HOW TO Hack Wi-Fi Networks with Bettercap

bettercap HOW TO Hack Wi-Fi Networks with Bettercap

HOW TO Hack Wi-Fi Networks with Bettercap

Hack Wi-Fi Networks with Bettercap

There are many tools out there for Wi-Fi hacking, but few are as integrated and well-rounded as Bettercap. Thanks to an impressively simple interface that works even over SSH, it’s easy to access many of the most powerful Wi-Fi attacks available from anywhere. To capture handshakes from both attended and unattended Wi-Fi networks, we’ll use two of Bettercap’s modules to help us search for weak Wi-Fi passwords.

Wi-Fi Hacking Frameworks

The idea of organizing tools into useful frameworks isn’t new, but there are many ways of doing it. Frameworks like Airgeddon include an incredible amount of bleeding-edge Wi-Fi hacking tools but cannot be used over a command line. That’s because Airgeddon requires the ability to open new windows for different tools to run, so if you’re communicating with a Raspberry Pi over SSH, you can forget launching many Wi-Fi hacking tools.

Bettercap allows access to the tools needed to swiftly scout for targets, designate one, and grab a WPA handshake to brute-force. While we won’t be working with any WPS recon modules today, our setup will allow you to audit for weak WPA passwords with ease. The way Bettercap is organized allows for anyone within proximity of a target to probe for weak WPA passwords while staying stealthy and undetected.

WPA Hacking with Bettercap

Bettercap is described as the Swiss Army knife of wireless hacking. To that end, it has a lot of modules for sniffing networks after you connect to them, as well as other modules looking at Bluetooth devices. The most straightforward use of Bettercap is to use the scanning and recon modules to identify nearby targets to direct attacks at, then attempt to identify networks with weak passwords after capturing the necessary information.

Our targets, in this case, will be two kinds of networks: attended and unattended. Attended networks are easier to attack, and a larger number of tools will work against them. With an attended network, there are people actively using it to download files, watch Netflix, or browse the internet. We can count on there being devices to kick off the network that will give us the information we need to try to crack the password.

Unattended networks are trickier to target. Because they do not have devices with an active data connection on them to disconnect, these networks were typically unable to yield the information needed to audit for a weak password. With the PMKID approach to cracking WPA passwords, that’s no longer the case. The tool is integrated as one of the Wi-Fi hacking modules and makes it even easier to attack.

Brute-Forcing Power Workarounds

Bettercap doesn’t directly break the passwords of networks it targets, but it would be impossible to do so without the information Bettercap provides. Once a handshake is captured, you’ll need to use a brute-forcing tool like Hydra or Aircrack-ng to try a list of common passwords against the hash you’ve captured. How quickly it will happen depends on a few factors.

The first is whether the password used to secure the target network is in the password list you’re using at all. If it isn’t, this attack won’t succeed, so it’s essential to use lists of real stolen passwords or customized password generators like CUPP. If you don’t believe that brute-force attacks are still effective, you’d be surprised to learn that any eight-character password can be brute-forced in a little over two hours.

Another workaround to using a device like a Raspberry Pi for Wi-Fi hacking is to upload the WPA handshake to a cracking service or network. Many hackers use networks that distribute the cracking load among volunteer “worker” computers, which lets the group crack WPA handshakes that less powerful devices can gather.

If you were to run Bettercap on a Raspberry Pi and then upload the captured handshakes to a distributed WPA cracker, you would be able to crack passwords within mere minutes. Alternatively, you could set this up yourself if you have a computer with a powerful processor and GPU.

What You’ll Need

To follow this guide, you’ll need a wireless network card you can put into wireless monitor mode. You can find a list of these in our previous articles on buying Wi-Fi network adapters. Your computer may have an internal card that supports wireless monitor mode, but you’ll need to be running Linux to work with it. You can refer to our other guide to find out if your existing card will work.

