There are many tools out there for Wi-Fi hacking,
but few are as integrated and well-rounded as Bettercap. Thanks to an
impressively simple interface that works even over SSH, it’s easy to
access many of the most powerful Wi-Fi attacks available from anywhere.
To capture handshakes from both attended and unattended Wi-Fi networks,
we’ll use two of Bettercap’s modules to help us search for weak Wi-Fi
passwords.
Wi-Fi Hacking Frameworks
The idea of organizing tools into useful frameworks isn’t new, but there are many ways of doing it. Frameworks like Airgeddon include
an incredible amount of bleeding-edge Wi-Fi hacking tools but cannot be
used over a command line. That’s because Airgeddon requires the ability
to open new windows for different tools to run, so if you’re
communicating with a Raspberry Pi over SSH, you can forget launching many Wi-Fi hacking tools.
Bettercap
allows access to the tools needed to swiftly scout for targets,
designate one, and grab a WPA handshake to brute-force. While we won’t
be working with any WPS recon modules today, our setup will allow you to
audit for weak WPA passwords with ease. The way Bettercap is organized
allows for anyone within proximity of a target to probe for weak WPA
passwords while staying stealthy and undetected.
WPA Hacking with Bettercap
Bettercap
is described as the Swiss Army knife of wireless hacking. To that end,
it has a lot of modules for sniffing networks after you connect to them,
as well as other modules looking at Bluetooth devices.
The most straightforward use of Bettercap is to use the scanning and
recon modules to identify nearby targets to direct attacks at, then
attempt to identify networks with weak passwords after capturing the
necessary information.
Our
targets, in this case, will be two kinds of networks: attended and
unattended. Attended networks are easier to attack, and a larger number
of tools will work against them. With an attended network, there are
people actively using it to download files, watch Netflix, or browse the
internet. We can count on there being devices to kick off the network
that will give us the information we need to try to crack the password.
Unattended
networks are trickier to target. Because they do not have devices with
an active data connection on them to disconnect, these networks were
typically unable to yield the information needed to audit for a weak
password. With the PMKID approach to cracking WPA passwords, that’s no
longer the case. The tool is integrated as one of the Wi-Fi hacking
modules and makes it even easier to attack.
Brute-Forcing Power Workarounds
Bettercap
doesn’t directly break the passwords of networks it targets, but it
would be impossible to do so without the information Bettercap provides.
Once a handshake is captured, you’ll need to use a brute-forcing tool
like Hydra or Aircrack-ng to try a list of common passwords against the hash you’ve captured. How quickly it will happen depends on a few factors.
The
first is whether the password used to secure the target network is in
the password list you’re using at all. If it isn’t, this attack won’t
succeed, so it’s essential to use lists of real stolen passwords or
customized password generators like CUPP. If you don’t believe that brute-force attacks are still effective, you’d be surprised to learn that any eight-character password can be brute-forced in a little over two hours.
Another workaround to using a device like a Raspberry Pi for Wi-Fi hacking is to upload the WPA handshake to a cracking service or network. Many hackers use networks that distribute the cracking load among volunteer “worker” computers, which lets the group crack WPA handshakes that less powerful devices can gather.
If
you were to run Bettercap on a Raspberry Pi and then upload the
captured handshakes to a distributed WPA cracker, you would be able to
crack passwords within mere minutes. Alternatively, you could set this
up yourself if you have a computer with a powerful processor and GPU.
What You’ll Need
To
follow this guide, you’ll need a wireless network card you can put into
wireless monitor mode. You can find a list of these in our previousarticles on
buying Wi-Fi network adapters. Your computer may have an internal card
that supports wireless monitor mode, but you’ll need to be running Linux
to work with it. You can refer to our other guide to find out if your existing card will work.
You
can follow our guide today with Kali Linux on your laptop, a Raspberry
Pi running Kali Linux, or even Ubuntu with some additional installation.
For best results, you should use Kali Linux, because Bettercap comes
preinstalled.
Step 1Install Bettercap
If
you have Kali Linux installed, you can find it in the “Sniffing &
Spoofing” folder in the “Applications” menu or from a search.
If you don’t have Bettercap, the documentation for the project is on the Bettercap website. If you’re running Kali, you can run apt install bettercap to add it, as seen below. Then, you can locate the tool as seen above.
~# apt install bettercap
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
liblinear3
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
bettercap-caplets
Suggested packages:
bettercap-ui
The following NEW packages will be installed:
bettercap bettercap-caplets
0 upgraded, 2 newly installed, 0 to remove and 1854 not upgraded.
Need to get 6,931 kB of archives.
After this operation, 25.8 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 bettercap amd64 2.26.1-0kali1 [6,821 kB]
Get:2 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 bettercap-caplets all 0+git20191009-0kali1 [110 kB]
Fetched 6,931 kB in 3s (2,332 kB/s)
Selecting previously unselected package bettercap.
(Reading database ... 417705 files and directories currently installed.)
Preparing to unpack .../bettercap_2.26.1-0kali1_amd64.deb ...
Unpacking bettercap (2.26.1-0kali1) ...
