Links: Wifite: github.com/derv82/wifite2 Alfa AWUS036NHA: amzn.to/3qbQGKN Alfa AWUSO36NH: amzn.to/3moeQiI ================ Connect with me: ================ Discord: discord.davidbombal.com Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal RU-vid: ru-vid.com ================ Support me: ================ Join thisisIT: bit.ly/thisisitccna Or, buy my CCNA course and support me: DavidBombal.com: CCNA ($10): bit.ly/yt999ccna Udemy CCNA Course: bit.ly/ccnafor10dollars GNS3 CCNA Course: CCNA ($10): bit.ly/gns3ccna10 ====================== Special Offers: ====================== Cisco Press: Up to 50% discount Save every day on Cisco Press learning products! Use discount code BOMBAL during checkout to save 35% on print books (plus free shipping in the U.S.), 45% on eBooks, and 50% on video courses and simulator software. Offer expires December 31, 2020. Shop now. Link: bit.ly/ciscopress50 ITPro.TV: itpro.tv/davidbombal 30% discount off all plans Code: DAVIDBOMBAL Boson software: 15% discount Link: bit.ly/boson15 Code: DBAF15P Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
i have a natively installed version of Kali on my HP. fresh install, NOT through vmware. Do you think the Alfa adapter will still work? Or is my best bet is to install VMWARE PLAYER 16 on my windows 10 and do it that way?
I used your other video ALFA adapter fix, followed the commands, installed the wireless driver commands, my Dell laptop wouldn't support monitor mode. Now it does without the ALFA adapter, thanks for all the content you put out, Davis!
@@paladin11C40 is it used for to be connected to the internet? or for another purposes? if it is used to be connected to the internet then why this youtuber guy has also big white wifi adapter?
@@yaqubnaqiyev131 Yes its used to connect to the internet, I dont know why he has a white one. The purpose is to be able to use both manage and monitor modes, which a NIC that comes with a laptop cant do. Mine dont look like either of the ones he shows.
tip: usually people use their phone numbers as wifi passwords, it's really easy to create a wordlist with phone numbers starting on your region code, which narrows the options to about 10 million which will take 2 minutes to brute force in hashcat if you have a decent GPU. don't use aircrack-ng since it is a primitive tool that only uses your cpu and that is much slower.
@@joetreadonme bruh, so much people using their phone numbers as a wifi password, I don't know what country you live in, but in my country it's a little common
@@mrdakik8357 It's many times more common to just use the password printed on the bottom of the router. 99% of people don't know how to do anything different than that. I'm sure you know many people that do use a phone number as their wifi password, but that's your only real reference and it's not a realistic way to approach life.
@@itstheweirdguy its very realistic, and maybe "people don't know how to do anything different than that" but when you buy your internet service provider and even after you buy, you can call them so they will change the wifi password for you..... its not that hard, and in my case and others also said here, a lot of people use their phone number as their wifi password
It could work with, but again you need a hm treadripper and tons of ram and super gpu, , and if you get a pass, the owner can change it again, and again, and you do don't have wps pin , so you can't log in into network super easy
It's been such a treat watching your videos, David. Thank you for sharing with us. My router is not gonna know what hit it :)) Alles van die beste en baie dankie.
Just some info for some people who are just getting into Pen testing. With most routers coming with random and complicated passwords now, most dictionary attacks won't work. They might work against people who insist on using short easy passwords, but that is fewer and fewer people everyday. Awesome video though David!
Most Netgear routers given by Spectrum, for example, have passwords which are simply a noun, adjective and three numbers. Dictionary and bruteforce are increasingly outdated but it seems with certain patterns can be used. I've seen tools just for these, combining nouns and adjectives and then trying random numbers.
I'm currently taking an Ethical Hacking Course. I find your videos to be very interesting and informative. Looking forward to viewing more of your videos.