You can follow our guide today with Kali Linux on your laptop, a Raspberry Pi running Kali Linux, or even Ubuntu with some additional installation. For best results, you should use Kali Linux, because Bettercap comes preinstalled.

Step 1Install Bettercap

If you have Kali Linux installed, you can find it in the “Sniffing & Spoofing” folder in the “Applications” menu or from a search.

hack wi fi networks with bettercap.w1456 HOW TO Hack Wi-Fi Networks with Bettercap






If you don’t have Bettercap, the documentation for the project is on the Bettercap website. If you’re running Kali, you can run apt install bettercap to add it, as seen below. Then, you can locate the tool as seen above.

~# apt install bettercap

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  liblinear3
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
  bettercap-caplets
Suggested packages:
  bettercap-ui
The following NEW packages will be installed:
  bettercap bettercap-caplets
0 upgraded, 2 newly installed, 0 to remove and 1854 not upgraded.
Need to get 6,931 kB of archives.
After this operation, 25.8 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 bettercap amd64 2.26.1-0kali1 [6,821 kB]
Get:2 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 bettercap-caplets all 0+git20191009-0kali1 [110 kB]
Fetched 6,931 kB in 3s (2,332 kB/s)
Selecting previously unselected package bettercap.
(Reading database ... 417705 files and directories currently installed.)
Preparing to unpack .../bettercap_2.26.1-0kali1_amd64.deb ...
Unpacking bettercap (2.26.1-0kali1) ...
Selecting previously unselected package bettercap-caplets.
Preparing to unpack .../bettercap-caplets_0+git20191009-0kali1_all.deb ...
Unpacking bettercap-caplets (0+git20191009-0kali1) ...
Setting up bettercap-caplets (0+git20191009-0kali1) ...
Setting up bettercap (2.26.1-0kali1) ...
bettercap.service is a disabled or a static unit, not starting it.

If you’re not running Kali, you’ll need to refer to Bettercap’s more complicated setup. If you’re on a Mac, you can do network recon, but the modules I’m writing about won’t work. Still, you can check out other features by installing it with Homebrew, using the command brew install bettercap.

Step 2Launch Bettercap

When ready, click on Bettercap’s icon to launch it. You should see the following help menu in a terminal window, although the tool will not automatically start.

Usage of bettercap:
  -autostart string
        Comma separated list of modules to auto start. (default "events.stream")
  -caplet string
        Read commands from this file and execute them in the interactive session.
  -cpu-profile file
        Write cpu profile file.
  -debug
        Print debug messages.
  -env-file string
        Load environment variables from this file if found, set to empty to disable environment persistence.
  -eval string
        Run one or more commands separated by ; in the interactive session, used to set variables via command line.
  -gateway-override string
        Use the provided IP address instead of the default gateway. If not specified or invalid, the default gateway will be used.
  -iface string
        Network interface to bind to, if empty the default interface will be auto selected.
  -mem-profile file
        Write memory profile to file.
  -no-colors
        Disable output color effects.
  -no-history
        Disable interactive session history file.
  -silent
        Suppress all logs which are not errors.
  -version
        Print the version and exit.

Here, we can see the arguments we can start Bettercap with. One of the most useful of these is -iface which allows us to define which interface to work with. If we have an external wireless network adapter, we’ll need to define it with that.

Step 3Connect Your Network Adapter & Start

Now, we’ll need to put our card into monitor mode. If we’re connected to a Wi-Fi network already, Bettercap will start sniffing that network instead, so monitor mode always comes first.

Locate your card with ifconfig or ip a to find the name of your network adapter. It should be something like wlan0 for your internal adapter and wlan1 for your USB network adapter.

~# ifconfig

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 50:7b:9d:7a:c8:8a  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 38625  bytes 3052647 (2.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38625  bytes 3052647 (2.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.5.93  netmask 255.255.255.0  broadcast 192.168.5.255
        inet6  prefixlen 64  scopeid 0x20<link>
        ether   txqueuelen 1000  (Ethernet)
        RX packets 451  bytes 119964 (117.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 364  bytes 115672 (112.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan1: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 18:d6:c7:0e:e7:a1  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Take the adapter that’s monitor mode-compatible, and switch it to monitor mode by opening a terminal window and typing airmon-ng start wlan1, with wlan1 substituted with the name of your network adapter.

