Differences

This shows you the differences between two versions of the page.

--- marc:linux:hacking [2022/01/06 17:26] – marcv
+++ marc:linux:hacking [2022/01/16 12:40] (current) – [Capturing traffic:] marcv
@@ Line 5: / Line 5: @@
 ===== Spoofing Ethernet Mac address: =====
-To spoof the MAC address of the NIC we can use a //ifconfig// and //ip//. Remember that spoofing the MAC address using these tools is only done in RAM; a reboot will return the MAC address to the actual hardware address. {{ :marc:linux:screenshot_from_2022-01-06_17-24-20.png?nolink&200|}}
+To spoof the MAC address of the NIC we can use a //ifconfig// and //ip//. Remember that spoofing the MAC address using these tools is only done in RAM; **a reboot will return the MAC address to the actual hardware address.** {{ :marc:linux:screenshot_from_2022-01-06_17-24-20.png?nolink&200|}}
 ==== using ifconfig: ====
@@ Line 27: / Line 27: @@
 ip link show interface # to check
 </code>
+===== Capturing traffic: =====
+In order to hack a (wireless) connection we need to be able to sniff the traffic on a network. For this we need the NIC we use to capture all traffic, including traffic for another destination.
+<code>
+iwconfig
+eth0    no wireless extensions
+wlan0   IEEE 802.11 ESSID:off/any
+        Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
+        ...
+        ...
+</code>
+**Mode:Managed** means the NIC only captures traffic meant for its address.
+There are 2 methods of changing the mode to **Monitor** (which captures all traffic) and dependant of the NIC/chipset one of these methods will probably work:
+==== Using iwconfig: ====
+<code>
+ifconfig wlan0 down                      # bring NIC down
+airmon-ng check kill                     # to stop any running processes using the NIC
+Killing these processes:
+  PID  Name
+  wpa_supplicant
+  dhclient
+iwconfig wlan0 mode monitor              # capture all traffic
+ifconfig wlan0 up                        # bring NIC up
+iwconfig
+eth0    no wireless extensions
+wlan0   IEEE 802.11 Mode:Monitor Frequency:2.412 GHz Tx-Power=20 dBm
+        ...
+        ...
+</code>
+Now the NIC captures all traffic (**Mode:Monitor**)
+==== Using airmon-ng: ====
+<code>
+ifconfig wlan0 down                      # bring NIC down
+airmon-ng check kill                     # to stop any running processes using the NIC
+Killing these processes:
+  PID  Name
+  wpa_supplicant
+  dhclient
+airmon-ng start wlan0                   # bring wlan0 adapter in //monitor// mode
+PHY    Interface  Driver       Chipset
+phy3   wlan0      ath9k_htc    IMC Networks
+          (mac80211 monitor mode vif enabled for [phy3]wlan0 on [phy3]wlan0mon)
+          (mac80211 station mode vif disabled for [phy3]wlan0)
+iwconfig
+eth0       no wireless extensions
+wlan0mon   IEEE 802.11 Mode:Monitor Frequency:2.412 GHz Tx-Power=20 dBm
+           ...
+           ...
+</code>
+Now the NIC captures all traffic (**Mode:Monitor**)
+**Notice that using airmon-ng a new device (wlan0mon) is created and wlan0 no longer exists. Also we do not need to bring the interface up manually.