Its difficult to attack wpa2-psk security. You may probably have inserted the password on your wordlist thats why. Even the rock you wordlist isn't enough.
@Stimpy&Ren yeah sure right since it is offensive to show that in public Mostly if we research any keywords showed in the video and any tools, we can surely get it done but needs patience, and interest in particular field
Absolutely. So long as your password is random, chosen from all letters and symbols, and, at least 10 characters then your good, Also learn how to identify an evil twin fluxion attack.
Cracked WEP in 2010 using just Ubuntu with reaver. I did it again in 2015 cracking WPA2 with the alfa cards,kali Linux in VM with airmon-ng commands. Took about 10 hrs to crack the pin on the modem to get the passwords. Soon as you get that pin, you can get the password instantly no matter how many times it's changed. You need the AP to have a strong signal as well
@@chebalid7524 that doesn't work, when you deauth a client from their own wifi network, it doesnt means it will remove the password from their device as well, it only disconnects them by sending deauth packets to the client's network, but when u stop the deauth attack, their device will automatically connect to the wifi network.
Just trying to keep up and having a lot of issues with a network adapter (TL-WN7200ND) but all in all great video. All the best for Mr. Bombal and everyone here.
Dear David, Thank you. Once again, you reminded me that 'Security' is liken an Onion with multiple layers. One of the most important layer is Layer 8 - the human. And you are doing just that - educate them! Teaching the importance of using non-dictionary strong password as a starting layer of security. Thanks again.
@Evan Hodge hmmm... interesting point of view... but are you referring to education or security or both or something else? I still rmb how we used to leave our house unlock when away from morning till the evening... good & dependable neighbours. Without schooling I won't be able to type these; those were some pretty happy days. Nontheless I would still choose Life-long-learning. Anyway pls enjoy your life your ways & be safe & joyful. Best wishes.
@@davidbombal Everything works like in the video ,only is not find a hanshake file, and also not start use my wordlist file and not start crack it, is stuck on Listening , please help
WTF you used your .txt file with password in it to crack your password hahahah?! This "attack" is the equivalent of you giving me a key to "break" into your house...
"secure123" is not much of a secure password. Of course you can tap into a wifi with a dictionary. Using a secure password and a router that limits failed connection attempts...someone will get to see their unborn children get married before seeing the password. Good for practice though, but a bit overrated.
The greatest tutorial on RU-vid. Very informative. Immediately sub 👍🏻👍🏻 If using password list to crack the password might be diificut, because different countries using different languages or words combination.
dear david , its also possible for people to use wifislax, it got bunch of wifi tools for cracking and bruteforcing ,and boot it directly from USB in live mode , with the ability to save modification ( with permenant )
Thank you 🙏 I’ve been trying to get better at hacking as I was doing simple things and now Ik ddosing,ip pulling and wifi general things, and this was explained in like a way a year 2 kid would understand. THANKS 🙏
Hello David, thank you for this tutorial, I have followed 100% and it worked for me, I was able to penetrate and test my Router and it cracked the p/w very quickly, even though my password was not so easy.
@@davidbombal I think I might have jumped to conclusions because I thought that Udemy course was copying you not including you sorry but still you didn't have to use your same video from RU-vid that's why I thought someone copied you
There's still many Wi-Fi networks that use weak passwords that can be found in default wordlists. Wifite still can be used just use better options than him.
Thank you so much David! This is the most clear, concise demonstration I’ve seen on RU-vid! I’ll try this out once I purchase the WiFi adapters you recommended. 🙌🏽🙏🏽
Nice one. Really miss having the free access to Shodan. Their cheapest option for casual users, run $69 per month. Had hours of fun, all over the world, finding default passwords in use. There were many that had admin password. Went into a Russian Power sub station once. I can't read Russian , so it was not at all easy to navigate the router. I didn't do anything other than just looking at their router. Before the Ukraine conflict. Pretty sure that now that router should have a better login.
