Checking Wi-Fi Network Security in Ubuntu: Audit Methods

sudo airmon-ng check kill
sudo airmon-ng start wlan0

After activating the mode, check the interface status with the command iwconfig. The Mode line must contain the following: MonitorIf you see Managed, then switching failed, and driver compatibility should be checked. Some adapters require manual loading of kernel modules or the use of a utility. iw instead of airmon-ng.

There's a common misconception that monitor mode allows you to see the contents of HTTPS traffic. This isn't true: it allows you to see frame headers, MAC addresses, and, in vulnerable configurations, password hashes during the handshake. Traffic encryption inside the tunnel remains inaccessible without decryption keys obtained by other methods.

• 🔍 Use the command iw list to check the modes supported by the interface.
• ⚙️ If you have problems with drivers, try uninstalling and reinstalling the kernel module.
• 🛑 Don't forget to turn off monitor mode after working with the command airmon-ng stop.

The stability of operation in monitor mode depends heavily on signal quality and the level of noise in the air. If you are located far from the router or in an area with a large number of neighboring networks, packet capture efficiency may decrease. In such cases, it is recommended to use a high-gain antenna to improve signal quality.

Analysis of the etheric space and target search

The next step is to scan the surrounding area to identify available wireless networks. The utility airodump-ng Allows you to view a list of access points, their channels, signal strength, and encryption type in real time. Launching is performed on a previously created monitor interface, for example, sudo airodump-ng wlan0mon.

A list of networks will appear on the screen, with columns for BSSID (router MAC address), PWR (signal strength), Beacons (number of beacon frames), and Data (number of captured data packets). We are interested in networks with the encryption type WPA2 or WPA3, since they are the de facto standard. Old protocols WEP They are considered completely insecure and can be hacked in seconds, so their presence in a modern network is a critical vulnerability.

To study a specific network in detail, use filters. By adding arguments --bssid And --channel, you'll lock the scan to a single frequency, which will improve data collection efficiency. It's also useful to specify a file to save the results to for later analysis of the logs or for brute-force analysis.

sudo airodump-ng --bssid 00:11:22:33:44:55 --channel 5 -w audit_log wlan0mon

While observing, pay attention to the column #DataIf the value isn't increasing, there's no active data exchange on the network. Generating traffic (necessary to capture the handshake) may require additional steps, which will be discussed below. Without an active client or background network processes, data collection may take an indefinite amount of time.

It's important to note that modern routers can use SSID hiding or dynamic channel changing. In such cases, target detection becomes more difficult, but not impossible. Analysis of control frames can even reveal hidden networks, as client devices are still forced to send connection requests.

Handshake capture and deauthentication

To verify the strength of a password, it's necessary to obtain the hash that's transmitted when the client connects to the network. This process is called a "handshake." If no one is currently connecting to the network, the handshake won't occur naturally. This is where the deauthentication mechanism comes in.

Utility aireplay-ng Allows sending special frames on behalf of the router to the client, forcing it to reconnect. This doesn't permanently break the connection, but only causes a brief interruption, after which the device will automatically attempt to reconnect, transmitting the required hash. This is a standard method for testing resilience to DoS attacks.

The attack command looks like this: sudo aireplay-ng --deauth 10 -a [router_BSSID] wlan0mon. Argument --deauth 10 means sending 10 deauthentication packets. After that, in the window airodump-ng The message "WPA Handshake: [MAC address]" should appear in the upper right corner, indicating success.

Be careful with the frequency and number of packets sent. Overly aggressive packet sending can cause the client device to lock the access point or enter airplane mode. Furthermore, in corporate networks, such actions are immediately detected by intrusion detection systems (IDS).

• 🎯 Use the exact client BSSID for targeted deauthentication to avoid disturbing the entire network.
• ⏱ Pause between bursts of packets to give the network time to recover.
• 📂 Make sure the save file (.cap) is not full and is writing data correctly.

If a handshake fails to be captured on the first attempt, the client may be using fast reconnection or the router may be ignoring deauthentication packets (some models have flood attack protection). In this case, you'll have to wait for natural user activity or use more complex communication methods.

Dictionary attack and password recovery

After successfully capturing the handshake, the cryptanalysis phase begins. The utility aircrack-ng Takes the received file with the hash and attempts to crack the password by comparing hashes generated from dictionary words with the captured sample. This is a classic brute-force attack, the effectiveness of which depends on the password complexity and the hardware power.

Ubuntu has a dictionary available by default. rockyou.txt (often requires unpacking: gzip -d /usr/share/wordlists/rockyou.txt.gz). It contains millions of the most frequently used passwords. The check is launched with the command: aircrack-ng -w /path/to/dictionary.txt audit_log-01.cap.

aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 00:11:22:33:44:55 audit_log-01.cap

The speed of the search depends on the processor performance. Using the GPU (video cards) through utilities like hashcat can speed up the process hundreds of times, allowing for checking billions of combinations per second. However, for basic auditing, the CPU version is sufficient, especially if the password doesn't have high entropy.

If the password is successfully cracked, you'll see the message "KEY FOUND!" This means the network security has been breached. If the attack fails, it indicates the password is too complex and isn't in the dictionary being used. In this case, a brute-force attack (trying all possible combinations) could take years.

⚠️ Note: The time required to crack a password directly depends on the password length and the alphabet used. An 8-character password (numbers and letters) can be cracked in a few hours, while 12+ characters with special characters are virtually impervious to dictionary attacks.

Methods of protection and attack prevention

Understanding hacking mechanisms allows us to formulate effective security measures. The first and most important step is to avoid using simple passwords and dictionary words. Password length must be at least 12-15 characters, including uppercase and lowercase letters, numbers and special characters.

The second level of protection is the use of a protocol WPA3, which replaced WPA2. It uses the SAE (Simultaneous Authentication of Equals) mechanism, which makes it impossible to intercept a handshake for subsequent offline brute-force attacks. Even if an attacker intercepts packets, they won't be able to use them for a dictionary attack.

• 🔐 Enable MAC address filtering as an additional (but not primary) security measure.
• 📡 Disable the WPS function, as it has critical vulnerabilities in the implementation of the PIN code.
• 🔄 Regularly update your router firmware to fix security holes.
• 👁 Use intrusion detection systems (IDS) to monitor for abnormal activity.

It's also recommended to segment your network. The guest network should be isolated from the main local network where your computers and NAS storage devices are located. This will limit potential damage if one of the guest devices is compromised.

Don't rely on hiding the SSID as a security method. It doesn't encrypt traffic or prevent connections, but merely creates the illusion of security. An experienced administrator can find a hidden network in seconds, but for legitimate users, it will create unnecessary inconvenience when connecting new devices.

Frequently Asked Questions (FAQ)

In conclusion, it's worth emphasizing that the knowledge gained from studying audit tools should be used solely to strengthen the security of your own systems. The world of cybersecurity is constantly changing, and what was relevant yesterday may already be fixed by vendors today. Stay tuned for updates and remain vigilant.