~# airmon-ng start wlan1

Found 3 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode

  PID Name
  559 NetworkManager
  621 wpa_supplicant
14785 dhclient

PHY Interface   Driver      Chipset

phy0    wlan0       ath9k       Qualcomm Atheros QCA9565 / AR9565 Wireless Network Adapter (rev 01)
phy3    wlan1       ath9k_htc   Atheros Communications, Inc. AR9271 802.11n

        (mac80211 monitor mode vif enabled for [phy3]wlan1 on [phy3]wlan1mon)
        (mac80211 station mode vif disabled for [phy3]wlan1)

You can then type ifconfig or ip a again to verify it started.

~# ifconfig

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 50:7b:9d:7a:c8:8a  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 38645  bytes 3053647 (2.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38645  bytes 3053647 (2.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.5.93  netmask 255.255.255.0  broadcast 192.168.5.255
        inet6  prefixlen 64  scopeid 0x20<link>
        ether  txqueuelen 1000  (Ethernet)
        RX packets 490  bytes 126996 (124.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 386  bytes 126911 (123.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan1mon: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        unspec 18-D6-C7-0E-E7-A1-30-3A-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 1202  bytes 363761 (355.2 KiB)
        RX errors 0  dropped 1176  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

After making sure that your wireless card is in monitor mode, you can start Bettercap by typing sudo bettercap –iface wlan1mon in a new terminal window, substituting the “wlan1” portion with your card’s name.

~# sudo bettercap --iface wlan1mon

bettercap v2.24.1 (built for linux amd64 with go1.12.7) [type 'help' for a list of commands]

wlan1  »

Once Bettercap opens, type help to see a list of all the modules running and commands. In the modules, you can see that the Wi-Fi module is not started by default.

wlan1  » help

           help MODULE : List available commands or show module specific help if no module name is provided.
                active : Show information about active modules.
                  quit : Close the session and exit.
         sleep SECONDS : Sleep for the given amount of seconds.
              get NAME : Get the value of variable NAME, use * alone for all, or NAME* as a wildcard.
        set NAME VALUE : Set the VALUE of variable NAME.
  read VARIABLE PROMPT : Show a PROMPT to ask the user for input that will be saved inside VARIABLE.
                 clear : Clear the screen.
        include CAPLET : Load and run this caplet in the current session.
             ! COMMAND : Execute a shell command and print its output.
        alias MAC NAME : Assign an alias to a given endpoint given its MAC address.

Modules

      any.proxy > not running
       api.rest > not running
      arp.spoof > not running
      ble.recon > not running
        caplets > not running
    dhcp6.spoof > not running
      dns.spoof > not running
  events.stream > running
            gps > not running
     http.proxy > not running
    http.server > not running
    https.proxy > not running
   https.server > not running
    mac.changer > not running
   mysql.server > not running
      net.probe > not running
      net.recon > running
      net.sniff > not running
   packet.proxy > not running
       syn.scan > not running
      tcp.proxy > not running
         ticker > not running
         update > not running
           wifi > not running
            wol > not running

Step 4Scan for Nearby Networks

To get started, let’s look at the commands we can issue under the Wi-Fi module. We can see this information by typing help wifi into Bettercap.

wlan1  » help wifi

wifi (running): A module to monitor and perform wireless attacks on 802.11.