So I feel that 1. This is a WPA brute force attack which if the password is there it could still take years depending on how long the password is. 2. I was more interested in the WPS method using bully and/or pixie which is a more viable method imo. Especially if you know which commands to run to bypass the security checks or lock outs. On top of that you did leave WPS on. 4. You don’t mention injection capable cards thus people might go out and buy one of those two cards thinking they will have access to every tool. 5. I got click baited into a generic brute force when evil twin attacks are much more faster and successful
Hey sir.. Can you tell more about wps method.. Few passwords got cracked when I used wps pixie dust attack with wifite.. But I dont know it not always works.. I have so many wps networks around.. But it shows fail or timeouts in wifite.. I even used bully.. But it also shows timeouts and the tool keep on trying 1 pin again and again
@@codewithraiju1424 WPS is a pin so it works better with older routers since they dont have a timeout limit or a way to bypass it. I've noticed that some routers will say that WPS is enabled but they actually arnt. Try using Reaver with the verbose function or the fool proof method is still using an evil twin and flooding the original router to 1. shut it down or 2. have a stronger antenna to redirect traffic to your evil twin.
@@kohut124 thanks for your reply sir. Yeah I have also noticed that scanners show false positives in case of wps.. Sir can you recommend me some good adapter for evil twin, I have a currently 2 adapters, a cheap one and a tp link archer 600 and both are not capable of evil twin. When I search alfa adapters on amazon, it shows many and I get confused which one should be good
Thank you for the video, as usual, if you are lucky the password is included in the dictionary otherwise it takes more than what you expect to crack it.
-Great content. -So after the CCNA I will take the certification of Linux System Administrator Linux or CompTIA or LPIC which is the operational that I use professionally since the 90s so it's time to be certified professional on it. -So Kali is a Linux distro made by their org so that the student can prepare for their network security certification to OSCP, so it comes with the tools they will charge in the test which is the most insane test of certification that I know, where the student stays at home remotely defending a server attacked by them for 24 hours (look for the exam videos is very crazy). -Good advantage of Kali is that it comes with several tools already pre-installed, and it is what you have to use (because they are the tools that will be charged in their certification), but there are several that are not there. -Now is Kali the best Linux distro that security professionals use? -Can be used as the main OS of the machine in use ...? -Not in my opinion. -Because at the same time that she comes with the tools she has all the weaknesses known to anyone who really studies, he is not. -In summary, using kali gives you several tools but also gives you all the known weaknesses, so using it as the primary OS is a bit risky. -The people I knew years ago (before fashion and the free advertisement that the Mr. Robot series) from the security area used as unknown distro as possible installed the tools and compiled the kernel in the most "non-standard" way possible, usually used Arch Linux. -Well, but each person uses what they think is best, it's a matter of personal taste, but in the area of safety, the professional has to take extra care. -So to hack either in wifi or in ethernet USB interfaces like these can be programs at the simplest level as this script does, but it is possible to use even simpler hardware and program simpler attack tools using for example Arduino and a shield ethernet or esp8266 module with wifi, and C programs are even more attractive. -Alias my ex college professor suggested this end of course project for network analysts. -A security breach tool using esp8266. -Good thanks for the knowledge Professor David ... !!!
Only use WPA2. Disable WPS and UPNP and use a strong wifi password Don’t buy consumer grade routers. Buy a Peplink. Bare minimum but that should reduce your attack surface greatly.
I understand you said you created your own word list. And Kali comes with a default word list. With each update does that word list on Kali get updated and expanded?
No, rockyou.txt was a wordlist derived from a massive hack on a company called rockyou in 2009. It stored all its passwords in plaintext, unencrypted and unsalted. That made it easy to dump out the database for use. If you look deep into it there are many duplicates etc. You can find better, more targeted wordlists floating around on github and other websites with a bit of searching.
