WIFI
Introduction
Once you are into the network, it is time to analyse it, looking for further wireless-related vulnerabilities.
Capture and analysis of network traffic
Even if you encounter an open or WPA-PSK network, it is necessary to analyse the traffic looking for important or sensitive information transmitted through clear text protocols.
Open network
Because Open networks don't encrypt the traffic, it is pretty easy to capture and analyse the traffic.
For doing so, use airodump-ng to dump all the data into files. Then, filter the data and put everything on a single cap file. This way, analysing all the traffic on Wireshark is easier.
WPA-PSK
In the case of WPA-PSK, the network is encrypted, so you need to get the key to decrypt all the traffic and capture the WPA handshake during the sniffing process (Just deautenticate some users). But then, the process is almost the same.
Exposed network admin panels
Inside the network, scan the devices with tools such as Nmap to find some network admin panels (ports 80, 443, 8080, etc.). These panels are typically located on the network gateway when the router also acts as an access point.
In some cases, the admin panel can modify the network segments, so you can use it to pivot or perform port forwarding, accessing other network resources.
Captive portal
Some wireless networks use a captive portal to authenticate users. It is necessary to examine the captive portal looking for vulnerabilities that could lead to access to the device or the network.
Web page
Captive portals use web pages asking for credentials to check the client's authenticity and allow it to enter the network.
In this task, you should evaluate the web security by bypassing the authentication mechanism or exploiting any other vulnerability that could compromise the company's security.
Unauthenticated access to other network segments
The captive portals introduce the client to a preventing network until it is authenticated and moved to the internal network.
You need to check if you can get access to other networks. For that, you can use the following tools.
Netdiscover
Outside traffic allowed
Users who are not authenticated and reside on the temporal network should not be allowed to send data to the Internet or other networks until they are authenticated.
To check this, you can try to resolve DNS names or ping hosts outside the network. If they work, you can use DNS or ICMP tunnels with the following tools:
References
Last updated