Selecting previously unselected package bettercap-caplets.
Preparing to unpack .../bettercap-caplets_0+git20191009-0kali1_all.deb ...
Unpacking bettercap-caplets (0+git20191009-0kali1) ...
Setting up bettercap-caplets (0+git20191009-0kali1) ...
Setting up bettercap (2.26.1-0kali1) ...
bettercap.service is a disabled or a static unit, not starting it.
If you’re not running Kali, you’ll need to refer to Bettercap’s more complicated setup.
If you’re on a Mac, you can do network recon, but the modules I’m
writing about won’t work. Still, you can check out other features by
installing it with Homebrew, using the command brew install bettercap.
Step 2Launch Bettercap
When
ready, click on Bettercap’s icon to launch it. You should see the
following help menu in a terminal window, although the tool will not
automatically start.
Usage of bettercap:
-autostart string
Comma separated list of modules to auto start. (default "events.stream")
-caplet string
Read commands from this file and execute them in the interactive session.
-cpu-profile file
Write cpu profile file.
-debug
Print debug messages.
-env-file string
Load environment variables from this file if found, set to empty to disable environment persistence.
-eval string
Run one or more commands separated by ; in the interactive session, used to set variables via command line.
-gateway-override string
Use the provided IP address instead of the default gateway. If not specified or invalid, the default gateway will be used.
-iface string
Network interface to bind to, if empty the default interface will be auto selected.
-mem-profile file
Write memory profile to file.
-no-colors
Disable output color effects.
-no-history
Disable interactive session history file.
-silent
Suppress all logs which are not errors.
-version
Print the version and exit.
Here, we can see the arguments we can start Bettercap with. One of the most useful of these is -iface which
allows us to define which interface to work with. If we have an
external wireless network adapter, we’ll need to define it with that.
Step 3Connect Your Network Adapter & Start
Now,
we’ll need to put our card into monitor mode. If we’re connected to a
Wi-Fi network already, Bettercap will start sniffing that network
instead, so monitor mode always comes first.
Locate your card with ifconfig or ip a to find the name of your network adapter. It should be something like wlan0 for your internal adapter and wlan1 for your USB network adapter.
Take the adapter that’s monitor mode-compatible, and switch it to monitor mode by opening a terminal window and typing airmon-ng start wlan1, with wlan1 substituted with the name of your network adapter.
~# airmon-ng start wlan1
Found 3 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
559 NetworkManager
621 wpa_supplicant
14785 dhclient
PHY Interface Driver Chipset
phy0 wlan0 ath9k Qualcomm Atheros QCA9565 / AR9565 Wireless Network Adapter (rev 01)
phy3 wlan1 ath9k_htc Atheros Communications, Inc. AR9271 802.11n
(mac80211 monitor mode vif enabled for [phy3]wlan1 on [phy3]wlan1mon)
(mac80211 station mode vif disabled for [phy3]wlan1)
You can then type ifconfig or ip a again to verify it started.
After making sure that your wireless card is in monitor mode, you can start Bettercap by typing sudo bettercap –iface wlan1mon in a new terminal window, substituting the “wlan1” portion with your card’s name.
~# sudo bettercap --iface wlan1mon
bettercap v2.24.1 (built for linux amd64 with go1.12.7) [type 'help' for a list of commands]
wlan1 »
Once Bettercap opens, type help to
see a list of all the modules running and commands. In the modules, you
can see that the Wi-Fi module is not started by default.
wlan1 » help
help MODULE : List available commands or show module specific help if no module name is provided.
active : Show information about active modules.
quit : Close the session and exit.
sleep SECONDS : Sleep for the given amount of seconds.
get NAME : Get the value of variable NAME, use * alone for all, or NAME* as a wildcard.
set NAME VALUE : Set the VALUE of variable NAME.
read VARIABLE PROMPT : Show a PROMPT to ask the user for input that will be saved inside VARIABLE.
clear : Clear the screen.
include CAPLET : Load and run this caplet in the current session.
! COMMAND : Execute a shell command and print its output.
alias MAC NAME : Assign an alias to a given endpoint given its MAC address.
Modules
any.proxy > not running
api.rest > not running
arp.spoof > not running
ble.recon > not running
caplets > not running
dhcp6.spoof > not running
dns.spoof > not running
events.stream > running
gps > not running
http.proxy > not running
http.server > not running
https.proxy > not running
https.server > not running
mac.changer > not running
mysql.server > not running
net.probe > not running
net.recon > running
net.sniff > not running
packet.proxy > not running
syn.scan > not running
tcp.proxy > not running
ticker > not running
update > not running
wifi > not running
wol > not running
Step 4Scan for Nearby Networks
To get started, let’s look at the commands we can issue under the Wi-Fi module. We can see this information by typing help wifi into Bettercap.
wlan1 » help wifi
wifi (running): A module to monitor and perform wireless attacks on 802.11.
wifi.recon on : Start 802.11 wireless base stations discovery and channel hopping.
wifi.recon off : Stop 802.11 wireless base stations discovery and channel hopping.
wifi.clear : Clear all access points collected by the WiFi discovery module.
