Remote Targeting Techniques - Part Two
40 Questions
1 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What types of networks should be reviewed when analyzing data during Phase III of Remote Targeting?

  • WPA-Enterprise, Open networks, Captured packers, and Probing clients
  • WEP, Captured packets, Rogue access points, and Associated clients
  • WEP, WPA2-Personal, WPA-Enterprise, and hidden networks
  • WEP, WPA-PSK, WPA-Enterprise, and captured packets (correct)

    • Which file formats can Kismet and airodump log data into for further analysis?

  • CSV and JSON files
  • PCAP and XML files (correct)
  • HTML and MKV files
  • TXT and PDF files

    • What information can be derived from the probing clients feature during wireless reconnaissance?

  • Determination of the total number of packets sent
  • Identification of network equipment manufacturers
  • Detection of all cloaked networks in the vicinity
  • Indication of potential client device ownership (correct)

    • What does the OUI of a MAC address signify in wireless reconnaissance?

    <p>A unique identifier assigned to network device manufacturers (D)</p> Signup and view all the answers

    What action can be taken to potentially identify cloaked networks during analysis?

    <p>Spoof a disassociation message to force association (A)</p> Signup and view all the answers

    What is a key consideration when selecting a location for stealth physical reconnaissance?

    <p>It should be in a public or common area. (D)</p> Signup and view all the answers

    Which of the following methods can be used for wireless recon targeting vulnerabilities?

    <p>Cracking WEP encryption. (A)</p> Signup and view all the answers

    What technique can be employed to maintain anonymity in an active wireless attack?

    <p>Changing the MAC address of the radio device. (C)</p> Signup and view all the answers

    During wardriving, what should a person be aware of regarding their surroundings?

    <p>Any observable actions may arouse suspicion. (C)</p> Signup and view all the answers

    What is the purpose of using devices like phones or tablets in a stealth physical recon?

    <p>To remotely connect for reconnaissance purposes. (B)</p> Signup and view all the answers

    What is the correct method to change a MAC address using a Linux terminal?

    <p>Use the command <code>root@kali:~# ifconfig wlan0 down hw either 22;44:66:11:22:23</code>. (B)</p> Signup and view all the answers

    Which strategy can be implemented to interfere with forensic investigations in wireless activities?

    <p>Setting the MAC address to be one digit different from a valid client MAC. (A)</p> Signup and view all the answers

    What is the purpose of the aireplay-ng command exemplified in the message spoofing?

    <p>To disassociate client devices without detection (D)</p> Signup and view all the answers

    Why is it essential to enumerate client info after wireless recon?

    <p>To identify the organization's client devices for targeted attacks (A)</p> Signup and view all the answers

    Which protocol is NOT mentioned as potentially revealing client device information?

    <p>FTP (D)</p> Signup and view all the answers

    What foundational strategy should one adhere to during stealth physical reconnaissance?

    <p>Maintain a low profile and act congruently with your narrative (A)</p> Signup and view all the answers

    In which situation would it be necessary to perform client enumeration?

    <p>When the identity of the network is ambiguous or unverified (C)</p> Signup and view all the answers

    What critical information might a DHCP request reveal?

    <p>Device hostname (C)</p> Signup and view all the answers

    Which element is emphasized as part of effective stealth during physical recon?

    <p>Acting congruently with a preplanned story (A)</p> Signup and view all the answers

    What is the primary advantage of capturing packets during wireless recon?

    <p>To obtain data indicative of device ownership and types (A)</p> Signup and view all the answers

    The OUI of a MAC address consists of the first six decimal digits.

    <p>False (B)</p> Signup and view all the answers

    Both Kismet and airodump are capable of logging data to PCAP files for analysis.

    <p>True (A)</p> Signup and view all the answers

    Any client device will always probe for other configured networks while connected to a single network.

    <p>False (B)</p> Signup and view all the answers

    Spoofing a disassociation message can aid in identifying cloaked networks during wireless reconnaissance.

    <p>True (A)</p> Signup and view all the answers

    A captured packet log will often contain the total number of packets sent from each device.

    <p>True (A)</p> Signup and view all the answers

    The aireplay-ng command can be used to send a disassociation message that appears legitimate to the client device.

    <p>True (A)</p> Signup and view all the answers

    The NetBIOS protocol can only reveal the internet protocol address of the client device.

    <p>False (B)</p> Signup and view all the answers

    Performing wireless reconnaissance does not require any physical presence.

    <p>False (B)</p> Signup and view all the answers

    Capturing packets during wireless network recon can assist in identifying the ownership of client devices.

    <p>True (A)</p> Signup and view all the answers

    The DHCP protocol does not provide any device-specific information.

    <p>False (B)</p> Signup and view all the answers

    To maintain anonymity during wireless attacks, it is crucial to adhere to the APT strategy of KISS.

    <p>True (A)</p> Signup and view all the answers

    Social engineering techniques have no relevance in the context of wireless reconnaissance.

    <p>False (B)</p> Signup and view all the answers

    Client device information can also be derived from HTTP requests which may show server names in cleartext.

