A computer with Wireshark and AirCrack, wifi adapter that supports monitoring and some time.
{ } means commands for terminal. ( ) Means general stuff.
To make this thing to actually work we will need to use Wireshark to sniff out traffic between our host. Today's goal is to capture unencrypted HTTP traffic coming to the hosts' computer.
First things first, we have to break the encryption of the network. Even if you have the password, do not connect quite yet, it will bring attention to us and opens up more risk of detection. Instead, we can add some Wi-Fi keys we know to Wireshark. To decrypt the data, we sniff without connecting to the network. This means our attack will be mostly passive, leaving very little opportunity for us to be detected.
One serious thing we'll need that is not passive is a Wi-Fi handshake to see the ongoing traffic. Because since Wireshark needs to observe a Wi-Fi handshake to decyrpt subsequent traffic, the computer we're interested in with an awesome filter, capture a four-way WPA handshake, and then decrpyt the data with the password we know.
Conditions must be favorable for this attack to have a chance of succeeding. In particular, if the camera does not use a insecure interface, then the data will be encrypted, and we will not be able to see it.
If not one is watching the camera feed, or it's not left displaying on a monitor, there will be no insecure traffic to intercept, so we will not see anything. If we cannot kick a client off the network momentarily to generate a four-way handshake, then knowing the password wont do us any good. And finally, if we're out of range of the network, we won't be able to intercept traffic we can't clear.
While this may seem like alot of requirements, it's fairly common to be able to do this. If the target has a Wi-Fi security camera and keeps a monitor viewing the display, the Wi-Fi password should be all you really need, aside from a Wi-Fi adapter.
Once you're in range and have any operating system loaded up with the required tools, you should be ready. Plug in your adapter, and make sure you have Wireshark installed to begin. If you dont have Wireshark, sudo apt install Wireshark -y or sudo pacman -S Wireshark -y.
To start, you'll need to access the built-in interface on whatever webcam or Wi-Fi security camera you want to intercept. In a browser window on your "host" computer, navigate to the HTTP interface, enter any password required, and the begin viewing the live webcam view.
If you need to find your camera on the network, you can run a Nmap scan to discover different devices on the network running insecure HTTP ports.
For this command, you'll need to know the network range. you can find this by typing ifconfig and copying down the IP address assigned to your computer. Then, you can type ipcalc and your IP address to calculate the network range. It should be something like 192.168.0.0/24. Run this following command but replace "IP" for your own network range. sudo nmap -p 80,81,8080, 8081 IP
This will look for devices with these ports "open", and when you find one, you can navigate it by typing the IP address and then :81 on that IP address. If you want to navigate to port 80801 type 192.168.0.1:8081 to your browser window.
You'll need to plug in your Wi-Fi adapter, I prefer the "Alfa AWUSO36NHA". You'll need to do two things before starting up Wireshark, the first being putting the card into wireless monitor mode, and the second being identifying the channel the router you're targetting is a broadcast on.
To put your card into wireless monitor mode, identify the name of your card by running ifconfig in a terminal window. It should be named something like wlan0 or wlan0mon.
Once you've found the name of your wireless card, we'll need to put it into monitor mode. Run the following command in a terminal window, with the name of your card substituted for wlan0.
airmon-ng start wlan0
airodump-ng start wlan0mon
This will put your card in wireless monitor more, changing the name of the card to add "mon" at the end. It will also start Airodump-ng, which will start scanning for nearby wireless networks.
Look for the Wi-Fi network that you're looking to sniff, and note the channel that it's on. We'll need to switch our card to that channel to intercept the images in Wireshark. The following is a sample output. Some of the output has been converted to a table. It is still a part of the console output.
CH 4 ][ Elapsed: 0 s ][ 2018-12-24 02:42
| BSSID | PWR | Beacons | #Data, | #/s | CH | MB | ENC | CIPHER | AUTH | ESSID |
|---|---|---|---|---|---|---|---|---|---|---|
| C0:8A:DE:39:CD:D9 | -46 | 2 | 0 | 0 | 1 | 130 | WPA2 | CCMP | MGT | TWCWiFi-Passpoint |
| C0:8A:DE:F9:CD:D8 | -47 | 2 | 0 | 0 | 1 | 130 | OPN | TWCWiFi | ||
| C0:8A:DE:B9:CD:D8 | -46 | 2 | 0 | 0 | 1 | 130 | OPN | SpectrumWiFi | ||
| C0:8A:DE:39:CD:D8 | -47 | 2 | 0 | 0 | 1 | 130 | OPN | CableWiFi | ||
| 78:96:84:00:B5:B0 | -42 | 2 | 0 | 0 | 1 | 130 | WPA2 | CCMP | PSK | The Daily Planet |
| 00:9C:02:D2:5E:B9 | -60 | 3 | 0 | 0 | 1 | 54e. | WPA2 | CCMP | PSK | HP-Print-B9-Officejet Pro 8600 |
| 20:10:7A:92:76:43 | -51 | 2 | 0 | 0 | 1 | 130 | WPA2 | CCMP | PSK | SBG6580E8 |
| DE:F2:86:EC:CA:A0 | -45 | 1 | 0 | 0 | 11 | 195 | WPA2 | CCMP | PSK | Bourgeois Pig Guest |
| D6:04:CD:BD:33:A1 | -55 | 1 | 0 | 0 | 11 | 130 | WPA2 | CCMP | PSK | DirtyLittleBirdyFeet |
| BSSID | STATION | PWR | Rate | Frames | Lost | CCMP | Probe |
root@kali:~/Desktop#
If our target is on channel 11, we'll run the following command to set our card to channel 11.
