{"id":103,"date":"2018-03-12T14:08:59","date_gmt":"2018-03-12T13:08:59","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=103"},"modified":"2018-03-12T14:08:59","modified_gmt":"2018-03-12T13:08:59","slug":"wps-insecurity-p2","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=103","title":{"rendered":"WPS &#8211; (In)Security P2"},"content":{"rendered":"<p>In this article I&#8217;ll show you how you can perform a step by step WPS attack.<\/p>\n<ul>\n<li><a href=\"https:\/\/cybercop-training.ch\/?p=97\" target=\"_blank\" rel=\"noopener\">WPS &#8211; (In)Security P1<\/a><\/li>\n<li>WPS &#8211; (In)Security P2<\/li>\n<\/ul>\n<p>LAB Setup:<\/p>\n<ul>\n<li>1x Alfa AWUS 036H Wlan Adapter (or similar with monitor mode support)<\/li>\n<li>1x Zyxel Router NBG-460N or similar device<\/li>\n<li>1x virtual machine with Kali Linux installed<\/li>\n<\/ul>\n<table>\n<tbody>\n<tr>\n<td><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-104 aligncenter\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wifi_and_dect_adapters.jpg\" alt=\"\" width=\"250\" height=\"188\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wifi_and_dect_adapters.jpg 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wifi_and_dect_adapters-80x60.jpg 80w\" sizes=\"auto, (max-width: 250px) 100vw, 250px\" \/><\/td>\n<td><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-105 aligncenter\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/gigabit-wireless-n-router-300x225.jpg\" alt=\"\" width=\"250\" height=\"188\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/gigabit-wireless-n-router-300x225.jpg 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/gigabit-wireless-n-router-300x225-80x60.jpg 80w\" sizes=\"auto, (max-width: 250px) 100vw, 250px\" \/><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>I did setup a Wifi Protection with WPA2-PSK and a very secure Password ?<\/p>\n<p>The SSID of my Network will be <strong>Swiss_Emmentaler<\/strong> and as you can see WPS is activated. Let\u2019s start!<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-114\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/zyxel_setup_wps.png\" alt=\"\" width=\"783\" height=\"485\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/zyxel_setup_wps.png 783w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/zyxel_setup_wps-300x186.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/zyxel_setup_wps-768x476.png 768w\" sizes=\"auto, (max-width: 783px) 100vw, 783px\" \/><\/p>\n<p>Check if Alfa AWUS 036H Adapter is successfully connected to virtual machine. In my case it&#8217;s mounted as wlan0<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-115\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack1.png\" alt=\"\" width=\"731\" height=\"402\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack1.png 731w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack1-300x165.png 300w\" sizes=\"auto, (max-width: 731px) 100vw, 731px\" \/><\/p>\n<p>Next step is to put the WLAN interface into monitor mode. Putting a wireless interface into monitor mode allows us to monitor all traffic received from the wireless adapter.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-116\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack2.png\" alt=\"\" width=\"734\" height=\"406\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack2.png 734w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack2-300x166.png 300w\" sizes=\"auto, (max-width: 734px) 100vw, 734px\" \/><\/p>\n<p>We can see that the monitor interface can get a conflict with three system processes. I\u2019ll kill them and check if the mon0 interface is up.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-117\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack3.png\" alt=\"\" width=\"734\" height=\"401\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack3.png 734w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack3-300x164.png 300w\" sizes=\"auto, (max-width: 734px) 100vw, 734px\" \/><\/p>\n<p>Next step is to do a scan with the tool wash (allready installed in kali). I\u2019ve scanned only for channel 6 and as we can see my <strong>Swiss_Emmentaler AP<\/strong> got successful deteced. We need the mac address of the router that we want to attack.<\/p>\n<p>wash -i mon0 -c 6<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-118\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack4.png\" alt=\"\" width=\"958\" height=\"392\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack4.png 958w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack4-300x123.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack4-768x314.png 768w\" sizes=\"auto, (max-width: 958px) 100vw, 958px\" \/><\/p>\n<p>With the tool reaver we have a lot of advanced options that we can use for the attack.<\/p>\n<p>\u2013 i means the interface mon0<br \/>\n\u2013 b means the target Mac Address<br \/>\n\u2013 D improvs the cracking speed<br \/>\n\u2013 vv dispays non critical warning<br \/>\nset the command reaver in your shell for a detailed information about all the commands<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-119\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack5.png\" alt=\"\" width=\"846\" height=\"458\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack5.png 846w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack5-300x162.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack5-768x416.png 768w\" sizes=\"auto, (max-width: 846px) 100vw, 846px\" \/><\/p>\n<p>In my lab the bruteforce speed depends from 3 to 6seconds\/pin. If everything works fine I should get the WPA2-PSK key in <strong>between 8 and 16 hours<\/strong>.<\/p>\n<p>If we stop the cracking process, the session gots automatically stored that we can continue later.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-121\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack6.png\" alt=\"\" width=\"674\" height=\"228\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack6.png 674w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack6-300x101.png 300w\" sizes=\"auto, (max-width: 674px) 100vw, 674px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-120\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack7.png\" alt=\"\" width=\"661\" height=\"185\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack7.png 661w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack7-300x84.png 300w\" sizes=\"auto, (max-width: 661px) 100vw, 661px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-122\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack8.png\" alt=\"\" width=\"463\" height=\"292\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack8.png 463w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_hack8-300x189.png 300w\" sizes=\"auto, (max-width: 463px) 100vw, 463px\" \/><\/p>\n<p>In my test it took 34057 seconds to crack the pin. <strong>34057\/3600 = 9.46h<\/strong><\/p>\n<p>Strongly Recomended: Disable WPS on your router \ud83d\ude42<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>In this article I&#8217;ll show you how you can perform a step by step WPS attack. WPS &#8211; (In)Security P1 WPS &#8211; (In)Security P2 LAB <a class=\"mh-excerpt-more\" href=\"https:\/\/cybercop-training.ch\/?p=103\" title=\"WPS &#8211; (In)Security P2\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":122,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,16,3],"tags":[15,7],"class_list":["post-103","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","category-linux","category-wi-fi","tag-wps","tag-wps-cracking"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=103"}],"version-history":[{"count":9,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/103\/revisions"}],"predecessor-version":[{"id":124,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/103\/revisions\/124"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/122"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}