Wireshark 101: Wireless Sniffing Pt 2 - HakTip 140 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

today on hack tip we're checking out
wireless packet captures for WEP and WPA
this episode of hot tip is brought to
you by Atlassian welcome to hack tip the
show were weak breakdown concepts tools
and techniques for hackers gurus and IT
ninjas I'm Shannon Morse and today we
are checking out wireless packet
captures in Wireshark now this week we
are going to expand our knowledge about
wireless packet captures and discuss how
to customize your options for a better
wireless capture so first off let's go
ahead and take a look at some new
columns in Wireshark so I'm going to
open up one of my Wireshark Network
analyzers over here
so before we move on to WEP and WPA in
the differences we're going to add some
new columns to our Wireshark packet
captures so to do so you simply need to
go over to edit and choose preferences
and go down to columns so that's gonna
be under appearance when you click on
your different columns over here you'll
notice if you double click in the newest
version of Wireshark you'll get a nice
little drop down so you'll simply want
to rename your new column to whatever
you want so for example I have TX rate
over here and then I want to find the
matching header type TX rate for the
actual column specification so I just
added three new columns over here I have
our SSI TX rate and frequency in channel
so our SSI stands for received signal
strength indication and shows the RF
signal strength of a packet TX rate is
the transmission rate for the data in a
packet and frequency and channel is
obviously frequencies and channels so
these are all going to work for all your
different wireless packet captures that
you do for each one you just go to edit
preferences and then add them there are
also some special filters that you can
use on a wireless capture so if you
check out the Wireshark website links in
the show notes of course you will find
several different resources for simple
filters that you can use to capture
specific data so for example if I scroll
way down here to the bottom you'll
notice that I have a whole bunch of
different display filters that I can use
so for example if I just want to see 802
11 base traffic I have W land if I want
to show from a specific MAC address I
can use WLAN address equals equals and
then the MAC address and so on and so
forth look I can hide beacon frames but
who wants to hide the bacon
after the break I am going to show you
the differences between WEP and WPA
generated content in Wireshark but first
let's take a break for a sponsor from
genome mapping to 3d printing to space
exploration or maybe just planning your
next team off-site behind every great
human achievement there is a team so the
big question is how do you bring
everybody together to build whatever is
next the solution is Atlassian you can
unleash your team's potential without
less ian's collaboration software so you
can work and you can communicate better
together simultaneously yeah you can
match up it actually works
you can assign track and manage
different tasks for any kind of project
no matter how complex they might be and
that's the clarity of JIRA you can
create and you can share content you can
organize your results and bring team
members up to speed with each other yay
because the flexibility of confluence
you can also instant message or video
chat with your team from any device with
the freedom of HipChat or you can test
review in manage code which is probably
my favorite in real time with the power
of bitbucket Atlassian is helping teams
in every single industry from startups
to enterprise turn great ideas into
reality I use bitbucket I use it to
share code snippets with the co-workers
and then I get their feedback so it
makes for a very very handy way that I
could make better segments for you guys
while I am learning how to write code
you can go to Atlassian comm to learn
more and see how JIRA confluence HipChat
and fit pocket give your team everything
you need to organize discuss and
complete shared work that's Atlassian
comm unleash the potential of your team
and build what's next and we're back
with some packet capture examples I know
this is the part that you guys are
looking forward to so let's go ahead and
take a look at a WEP packet capture
example so you're going to see an
authentication challenge under packet
four and this is a whole bunch of
authentications and acknowledgments if I
drop down all the different options
below the frames you'll notice a status
code of successful and a challenge text
so the challenge checks shows you 16 the
tag number so if we move on in packet
number 6 the challenge is acknowledged
with unencrypted data authenticating the
user to the W ap and if we look under
data you'll see the unencrypted data
right below moving on in packet number 8
we'll see the status as successful so
let's scroll down and check that out
there you go your status code is
successful now if your authentication
fails it's gonna look a little bit
different and I have an example of that
one as well so I'll pull that up here we
will look at packet number 8 so the very
last packet and I'm gonna go ahead and
drop down on these if the authentication
failed it would look something like this
packet capture so under number 8 we see
that we never received unencrypted data
but we ended up with a few errors now
WPA is going to be a little bit
different and I have an example of those
as well so in this case we're going to
look at the very first one the beacon so
this is a beacon frame when we drop down
to our tags which is information found
underneath 802 11 so I Triple E 802 11
management frame you'll notice that you
get a bunch of information about the
fact that it is WPA if we look back up
at the top at the different packets
you'll notice that authentication
happens normally you get a beacon frame
a pro request and response there's a
couple of authentications and
Association requests in an association
response and then we receive these key
packets which are transmitted and
there's four key packets so this ends up
being a four-way handshake you have to
have four different keys and you have to
have the probe request and response and
then the authentication once all of this
happens you end up with your data so you
get a bunch of data packets and your
data is flowing smoothly if there is a
failure in your WPA authentication it's
going to look something like this so you
end up with your beacon frame your probe
request in response your authentications
your association
request and response but then you get a
whole bunch of keys so instead of just
having four keys transmitted it tries
one of four 2:04 then it tries 1 & 2
again 1 & 2 1 & 2 & eventually gives you
a do n ocation because at once wasn't
able to successfully add you to the
network so you would have several
several more key authentication attempts
and a deaaath right after now if you
would like to delve into more of these
packets even more than what I just
described you can always check out a ton
of examples over at chris sanders
website chris sanders org slash captures
where he lists out a whole bunch of
great examples and he also has a book
called practical packet analysis that
you should definitely check out now if
you are using a Windows 10 computer for
Wireshark here's a handy little tip that
I discovered after a little bit of
frustration yes I have a Linux box as
well but I decided Windows 10 because it
looks better whenever I scale it to my
editing platform so for this one it gets
a little Jinky with Wireshark so here's
a tip some builds of Windows 10 are not
going to play nice with Wireshark
because the necessary download called
WinPcap hasn't been updated for the new
operating system it's updated for 8 but
not 10 so an open-source version a wind
peak app has been introduced and you can
download it over at Wynn 10 peak at org
so this should fix any kind of issues
with getting Wireshark to recognize your
network interfaces and hopefully you
don't have any problems with that now
let me know what you think you can
always send me a comment below or you
can email us tips at hacker 5 org
special big thanks to our new sponsor
for helping us bring hack tip back and
be sure to check out our sister show
hack 5 for more great stuff just like
this and I will be there reminding you
to trust your Tecna lest