Discover the Art of Digital Defense
Explore Cybersecurity and Ethical Hacking
Join Us Today!
DARK EDGE
PROTECT YOUR DIGITAL FUTURE
What is a Deauth Attack?
Deauthentication attack is a type of denial of service attack that targets communication between a user ( or all users ) and a Wi-Fi access point.
This attack sends disassociate packets to one or more clients which are currently associated with a particular access point. Of course, this attack is useless if there are no associated wireless clients or no fake authentications.
The cool thing about this attack is that even today where all networks are using WPA2 encryption you can still easily deauth almost anything or anyone without even being inside the network!
Step 1 - Fire up Kali Linux and open a Terminal
In Kali, almost all the action happens inside the terminal so you should really get the hang of it.
Now that's a trippy gif.
By typing ifconfig and the enter key on your terminal you get the following output :
.png)
At the eth0 section in my ifconfig output, you see that I have inet 10.0.2.15, this is because I am running Kali Linux on a Virtual Machine and it is connected on a nat network. Don't worry about it, you do not even have to care at the moment.
All you have to care about is the wlan0 section that is your wireless adapter and as you can see mine is not even connected to a network. If it was it would be displaying an IP in the range of 192.168.x.x (Just for answering future questions).
The next command is iwconfig. Type it and execute it on your terminal and boom:
.png)
From this output, we understand that our wireless card is in Managed Mode and we want it to be in Monitor Mode. So let's do that.
Step 2 - Setting wireless adapter on Monitor mode with airmon-ng
By running the airmon-ng start wlan0 (or whatever your adapter is called, it could be wlan1 or wlan2) you are setting your adapter to monitor mode! Check out the output :
.png)
See the above iwconfig result. Mode:Monitor and the name is wlan0mon! You are ready to go.
Step 3 - Searching for victims with airodump-ng
Execute the command airodump-ng wlan0mon on your terminal and start choosing targets.
Command output:
.png)
The combination of BSSID and ESSID can help hackers find locations. 😁 Yeap, that's a thing.
The command will keep running and monitoring near Access Point behavior but as soon as we find our target on the list we can just hit ctrl+c to stop the monitoring process.
You will get a bunch of different access points with a lot of info you don't understand! Let's break them down.
-
BSSID | MAC address of the access point. In the Client section, a BSSID of “(not associated)” means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.
-
PWR | Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn't support signal level reporting.
-
Beacons | Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.
-
# Data | Number of captured data packets (if WEP, unique IV count), including data broadcast packets.
-
#/s | Number of data packets per second measure over the last 10 seconds.
-
CH | Channel number (taken from beacon packets).
Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference. -
MB | Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. Displays “e” following the MB speed value if the network has QoS enabled.
-
ENC | Encryption algorithm in use. OPN = no encryption,“WEP?” = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP is present.
-
CIPHER | The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.
-
AUTH | The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
-
ESSID | Shows the wireless network name. The so-called “SSID”, which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.
I will be targeting my own AP TP-LINK_AP_4CE8! You should understand that doing this to other APs is illegal. Unless you have the permission of course.
Step 4 - Specific Targeting for better information gathering
Now that we know all that we need to know about our target we have to find any devices connected to the network, to do that we run the following command.
The commands structure is airodump-ng -d "target's BSSID" -c "target's channel number" "wireless adapter monitor mode name"
In our case the full command is:
Now we are monitoring SPECIFICALLY our target and not all nearby access points. Also, we can see that there are two devices currently inside the network, one of which is my phone!
Step 5 - Deauthenticating device from network //Kicking
The final command is:
Command instructions:
-
-0 means deauthentication.
-
0 is the number of deauths to send, 0 means send them continuously, you can send 10 if you want the target to disconnect and reconnect.
-
-a 50:C7:BF:DC:4C:E8 is the MAC address of the access point we are targeting.
-
-c E0:B5:2D:EA:18:A7 is the MAC address of the client to deauthenticate; if this is omitted then all clients are deauthenticated.
-
wlan0mon is the interface name.
The command continuous output:
.png)
And its immediate result :
.png)
Preventing the attack and taking necessary precautions
You are now well familiar with the attack and know all the theory a beginner may need! But how could one prepare himself for defending against a deauthentication attack?
You can not stop a bad guy from sending deauth packets. Instead, you should make sure your network is configured in a way that the deauth attack doesn't enable an attacker to compromise your network.
-
Make sure your network is using WPA2 encryption.
-
Your Wi-Fi passphrase should be very long and strong.
-
Once you have been disconnected from your network, make sure that you connect back to a WPA2 secure network and not an open one with the same name as yours! IMPORTANT.
-
You could also HIDE your SSID from anyone by accessing your router's configuration page.
-
Usually on WLAN > Advanced Option
-
-
By a VPN
-
A VPN creates a private tunnel between your laptop or smartphone and the VPN server on the other end, encrypting your traffic from snoops—even your ISP or the operator of the hotspot itself. To find the one that's right for you, read our roundup of the Best VPN Services, pick a top-rated one, pay for it, and put it on all your devices that use public Wi-Fi of any sort. You'll be glad you did.
-
Conclusion
Hacking is not easy, let's start with that. It needs patience and curiosity. You will always have days that everything is just not working how it should be and you may feel like a loser for not making it work! But that's the trick! Someone has made it work and this must drive you! Be that someone! And then be more!
Thank you very much for your time and I really hope that you got something from this article/tutorial! Sudorealm is here to stay and we promise to give you as much as we can!
Support me buying me a coffe :)
UPI
swarnimsingh525@paytm
THANK YOU:-