It's an informative video, but what I would have loved hearing more clearly is in terms of ethical hacking, this is something you want to do to make sure a script kid can't break into your wi-fi or to alert people their wifi is insecure. That's the main purpose of this tool, or should be. A bit of warning: breaking a system you are supposed to stay away from is borderline. You can intrude, but even if you break through, you should stay this way of the doorstep. As a lawyer who also assist ethical hackers, you should be extra careful. I have horror stories of people meaning good threatened or even hit with with criminal charges for "exposing" thw weakness of systems. They all get away fine, but pain could be high in the process. So: do this as an intrusion test? OK Do this as a service to local community: ok-ish with caveats Do this to have a free ride on your neighbor's bandwidth: no-no (a felony in many jurisdictions).
Agreed. If he'd done a side-by-side with that predictable password versus something more robust we could at the very least have inferred what goes into a good password for the wifi network. Then with that information in hand, suggest viewers test their own network at home and see if they need to update their password - followed by a link to an article on his website talking about good vs bad passwords.
So are you telling that I can hack any company I want but not accessing/exposing their files, because I can tell, that's risk as f*ck. Once you hack someone they have the possibility to hack you back. You're going to make permanent enemies for life with a bunch of hackers who are paid a minimum of 200k/per year to a maximum of 5.000.000 dollars. These guys will buy illegal tools in black market, even from army, CIA, Israeli forces, all sorts of exploit day-0. And you will end up with your life ruined for eternity
lol you're a lawyer and saying it's "ok-ish" to start testing people's wifi networks without consent as a 'service to the local community'? lmaooo literally the worst lawyer on the planet.
@@x_____________ this is your professional opinion, right? You advise companies and white-hat organizations, have experience of defending them in court and drafting intrusion detection as a service agreements I assume? So, trash-talking a lawyer's expertise is conversely okay-ish for you?
Great videos Thanks David. I do have one question here. IS your Tplink router connected to your Internet or buy just generating the wifi signal is enough to crack the code?
Why did it take me two different tools and various commands to do the same thing? It took me 2 commands to start a remote session. If you pwn my wifi, I'll literally join your channel.
I do not understand why it did the WPS attacks (pixie-dust, null pin, and pin attack) even though you used the --WPA argument. it should have jumped straight to the handshake capture and cracking by dictionary.
around 6:27 WPA: --wpa Show only WPA-encrypted networks (includes WPS) The --wpa, --wps, --wep options are only for network discovery, not which attacks to use and not to use
I feel like the reason why it worked is that the router had a generic password. I wonder if it would work with a more personal password. Like instead of "Secure123" you would have something like "DavidHakedThis420"? Would the password list still be effective? What are the chances of that password been in the lists..., or any list for that matter? Thank you for such great content. I been learning a lot!
Great Video was following everything till 7:52, when you switched to another page and started explaining on how you logged into the network you attacked. I am a bit lost because I know whats going on till 7:52 but no idea about the rest you did
He connects to the network to simulate the handshake since there are no other devices connected to his test access point. You need the handshake so you can bruteforce the passwords.
@@lopetta4077 lmao you dont need to setup handshake. To make a handshake basically you need device connected to that network. That is why in the vid, he used another device and connect to that network so that handshake will work if there is no conmected device then handshake will not work.
I'm using kali on usb live boot and I'm using my laptop's internal wifi card which supports monitor mode but when i run wifite it stucks at searching for devices and couldn't find any wifi network. please HELP
Hi David. First of all thanks for this material, i found it very interesting and Im new in the way to become Cyber security, i got one question, how can i connect from my home into my parents network, or to hack just need to be on local network? of course this is for learning purposes, I know that there is a way but i like say I'm new and learning if there is another video that can help that would be great, Thank you and keep the good job, learning pretty cool stuff, Regards
Confused. So you can own any wifi with a single command as long as the password exists in a wordlist? So as soon as someone adds a ! or a % to their password it makes this method effectively useless right?
