Backtrack is dead – long live Kali Linux ! 2016

This blog was posted on the Offensive Security site as a Press Release. Offensive Security decided to not release yet another version of Backtrack, but to rebuild from scratch. So now we’ll use Kali Linux instead.

Here’s the link: https://www.kali.org/offensive-security-introduces-kali-linux/

---

Black Hat Europe, Amsterdam – March 13 – Offensive Security today announced the availability of Kali Linux, the evolution of its popular BackTrack Linux, a free security auditing operating system and toolkit. Showcased at Black Hat Europe in Amsterdam, Kali Linux incorporates more than 300 penetration testing and security auditing programs with a Linux operating system, delivering an all-in-one solution that enables IT administrators and security professionals to test the effectiveness of risk mitigation strategies.

“For IT professionals, an experiment is worth a thousand theories. Applied to security, it means that simulating attacks to assess the defenses protecting your organization is the only sure way to understand their effectiveness and the impact of an attack,” said Mati Aharoni, Lead Trainer and Developer, Offensive Security. “That’s why we created Kali Linux; we’ve developed the most advanced penetration testing and security auditing toolkit available to help IT administrators and security professionals put themselves in the shoes of potential attackers.”

The new Kali Linux offers a smoother, easier penetration testing experience, making it more accessible to IT generalists as well as security specialists. The new infrastructure incorporates Debian development standards to provide a more familiar environment for IT administrators. The result is a more robust solution that can be updated more easily. Users can also customize the operating system to tailor it to their needs and preferences.

All the programs packaged with the operating system were evaluated for suitability and effectiveness before being included. They include Metasploit for network penetration testing, Nmap for port and vulnerability scanning, Wireshark for monitoring network traffic, and Aircrack-ng for testing the security of wireless networks.

“When it comes to security, the best defense is offense; you need to test the effectiveness of your own security practices before a real intruder does it for you,” said HD Moore, Chief Architect for Metasploit at Rapid7. “We built Metasploit to level the playing field for defenders; arming them with the same tools the attackers have. Offensive Security takes this even further, bringing hundreds of such tools together in Kali Linux to streamline security auditing.”
Additionally, Kali Linux can now run on a wide variety of hardware and is compatible with numerous wireless and USB devices. It also introduced support for ARM devices – typically miniature, battery-powered computers – which are becoming more prevalent and inexpensive. More information on which devices are supported, as well as other documentation, is available on the Kali Linux documentation site.

PRICING AND AVAILABILITY

Like its predecessor, Kali Linux is completely free and always will be. Offensive Security is committed to supporting the open source community with the ongoing development of Kali Linux. The development tree and all sources are available for those who wish to tweak and rebuild packages. Kali Linux is available immediately for download fromhttp://www.kali.org/downloads/.

ABOUT OFFENSIVE SECURITY

Founded in 2007, Offensive Security was born out of the belief that the only way to achieve sound defensive security is through an offensive approach. The team is made up of security professionals with extensive experience of attacking systems to see how they respond. They share this information through trainings, free tools and publications. With the motto “Try Harder,” the Company’s trainings and certifications are well-respected and considered amongst the most rigorous available, creating a model adopted across the industry. In addition, theExploit Database, Metasploit Unleashed and BackTrack Linux community projects are highly-regarded and used by security teams in governmental and commercial organizations across the world. For more information about Offensive Security, please visit www.offensive-security.com.

How do I hack WPA2 Wi-Fi password using Backtrack 2016 ?

Backtrack is now Kali Linux download it when you get some free time.

Pre-Requisites:

1. Kali / back track Linux which will by default have all the tools required to dow what you want.
2. A Virtual Machine or a Laptop you can use to boot the BT or Kali
3. A compatible network card, The network card should support packet injection if you want to do it fast else you will have to wait some time for someone disconnect and connect back to the access point.

Important Phrases To Know:


MAC Address(Media Access Control Address) is a unique  identifier assigned to network interfaces for communications on the  physical network segment.

WAP(Wireless Access Point) is a device that allows wireless devices to connect to a wired network using Wi-Fi

BSSID(Basic Service Set Identification) is the MAC address of the WAP

ESSID(Extended Service Set Identification) is the display name of the wireless network

WPA/WPA2(Wi-Fi Protected Access / Wi-Fi Protected Access  II) are two security protocols and security certification programs  developed by the Wi-Fi Alliance to secure wireless computer networks.

PSK(Pre-Shared Key) is the term for the password defined in WPA/WPA2 encrypted networks.


STEP 1: Changing Your MAC Address :

1. In Kali/BT open the terminal.
2. command : ifconfig
3. This should list all network adapters on your system including your wireless one which should be named something like: Wlanx { wlan0, wlan1 ....}
4. Turn off your network card using the command : ifconfig wlan0 down
   Note: change wlan0 to what ever it said in previous command.
5. command : macchanger -m 00:11:22:33:44:55
   This will change your MAC address of your device temporarily
6. Turn the device back on : ifconfig wlan0 up

STEP 2: Create a virtual monitoring inteterface.
In order to listen to the signals that wlan0 is handling we will create a virtual interface that will help us to monitor and handle what wlan0 is sending and receiving.

1. Command : airmon-ng start wlan0
2. This will create a new monitor interface called mon0

STEP 3 : Start the attack by monitoring the wireless traffic 

1. Command : airodump-ng mon0
   this will list down all active AP and their BSSID and other details. Also below the list you will see the list f computer stations connected to any of these APs.
2. Note down the BSSID and channel it is using (CH in the output) of the AP you want to hit
3. Hit Ctrl+c to end the monitoring.

STEP 4: Lock onto the needed AP. 
This will target the communication from just the accespoint you want and start writing don't collected information into a file you need to hack.

What we are hoping to capture is the 4way handshake data that the systems use to authenticate, this data can then be used to crack the password used.

1. Command : airodump-ng --bssid <bssid of AP> -c 4 -w dumpfilename mon0
   The underlined parts need to be changed as per the data you have. dumpfilename can be replaced with anyhting.
2. This will start monitoring the Accesspoint and showing you the stations connected to it too. You need to write down the BSSID of any one of the stations so that you can trick it to disconnect and reconnect.

STEP 5 :  Capturing Authentication Packets
Note: This will only work if your network card is packet injection compatible else you will have to wait till the the person disconnect and reconnects himself.

1. Open new terminal and give command :
   aireplay-ng -0 30 -a <BSSID of Station Connected> mon0
   This will send 30 disconnect requests to the computer causing it to try and reconnect to the accesspoint.
2. If it shows some error or does not seem to work it is probably the issue with the network card and you will need to wait till the user reconnects by himself.
3. Once the reconnection happens you can see it in the Airmon terminal which is monitoring the packets. A alert should be shown ton the top right corner.
   Hit ctrl+c and exit it. Time to crack the password.

STEP 6: Cracking the password

1. You need a password list file which can be downloaded from the internet. Just search for "wordlist" or  "password list" you can get files with millions of words and some as big as 1GB to 10Gb. More the words in it the better.
2. Get and extract the word list file to your home folder.
3. Run the command :
   aircrack-ng -w wordlist.lst -b <AP BSSID>  dumpfilename*.cap
4. Replace the underlined with the the right details.

STEP 7: Wait

1. Wait some time as your computer does the dirty work of cracking the password. You should have the password on your screen soon.

Happy exploits.