    <p>True (A)</p> Signup and view all the answers

    Aerial drones are commonly utilized by private individuals for stealth physical reconnaissance.

    <p>False (B)</p> Signup and view all the answers

    Cracking WEP is one of the major vulnerabilities targeted during active wireless attacks.

    <p>True (A)</p> Signup and view all the answers

    Changing your MAC address is a complex process that cannot be done from a Linux terminal.

    <p>False (B)</p> Signup and view all the answers

    Wardriving can only be conducted from a parked vehicle.

    <p>False (B)</p> Signup and view all the answers

    It is recommended to set your MAC address to match exactly one of the valid client MAC addresses during active recon.

    <p>False (B)</p> Signup and view all the answers

    Multiple wireless vendor vulnerabilities are not significant in identifying weaknesses within wireless networks.

    <p>False (B)</p> Signup and view all the answers

    To maintain anonymity during wireless activities, using a MAC address differing by only one digit is an effective strategy.

    <p>True (A)</p> Signup and view all the answers

    Flashcards

    Wireless Network Data Analysis

    Reviewing WEP, WPA-PSK, WPA-Enterprise networks, captured packets, associated clients, and client device information.

    PCAP Files

    Files that contain captured network packets, providing basic information like BSSID, client and associated clients.

    Target Organization Connection

    Using client device probe requests to identify potential connections with the target organization by checking probed SSID and client's MAC OUI.

    OUI of MAC Address

    First six hexadecimal digits of a MAC address that uniquely identifies each manufacturer of network equipment.

    Signup and view all the flashcards

    Spoofing Disassociation

    Forcing a client device to disconnect from a wireless network by sending a fake disassociation message using tools like aireplay-ng.

    Signup and view all the flashcards

    Physical Reconnaissance Locations

    Public areas like coffee shops, libraries, or hotels where people frequently use laptops.

    Signup and view all the flashcards

    Wardriving

    Using a vehicle (like a car) to scan for unprotected Wi-Fi networks.

    Signup and view all the flashcards

    Stealth Physical Reconnaissance

    Gathering information about a target without being noticed.

    Signup and view all the flashcards

    MAC Address Spoofing

    The act of changing your network adapter's unique identifier.

    Signup and view all the flashcards

    Wireless Attack Vulnerability

    Weak points in Wi-Fi security that attackers can exploit.

    Signup and view all the flashcards

    Offline Brute-Forcing

    Trying many passwords repeatedly, but done without being connected to the target network.

    Signup and view all the flashcards

    Wireless Vendor Vulnerabilities

    Weaknesses in specific wireless network hardware and software.

    Signup and view all the flashcards

    Wireless Spoofing

    Sending fake disassociation messages to a wireless network, making it seem like the network is going down and then back up.

    Signup and view all the flashcards

    Client Enumeration

    Finding information about client devices connected to a wireless network.

    Signup and view all the flashcards

    DHCP

    A protocol that assigns IP addresses to devices on a network.

    Signup and view all the flashcards

    NetBIOS

    A protocol that allows networked devices to communicate.

    Signup and view all the flashcards

    HTTP Requests

    Used by web browsers to request information from web servers.

    Signup and view all the flashcards

    DNS Queries

    Requests to translate domain names (like google.com) into IP addresses.

    Signup and view all the flashcards

    Stealth Wireless Recon

    Performing wireless network reconnaissance without being noticed.

    Signup and view all the flashcards

    Maintaining Stealth

    Acting discreetly during physical recon.

    Signup and view all the flashcards

    Why review PCAP files?

    PCAP files contain captured network packets. Analyzing them gives crucial information about BSSID, clients, and associated clients. This can help identify target networks and devices.

    Signup and view all the flashcards

    Client Device Probing

    Client devices often probe for available networks even when connected to one. This information can be used to determine which clients are connected to the target organization.

    Signup and view all the flashcards

    What is the OUI?

    The OUI of a MAC address is the first six hexadecimal digits, which uniquely identifies the manufacturer of network equipment.

    Signup and view all the flashcards

    Why enumerate SSIDs?

    Enumerating SSIDs helps identify cloaked networks that are hidden from normal scans. This can uncover potential target network connections.

    Signup and view all the flashcards

    DHCP in Wireless Recon

    Analyzing DHCP requests to reveal a client device's hostname, potentially indicating its owner or organization.

    Signup and view all the flashcards

    NetBIOS in Wireless Recon

    Examining NetBIOS broadcasts to discover a client device's domain name and hostname, revealing possible organizational affiliations.

    Signup and view all the flashcards

    HTTP Requests in Wireless Recon

    Analyzing HTTP requests to identify web servers a client device communicates with, potentially revealing sensitive information.

    Signup and view all the flashcards

    DNS Queries in Wireless Recon

    Analyzing DNS queries to determine if a client device is contacting antivirus servers or endpoint management systems, revealing security measures.

    Signup and view all the flashcards

    Stealth Physical Recon

    Gathering information about a target discreetly while physically present, like blending in with your surroundings.