        wifi.recon on : Start 802.11 wireless base stations discovery and channel hopping.
       wifi.recon off : Stop 802.11 wireless base stations discovery and channel hopping.
           wifi.clear : Clear all access points collected by the WiFi discovery module.
       wifi.recon MAC : Set 802.11 base station address to filter for.
     wifi.recon clear : Remove the 802.11 base station filter.
    wifi.deauth BSSID : Start a 802.11 deauth attack, if an access point BSSID is provided, every client will be deauthenticated, otherwise only the selected client. Use 'all', '*' or a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate every access point with at least one client and start a deauth attack for each one.
     wifi.assoc BSSID : Send an association request to the selected BSSID in order to receive a RSN PMKID key. Use 'all', '*' or a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate for every access point.
              wifi.ap : Inject fake management beacons in order to create a rogue access point.
  wifi.show.wps BSSID : Show WPS information about a given station (use 'all', '*' or a broadcast BSSID for all).
            wifi.show : Show current wireless stations list (default sorting by essid).
   wifi.recon.channel : WiFi channels (comma separated) or 'clear' for channel hopping.

  Parameters

         wifi.ap.bssid : BSSID of the fake access point. (default=<random mac>)
       wifi.ap.channel : Channel of the fake access point. (default=1)
    wifi.ap.encryption : If true, the fake access point will use WPA2, otherwise it'll result as an open AP. (default=true)
          wifi.ap.ssid : SSID of the fake access point. (default=FreeWiFi)
       wifi.assoc.open : Send association requests to open networks. (default=false)
     wifi.assoc.silent : If true, messages from wifi.assoc will be suppressed. (default=false)
       wifi.assoc.skip : Comma separated list of BSSID to skip while sending association requests. (default=)
      wifi.deauth.open : Send wifi deauth packets to open networks. (default=true)
    wifi.deauth.silent : If true, messages from wifi.deauth will be suppressed. (default=false)
      wifi.deauth.skip : Comma separated list of BSSID to skip while sending deauth packets. (default=)
  wifi.handshakes.file : File path of the pcap file to save handshakes to. (default=~/bettercap-wifi-handshakes.pcap)
       wifi.hop.period : If channel hopping is enabled (empty wifi.recon.channel), this is the time in milliseconds the algorithm will hop on every channel (it'll be doubled if both 2.4 and 5.0 bands are available). (default=250)
           wifi.region : Set the WiFi region to this value before activating the interface. (default=BO)
         wifi.rssi.min : Minimum WiFi signal strength in dBm. (default=-200)
      wifi.show.filter : Defines a regular expression filter for wifi.show (default=)
       wifi.show.limit : Defines limit for wifi.show (default=0)
        wifi.show.sort : Defines sorting field (rssi, bssid, essid, channel, encryption, clients, seen, sent, rcvd) and direction (asc or desc) for wifi.show (default=rssi asc)
      wifi.skip-broken : If true, dot11 packets with an invalid checksum will be skipped. (default=true)
      wifi.source.file : If set, the wifi module will read from this pcap file instead of the hardware interface. (default=)
          wifi.txpower : Set WiFi transmission power to this value before activating the interface. (default=30)

Here, we can see lots of options! For our purposes, we’ll be selecting the Wi-Fi recon module. To start it, type wifi.recon on into Bettercap. You’ll begin to get a flood of messages as soon as networks start to be detected. If this gets overwhelming, you can type events.stream off to mute the alerts.

wlan1  » wifi.recon on

[23:01:35] [sys.log] [inf] wifi WiFi region set to 'BO'
[23:01:35] [sys.log] [inf] wifi interface wlan1 txpower set to 30
[23:01:35] [sys.log] [inf] wifi started (min rssi: -200 dBm)
wlan1  » [23:01:35] [sys.log] [inf] wifi channel hopper started
wlan1  » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:38] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:38] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:38] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:39] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:39] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:39] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:41] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:41] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:41] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.ap.new] wifi access point ███████████████████████████████████████████
            
Comments

Leave a Reply

Your email address will not be published. Required fields are marked *


Get our best healthy recipes and nutrition tips straight to your inbox!
Get Healthy Now! Extra Health Updates
Sign Up
Your privacy is important to us
Join Our Newsletter!
Sign up today for free and be the first to get notified on new tutorials and snippets.
Subscribe Now