Instructor: Now before leaving this section and moving 2 2
to the gaining access section where I'm gonna teach you 3 3
how to break the different encryptions and gain access 4 4
to networks, I want to spend one more lecture talking about 5 5
a really useful attack that still falls under the 6 6
pre-connection attacks under this section. 7 7
The attack that I want to talk about, 8 8
is the de-authentication attack. 9 9
This attack allow us to disconnect any device, 10 10
from any network, before connecting to any of these networks 11 11
and without the need to know the password for the network. 12 12
To do this, we're going to pretend to be the client 13 13
that we want to disconnect, by changing our MAC address 14 14
to the MAC address of that client, and tell the router 15 15
that I want to disconnect from you. 16 16
Then, we're going to pretend to be the router, again, 17 17
by changing our MAC address to the router's MAC address 18 18
and tell the client that you're requested 19 19
to be disconnected, so I'm going to disconnect you. 20 20
This will allow us to successfully disconnect, 21 21
or de-authenticate any client from any network. 22 22
Now, we're actually not going to do this manually, 23 23
we're gonna use a tool called aireplay-ng to do that. 24 24
From the previous lecture, we know that this MAC 25 25
address right here, belongs to an Apple computer, and like 26 26
I said, this Apple computer is actually my computer 27 27
right here. 28 28
And, as you can see, this host machine is connected to this 29 29
network right here, which is the same as the one that you 30 30
see in here, and it actually has internet access. 31 31
So, if I just look for test, you'll see that I'm connected 32 32
and I can look for things, I can use google. 33 33
So, I have a proper working internet connection. 34 34
Now, we're gonna come back here, and we're gonna use a tool 35 35
called aireplay-ng, to launch the de-authentication attack, 36 36
and disconnect this MAC computer from the internet. 37 37
So, we're gonna type the name of the program, which is 38 38
aireplay-ng, we're gonna tell it that I want to run 39 39
a de-authentication attack, then, I'm gonna give it 40 40
the number of de-authentication packets that I want to send. 41 41
So, I'm gonna give it a really large number, so that 42 42
it keeps sending these packets to both the router, 43 43
and the target device, therefore, I'll disconnect my target 44 44
device for a very long period of time, and the only way 45 45
to get it back to connect is to hit Control + C and quit 46 46
aireplay-ng. 47 47
Next, I'm gonna give aireplay-ng the MAC address 48 48
of my target network. 49 49
So, I'm gonna do -a and give it the MAC address, which 50 50
I'm gonna copy from here. 51 51
Then, I'm gonna use -c to give it the MAC address of the 52 52
client that I want to disconnect. 53 53
And, the client that I want to disconnect is this client 54 54
right here, which is the Apple computer like we said. 55 55
So, I'm gonna copy it, and paste it here. 56 56
And finally, 57 57
I'm gonna give it the name of my wireless adapter in 58 58
monitor mode, and in my case it's called mon zero. 59 59
So, a very, very simple command. 60 60
We're typing aireplay-ng, this is the name of the program 61 61
that we're going to use, we're doing --deauth to tell 62 62
aireplay-ng that I want to run a de-authentication attack, 63 63
I'm givin' it a really large number of packets, so that it 64 64
keeps sending the de-authentication packets 65 65
to both the router and the client, and keep the client 66 66
disconnected, I'm using -a to specify the MAC address of the 67 67
target router, or the target access point, then I'm using -c 68 68
to specify the MAC address of the client. 69 69
Finally, I'm givin' it mon zero, which is the name 70 70
of my wireless adapter in monitor mode. 71 71
Now, you can run this command like this, and in most cases 72 72
it would work, but in very rare cases, this command will 73 73
fail unless airodump-ng is running against the target 74 74
network. 75 75
So, what I'm gonna do now is, I'm gonna go back to my 76 76
first terminal in here, and I'm going to run airodump-ng 77 77
using the command that we seen before, and I don't want 78 78
to write anything to our file, so I'm going to remove the 79 79
write argument. 80 80
So, I'm just doin' a normal airodump-ng command. 81 81
I'm literally just givin' it the BSSID of my target network, 82 82
and I'm givin' it the target channel, and then I'm just 83 83
gonna hit Enter. 84 84
We seen how to do this, we spent a full lecture on it, 85 85
that's why I did it really quick. 86 86
And then I'm gonna go back to the command that we wrote 87 87
so far, and I'm gonna hit Enter. 88 88
Now, as you can see, aireplay-ng it's telling me that it's 89 89
sending the de-authentication packets, and if we go back 90 90
here and look up, you can see that I actually lost 91 91
my connection, and I'm trying to connect back. 92 92
So, obviously if I try to look for anything, so let's say 93 93
test 2, you'll see I'll get stuck and nothing will load 94 94
for me. 95 95
So, the only way for me to connect back is, if I go back 96 96
here, if I quit this by doing Control+C, quit this again, 97 97
and now my machine should be able to connect back, 98 98
and restore its connection. 99 99
This is actually very,very handy in so many ways. 100 100
It's very useful in social engineering cases, 101 101
where you could disconnect clients from the target network, 102 102
and then call the user and pretend to be, a person from the 103 103
IT Department and ask them to install a virus or a backdoor, 104 104
telling them that this would fix their issue. 105 105
You could also set, create other fake access point and get 106 106
them to connect to the fake access point, and then start 107 107
spying on them, from that access point. 108 108
And, we'll see how to do that later on in the course. 109 109
And, you can also use this to capture the handshake, 110 110
which is what happened in here, actually. 111 111
And, this is vital when it comes to WPA cracking and we'll 112 112
talk about this once we get to the WPA cracking section. 113 113
So, like I said, this is a small attack that can be used as 114 114
a plug into other attacks to make other attacks possible.