wifi.recon MAC : Set 802.11 base station address to filter for.
wifi.recon clear : Remove the 802.11 base station filter.
wifi.deauth BSSID : Start a 802.11 deauth attack, if an access point BSSID is provided, every client will be deauthenticated, otherwise only the selected client. Use 'all', '*' or a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate every access point with at least one client and start a deauth attack for each one.
wifi.assoc BSSID : Send an association request to the selected BSSID in order to receive a RSN PMKID key. Use 'all', '*' or a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate for every access point.
wifi.ap : Inject fake management beacons in order to create a rogue access point.
wifi.show.wps BSSID : Show WPS information about a given station (use 'all', '*' or a broadcast BSSID for all).
wifi.show : Show current wireless stations list (default sorting by essid).
wifi.recon.channel : WiFi channels (comma separated) or 'clear' for channel hopping.
Parameters
wifi.ap.bssid : BSSID of the fake access point. (default=<random mac>)
wifi.ap.channel : Channel of the fake access point. (default=1)
wifi.ap.encryption : If true, the fake access point will use WPA2, otherwise it'll result as an open AP. (default=true)
wifi.ap.ssid : SSID of the fake access point. (default=FreeWiFi)
wifi.assoc.open : Send association requests to open networks. (default=false)
wifi.assoc.silent : If true, messages from wifi.assoc will be suppressed. (default=false)
wifi.assoc.skip : Comma separated list of BSSID to skip while sending association requests. (default=)
wifi.deauth.open : Send wifi deauth packets to open networks. (default=true)
wifi.deauth.silent : If true, messages from wifi.deauth will be suppressed. (default=false)
wifi.deauth.skip : Comma separated list of BSSID to skip while sending deauth packets. (default=)
wifi.handshakes.file : File path of the pcap file to save handshakes to. (default=~/bettercap-wifi-handshakes.pcap)
wifi.hop.period : If channel hopping is enabled (empty wifi.recon.channel), this is the time in milliseconds the algorithm will hop on every channel (it'll be doubled if both 2.4 and 5.0 bands are available). (default=250)
wifi.region : Set the WiFi region to this value before activating the interface. (default=BO)
wifi.rssi.min : Minimum WiFi signal strength in dBm. (default=-200)
wifi.show.filter : Defines a regular expression filter for wifi.show (default=)
wifi.show.limit : Defines limit for wifi.show (default=0)
wifi.show.sort : Defines sorting field (rssi, bssid, essid, channel, encryption, clients, seen, sent, rcvd) and direction (asc or desc) for wifi.show (default=rssi asc)
wifi.skip-broken : If true, dot11 packets with an invalid checksum will be skipped. (default=true)
wifi.source.file : If set, the wifi module will read from this pcap file instead of the hardware interface. (default=)
wifi.txpower : Set WiFi transmission power to this value before activating the interface. (default=30)
Here, we can see lots of options! For our purposes, we’ll be selecting the Wi-Fi recon module. To start it, type wifi.recon on into
Bettercap. You’ll begin to get a flood of messages as soon as networks
start to be detected. If this gets overwhelming, you can type events.stream off to mute the alerts.
wlan1 » wifi.recon on
[23:01:35] [sys.log] [inf] wifi WiFi region set to 'BO'
[23:01:35] [sys.log] [inf] wifi interface wlan1 txpower set to 30
[23:01:35] [sys.log] [inf] wifi started (min rssi: -200 dBm)
wlan1 » [23:01:35] [sys.log] [inf] wifi channel hopper started
wlan1 » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:38] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:38] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1 » [23:01:38] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1 » [23:01:39] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:39] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1 » [23:01:39] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:41] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:41] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:41] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1 » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:42] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1 » [23:01:42] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1 » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1 » [23:01:42] [wifi.ap.new] wifi access point ███████████████████████████████████████████
, for everyone. More @ http://goo.gl/7AJzbL --><svg width="55" height="80" viewBox="0 0 55 80" xmlns="http://www.w3.org/2000/svg" fill="%23FFF"> <g transform="matrix(1 0 0 -1 0 80)"> <rect width="10" height="20" rx="3"> <animate attributeName="height" begin="0s" dur="4.3s" values="20;45;57;80;64;32;66;45;64;23;66;13;64;56;34;34;2;23;76;79;20" calcMode="linear" repeatCount="indefinite" /> </rect> <rect x="15" width="10" height="80" rx="3"> <animate attributeName="height" begin="0s" dur="2s" values="80;55;33;5;75;23;73;33;12;14;60;80" calcMode="linear" repeatCount="indefinite" /> </rect> <rect x="30" width="10" height="50" rx="3"> <animate attributeName="height" begin="0s" dur="1.4s" values="50;34;78;23;56;23;34;76;80;54;21;50" calcMode="linear" repeatCount="indefinite" /> </rect> <rect x="45" width="10" height="30" rx="3"> <animate attributeName="height" begin="0s" dur="2s" values="30;45;13;80;56;72;45;76;34;23;67;30" calcMode="linear" repeatCount="indefinite" /> </rect> </g></svg>)
Hi where to look for step % ?
what do you mean