. Now there are various different ways cracking of WPA2 can be done. But since WPA2 is a long shot, we shall first look at the process of capturing a handshake.
Now since i don’t want you to remain script kiddies forever, let me explain what the 4 way handshake actually is.
The Four-Way Handshake
The authentication process leaves two considerations: the access point (AP) still needs to authenticate itself to the client station (STA), and keys to encrypt the traffic need to be derived. The earlier EAP exchange or WPA2-PSK has provided the shared secret key PMK (Pairwise Master Key). This key is, however, designed to last the entire session and should be exposed as little as possible. Therefore the four-way handshake is used to establish another key called the PTK (Pairwise Transient Key). The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address. The product is then put through PBKDF2-SHA1 as the cryptographic hash function.
The handshake also yields the GTK (Group Temporal Key), used to decrypt multicast and broadcast traffic.
The actual messages exchanged during the handshake are depicted in the figure and explained below:
Here is YouTube video for a better understanding.
The Aircrack-ng suite
Aircrack-ng is a complete suite of tools to assess WiFi network security.
It focuses on different areas of WiFi security:
- Monitoring: Packet capture and export of data to text files for further processing by third party tools
- Attacking: Replay attacks, deauthentication, fake access points and others via packet injection
- Testing: Checking WiFi cards and driver capabilities (capture and injection)
- Cracking: WEP and WPA PSK (WPA 1 and 2)
Here is a breakdown of tools that we would use:
- Airmon-ng (for initiating monitor mode)
- Airodump-ng (to capture the handshake)
- Aireplay-ng (to deauthenticate clients)
- Aircrack-ng (to brute force the password)
Mac Os Show Wifi Password
Step 1 Set your interface to monitor mode.
Finding Wifi Password On Mac
Monitor mode or RFMON (Radio Frequency Monitor) mode, enables a device with a wireless network interface controller to monitor all traffic received from the wireless network. Unlike promiscuous mode, which is also used for packet sniffing, RFMON mode enables packets to be captured without having to connect or link with an access point. RFMON mode only works with wireless networks, while promiscuous mode can be applied to both wired and wireless networks.
Now wlan0 is for me, for you it could be wlan1 or wlan2 anything else, depending on you card. So select the interface carefully.
As you can see station mode is disabled and monitor mode is now enabled.
Step 2 Find your target.
Find you targets BSSID by this command:
Yes i know there’s a lot of information over there, so lets break that down as well.
Mac Os Wifi Password
PWR: Signal strength
RXQ: Receive quality
Beacons: Number of announcement packets.
#Data: Number of captured packets
CH: Channel
ENC: Encryption Type
Cipher: Cipher type
Station: MAC address of the client.
Lost: Packets lost
Packets: Data packets sent by client
Anyways, as you can see in the picture above, our target is called Test Router.
Step 3 Capture the Handshake
You will see something like this
The below area is to display clients connected to that AP. Now we need to simultaneously de-authenticate at least one client. In this case will de-authenticate 7A:AC:AD:CC:44:05.
So open another terminal
The command is
The -a is for the APs MAC address, the -c is for the clients MAC and -0 is for deauth mode.
After a few seconds press CTRL-Z to stop sending deauth packets. As soon as the client connects back, we would capture the hashed handshake file.
Oldies lyrics and chords. You can see on the top right corner that we captured the handshake file.
Step 4 Brute Forcing the handshake file
I have put the actual password in the file dic.txt along with some other random passwords. So we run aircrack-ng with the dictionary as well as the handshake file (.cap)
Now depending on your dictionary this can take a second or even weeks. I cracked it in a second because the dictionary was small and it contained the password.
Now you may be thinking that this isn’t the most efficient way of getting someones password.
Well the purpose of this article was to explain the basic attack vector used to hack WiFi passwords and to introduce you to the Aircrack-ng. If you want someones password, just go ask them.
There is another way we could get an APs (with WPA2) password and that is by exploiting the WPS pin vulnerability, we could get the password in just a few hours guaranteed, apparently that only works on old routers. So when i get a hold of one i’ll cover that topic as well.
Every type of WiFi encryption has its set vulnerabilities, for example the WEP has an issue with the implementation of the RC4 encryption algorithm. So stay tuned as i cover them one by one.
HAPPY HACKING
Forgot Wifi Password Mac