Hacker Handle

In the series of wifi hacking, I have already covered WPA handshake capture and social engineering . In this post I present to you yet another attack using a novel approach for gaining access to a network: it is based on the WPS protocol and is known as the Pixie-Dust attack. You will find a step-by-step guide after a short explanation of the theory behind the security flaw hereby discussed.

It is possible to obtain a Wifi password without the need for a powerful processor or a lengthy brute-force attack. Do you know how thieves steal cars and jewelry? They can also steal your password in a comparable manner: this is what will be described in this post. Meet social engineering, a fancy designation for "phishing". This type of attack is commonly used for stealing sensitive data, such as credit card details or account credentials. The popularity and spread of this method come down to one single characteristic: ease of use. Perpetrators don't need any background knowledge in coding, cyber security, or computer science, and the technique doesn't require advanced hardware. Today's attack is the art of fooling the user into thinking you're the legitimate manufacturer of his router: you then pretend that a firmware update is required and prompt the user for his password. You thus gain access to the Wifi network effortlessly, without using any brute-fo...

The Raspberry Pi is an ideally versatile platform for pentesting, as you would have guessed by reading my previous posts since it is my device of choice. I wrote about several attacks performed with Kali Linux running on a Pi 3, but I didn't mention the different setups possible: lab or headless. The lab setup This is the config you have probably used while installing Kali Linux on the Pi. Here, you are interacting with the Pi directly and not through an intermediate device (more on that later): this is why you need to use a keyboard, mouse and monitor connected to the USB and HDMI ports respectively. The Pi is powered with a 5V/2A adapter plugged in a wall socket. I made a diagram to illustrate the setup: Fig.1 - Lab setup (click to enlarge) This is called a "lab" setup for two reasons. First, it is meant to be rather permanent, in a fixed place, rather than portable. Second, this is usually the "laboratory" of the pentester, where he searches for new...

A text editor is where a script coder or hacker spends most of his time. Choosing one that we master and feel comfortable with is therefore a crucial factor affecting productivity and speed. A common mistake is made by new hackers: they find a text editor with a GUI and jump towards it because it's simple and similar to standard editors. This is a bad practice because they'll find only later that the capabilities of such editors are limited. It is recommended to start with a more advanced text editor since day one, even if this requires more effort, time and dedication to master. Today we'll talk about Vim, short for Vi Improved, a text editor that has earned the reputation of the most powerful editor out there. Vim, the friendly beast that scared newbies The very first thing we notice about Vim is that it doesn't have a GUI. Instead, it runs entirely in a terminal window. Add to this the lack of functionality for the mouse -- all interaction is done through the ke...

Perhaps the most important skill a hacker should master is programming. This is what makes the true difference between "hackers" and "script kiddies". The latter lacks the knowledge to write his own script: he rather uses programs made by others to attack his target. In contrast, a worthy hacker builds his own program tailored to his needs in order to exploit a specific vulnerability. Does that mean that a hacker never uses material written by others? Of course not. As most of the exploits (i.e. scripts that exploit a flaw) written by/for the Linux community are open-source, hackers often reverse-engineer these programs to understand how they work and potentially modify them to suit their own needs. What's more, when building his own script, a hacker very often integrates some tool from a fellow hacker. This is precisely how malware evolves on a daily basis: a programmer uses his know-how to combine multiple exploits in an effective way. Writing your firs...

There are different methods for getting unauthorized access to a Wifi network. I will try to cover several ones, but in this post I will focus on capturing a WPA handshake for a subsequent dictionary or brute-force attack. Requirements Before getting started make sure you have the following: Raspberry Pi 3 running Kali Linux ( tutorial here ) Monitor-mode and Packet-injection capable wifi adapter PC Decent internet connection We'll be using the wifi adapter with the Raspberry Pi, controlling them with a PC via VNC ( tutorial here ). What is a WPA handshake? In simple words, a WPA handshake is used to authenticate a user with an AP (Access Point). To illustrate things, think of it as a literal handshake: if the client presents his hand but the AP doesn't, the handshake can't happen and authentication thus fails. Because the engineering behind a WPA handshake is not the main purpose of this guide, let's dive into our work. Discovering the target AP Th...

In my previous post I talked about setting up a headless Raspberry Pi configuration -- the real purpose of using a Pi as a pentesting tool. The first step in making our Pi portable is the installation and activation of a VNC (Virtual Network Computing) connection. I will be glad to answer any questions you might have after reading this guide. Requirements As always, verify that you have the necessary material: Raspberry Pi 3 running Kali Linux ( tutorial here ) Power adapter HDMI cable TV or monitor Decent internet connection Installing the VNC server on the Pi There are many VNC softwares but we'll be using TightVNC because it's simple to configure and compatible with most devices. In a terminal window on your Pi, type apt-get install tightvncserver to download the software. Once completed, type  tightvncserver to start the VNC service. You will be prompted to choose a password, note that it cannot exceed 8 characters. You will also be asked if you wan...

The much-awaited tutorial. Here, you will learn step by step how to download and install the Kali Limux OS on a Raspberry Pi 3. Let's get started. First, make sure that you have everything necessary by checking this list: Raspberry Pi 3 Model B or B+ A computer A microSD card An HDMI cable A micro USB power adapter A USB keyboard A monitor A stable and decent Internet connection Note regarding the post: you can click on any image to enlarge it. I- Downloading Kali Linux Head to www.kali.org , go to Downloads and click on Kali ARM Images as follows: Then scroll down until you find the Raspberry Foundation section and download the first file in the table: Download the file and don't open it. Leave it as it is. II- Flashing Kali to the microSD card Head to www.etcher.io and download the software. Once done, run it: Click on Select image and choose the file you downloaded in step 1 (the Kali image). You should find it in the Downloads folder. Nex...