read

This is a short note on Wi-Fi testing tooling and the value of revisiting simpler utilities. The professional takeaway is to keep wireless testing scoped, authorized, and repeatable: know what the tool captures, where credentials or handshakes are stored, and how to clean up afterward.

It was this one about besside-ng.

If you had no concern about stealth, it is as simple as:

  1. Make sure your wireless card is connected and available: sudo iwconfig should do it.
  2. Start a capture: sudo besside-ng wlan0 -vv

That’s it.

besside-ng will hop channels and attempt deauth attacks on everything it finds automatically.

It can even be configured to send the .cap files for cracking on a remote service as it captures them.

If you’d like to just pass the captures through a simple word-list on your testing machine you could use:

sudo aircrack-ng wpa.cap -w rockyou.txt

(The Alfa AWUS036H is one of the cards you can find relatively cheap that won’t give you any trouble with wifi analysis tools).

References

Blog Logo

Chad Duffey


Published

Image

Chad Duffey

Blue Team -> Exploit Development & things in-between

Back to Overview