airmon-ng start wlan0mon 11
Now that our wireless network adapter is listening on the same channel as the traffic we want to intercept, it's time to start Wireshark. When Wireshark opens, double-click the card you put in monitor mode to start the capture. Our card should now be scanning on the correct channel, but without the network password, we won't be able to see anything. To solve that, we'll need to add some encryption keys to Wireshark.
To add the encryption keys to Wireshark, click on "Edit" in the menu bar, then "Preferences" to show the preferences menu. Next, select "Protocols" from the sidebar to see a list of protocols that Wireshark can translate.
In the Protocols drop-down menu you just opened, you'll want to select IEEE 802.11 to show options for decryptiing Wi-Fi. Make sure that the "Enable Decryption" box is checked, and then click the "Edit" button next to "Decryption keys" to open the list of keys Wireshark will try to use to decrypt traffic.
Once the WEP and WPA decryption key menu is open, click on the field to the left and select "pa-psw" to add. While we can also add a "wpa-psk" here, we would have to calculate it ourselves, which is more complicated than simply entering the password.
For the decryption to work, you must add the key by clicking on the plus (+) icon, and then enter the key in the format (password:networkname) to add to the list.
Click "OK" to save the key, and now we should be able to decrypt traffic from his network, if we can grab a four-way Wi-Fi handshake.
In our Wireshark capture, we're sure to be seeing a lot of traffic. While we can't yet decrypt it because we don't have a handshake, we can build a filter to make sure we're only seeing traffic to the device we're sniffing.
The best way to do this over a Wi-Fi network is to find a piece of traffic to the computer we're looking for, and then make a display filter to show only packets heading to that MAC address. That means that any traffic directed to the target computer will be displayed, and any other network traffic will be ignored.
Looking under the packet information, right-click the "Receiver address" for a packet being sent to the target device, select "Apply as Filter", and then "Selected". Now, we should see only packets to the target.
Now that we've isolated the traffic from our target device, we need to generate a four-way handshake by kicking the target computer off the network momentarily while Wireshark is listening. To do this, we can use tool named MDK3, which is able to kick any devices connected to Wi-Fi off and generate a handshake. Highly suggest looking into using MDK3 for Advanced Wi-Fi jamming.
Because we already know the channel our Wi-Fi network is on, we can use MDK3 to take out any device operating on that channel. You should not need long to generate a WPA handshake. With "wlan0mon" swapped for the name of your wireless card, and "11" swapped for the channel you're attacking, run the following command in a terminal window to start jamming the network.
{
mdk3 wlan0mon d -c 11
}
After a few moments, nearby devices on the network should automatically reconnect, allowing you to intercept the WPA four-way handshake. If you want to make sure you have it, you can open a new terminal and run Airodump-ng to see when you get a WPA handshake. To do so, type:
{
airodump-ng wlan0mon 11
}
Substituting "wlan0mon" and "11" for your actuals to watch for WPA handshakes while you run MDK3.
Once you see the result above, you've captured a WPA four-way handshake! Make sure to match the MAC address shown with the wireless network you're targetting to avoid a handshake for the wrong network.
Now that we have a four-way handshake and have entered the network key, we should have full access to data flowing over the network. While HTTPS is still of the table, we should be able to see raw HTTP just fine.
While we've gained access to the network traffic and narrowed it down to the target computer, there may be other traffic that's unrelated and makes it difficult to focus on what we're looking for. To cut through this, we'll add another network filter to show only HTTP traffic flowing through on the network.
In the Wireshark main view, type http into the display filter bar.
Now that we can see the HTTP traffic from the web app, we'll need to select the encoded JPEG files in order to turn them into something we can work with. Stop the capture, and then click on "File", then "Export Objects." We'll be exploring the HTTP objects we've found, so click on "HTTP" to open the object list.
In the HTTP object list, we'll see a list of HTTP objects we've intercepted. Here we can see the JPEG images we want to decode. You can select one one or all of them, and then clock "Save" or "Save All" and pick a location to export the files to.
Click "Close", and then navigate to the folder you exported the images to. You should see a list of files that Wireshark exported from our capture. This will be more or less depending how long you ran the capture for.
Finally, click on one of the images to see the image that was intercepted on the way to the target computer. You should see a frame from the video feed!