Access Denied | Yash Sapkale

Today we’re gonna take a look at how to hack Wi-Fi hotspots. In the last few years, many commercial hotspots have been poppin’ up literally everywhere. Most of these work as a complement to a ISP’s (Internet Service Provider) subscription. Others work with a pay-to-use model… if you want to use for X amount of hours, you pay $ Y amount of money.

Once the client connects into one of these hotspots he will either have to login using credentials (email & passwd) or input his credit card to purchase time…

When the client logs in or pays for time on the hotspot, his MAC address is now whitelisted (a list of approved addresses which are free to go thru to the internet, if a MAC address isn’t on that list he will be restricted to the local area network) and therefore allowed to browse the web freely.

What can we do with this information?

An attack into this type of network seems fairly easy to accomplish… as always you’ll want to start by bringing up a monitor interface:

airmon-ng start <wireless interface>

Then, begin scanning for associated clients on a specific channel and pay attention to the incoming traffic. You can use the following command to do so:

airodump-ng -c <channel> -a <monitor interface>

Optionally, you could write the traffic into a file (-w <filename>). During the scan pay attention to the OPEN networks you find, see which ones are hotspots (hint: they usually end with the word “wifi”) and most importantly keep an eye out for associated clients.

If you’ve found an associated client, looks at the amount of “frames” (read traffic) shown in the scan. More frames = more traffic; continuous frames = continuous traffic = authenticated client. If we clone an unauthenticated client, the method won’t work. So it’s worth making sure we have the right network and right client under the scope.

Once your ready, clone the client using the following command:

ifconfig <wireless interface> hw ether <MAC address>

Alternatively, you can use macchanger as well.

Let’s take a look at the video in high quality!

Network Wireless Hacking Tools, new version and support your kali linux

The cookie which facebook uses to authenticate it’s users is called “Datr”, If an attacker can get hold of your authentication cookies, All he needs to do is to inject those cookies in his browser and he will gain access to your account. This is how a facebook authentication cookie looks like:

How To Steal Facebook Session Cookies And Hijack An Account? 

An attacker can use variety of methods in order to steal your facebook authentication cookies depending upon the network he is on, If an attacker is on a hub based network he would just sniff traffic with any packet sniffer and gain access to victims account.

If an attacker is on a Switch based network he would use an ARP Poisoning request to capture authentication cookies, If an attacker is on a wireless network he just needs to use a simple tool called firesheep in order to capture authentication cookie and gain access to victims account.

In the example below I will be explaining how an attacker can capture your authentication cookies and hack your facebook account with wireshark.

Step 1 – First of all download wireshark from the official website and install it.

Step 2 – Next open up wireshark click on analyze and then click on interfaces.

Step 3 – Next choose the appropriate interface and click on start.

Step 4 – Continue sniffing for around 10 minutes.

Step 5 – After 10minutes stop the packet sniffing by going to the capture menu and clicking on Stop.

Step 6 – Next set the filter to http.cookie contains “datr” at top left, This filter will search for all the http cookies with the name datr, And datr as we know is the name of the facebook authentication cookie.

Step 7 –  Next right click on it and goto Copy – Bytes – Printable Text only.

Step 8 – Next you’ll want to open up firefox. You’ll need both Greasemonkey and thecookieinjector script. Now open up Facebook.com and make sure that you are not logged in.

Step 9- Press Alt C to bring up the cookie injector, Simply paste in the cookie value into it.

Step 10 – Now refresh your page and viola you are logged in to the victims facebook account.

Note: This Attack will only work if victim is on a http:// connection and even on https:// if end to end encryption is not enabled.

VIDEO TUTORIAL

Countermeasures

The best way to protect yourself against a session hijacking attack is to use https:// connection each and every time you login to your Facebook, Gmail, Hotmail or any other email account. As your cookies would be encrypted so even if an attacker manages to capture your session cookies he won’t be able to do any thing with your cookies.