    Signup and view all the flashcards

    KISS Principle in Physical Recon

    Keeping your actions simple and straightforward during physical reconnaissance to avoid attracting attention and suspicion.

    Signup and view all the flashcards

    Active Attack

    Attacking a target network to gain access or disrupt its operation.

    Signup and view all the flashcards

    Brute-forcing WPA Preshared Keys

    Trying to guess passwords for a wireless network (WPA-PSK).

    Signup and view all the flashcards

    Active Brute-forcing WiFi Protected Setup (WPS)

    Testing the WPS protocol to find weak PINs and gain access to a protected wireless network.

    Signup and view all the flashcards

    Multiple Wireless Vendor Vulnerabilities

    Weaknesses in the software and hardware of specific wireless vendors.

    Signup and view all the flashcards

    Study Notes

    Phase III: Remote Targeting - Part Two

    • This phase involves reviewing data from reconnaissance for useful information.
    • Wireless networks are categorized by their security protocol:
      • WEP (Wired Equivalent Privacy)
      • WPA-PSK (WPA Pre-Shared Key Mode)
      • WPA-Enterprise (WPA Enterprise Mode)
    • Captured packets and associated clients are also examined.
    • Tools like Kismet and airodump log PCAP files for analysis using Wireshark.
    • PCAP files provide basic information, including:
      • BSSID (Basic Service Set Identifier)
      • Client devices
      • Associated clients
      • Probing clients
      • Channels
    • Tools log additional data, including:
      • Timestamps of client and network activity
      • Packet counts from each device
      • Packets observed
      • Wireless networks probed by a client device
    • This information helps identify potential target organization clients.
    • Probed networks may indicate client ownership.
      • If a probe for a known employee's network is seen, it may suggest the owner.
      • Not all clients probe all networks.
    • SSID (Service Set Identifier) information can be helpful in identifying the target organization.
    • OUI (Organizationally Unique Identifier) of the MAC address's BSSID is recorded.
    • OUI is the first six hexadecimal digits assigned to network equipment manufacturers for identification.
    • Cloaked networks require enumeration efforts.
    • Spoofing disassociation messages forces association process enumeration using aireplay-ng.

    Active Recon II

    • Changing MAC addresses is necessary for active attacks.
    • The command format for MAC address change in a Linux terminal is: ifconfig wlan0 down, followed by ifconfig wlan0 down hw ether <MAC address>, and ending with ifconfig wlan0 up.
    • Example usage for MAC address to 22:44:66:11:22:23:
      • root@kali:~# ifconfig wlan0 down
      • root@kali:~# ifconfig wlan0 down hw ether 22:44:66:11:22:23
      • root@kali:~# ifconfig wlan0 up
    • Use of a different card is recommended if possible.

    Active Wireless Attacks

    • Major vulnerabilities in wireless networks include:
      • WEP cracking
      • Offline brute-forcing of WPA pre-shared keys
      • Active brute-forcing of WiFi Protected Setup
      • Multiple wireless vendor vulnerabilities
    • MAC address changes are important for active attacks.
    • Spoofing a valid client MAC address helps evade detection; use a one-digit offset

    Web Cracking

    • WEP cracking relies on packet capture.
    • Packet counts vary, typically between 2,000-200,000 packets.
    • Passive methods to crack WEP might take 15+ minutes to crack, requiring about 20,000 packets.
    • Airodump is a good tool for initial packet capture.
    • The airmon-ng command is needed to put the network interface into monitor mode.
    • Example command format: root@kali : ~# airmon-ng start wlan.

    WPA Preshared Key Cracking

    • WPA-PSK vulnerabilities are often exploited by brute-forcing offline.
    • Capturing four-way authentication handshakes between client and access point is critical.
    • Default WPA pre-shared keys on residential access points are less secure.
    • airodump-ng is used to monitor network traffic.
    • The command to capture traffic is typically shown as airodump-ng -w <filename> -c <channel> -bssid <BSSID> mon0 for default.
    • If needed, spoofing disassociation messages can be used to force re-association.
    • Create a wordlist using relevant information (company name, phone numbers, etc).
    • hashcat can be utilized for cracking.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Chapter 7 Part 2: Active Wireless Recon

    Description

    Explore the critical aspects of Phase III in Remote Targeting, focusing on the review of reconnaissance data. This phase emphasizes understanding wireless network security protocols, analyzing captured packets, and the use of tools like Kismet and Wireshark for effective network analysis.

    More Like This

    Wireless Network Security
    3 questions

    Wireless Network Security

    LucrativeMagenta avatar
    LucrativeMagenta
    Wireless Security Best Practices
    5 questions

    Wireless Security Best Practices

    PermissibleSeal avatar
    PermissibleSeal
    Wireless Security and Wi-Fi Standards Quiz
    40 questions

    Wireless Security and Wi-Fi Standards Quiz

    SeasonedJoy1900 avatar
    SeasonedJoy1900
    Wireless Security Mechanisms - Lecture 5
    30 questions

    Wireless Security Mechanisms - Lecture 5

    BrighterRadon avatar
    BrighterRadon
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser