Wifi в режим монитора windows

Capturing Wireless on Windows was always problematic, because other than on Linux or Mac it wasn’t possible to activate Monitor mode on the WiFi cards to capture the radio layer. All you could do was capture packets on your WiFi card from the Ethernet layer and up. That’s  unless you spent money on the now discontinued AirPCAP USB adapters. But now there is a silver lining on the horizon in the form of the npcap library.

I have to admit that capturing wireless traffic isn’t my strong suit. Dealing with radio waves is a whole different topic than picking up packets from a cable, so there’s a different set of skills required to troubleshoot WiFi issues. But at least I know that there’s a difference between being able to use “Monitor Mode” and not being able to. Of course I can capture on a WiFi card, e.g. picking up packets like this on my “Wi-Fi 2” card:

As you can see, the capture looks just like a normal Ethernet capture would. There’s nothing related to the radio layer, so troubleshooting the wireless connectivity is not possible this way. To get the radio layer information, you need at least three things (other than Wireshark, of course):

1. A WiFi card that supports monitor mode.
2. The npcap capture libraries (instead of WinPCAP).
3. A tool to enable monitor mode

Requirement 1 – a WiFi card with monitor mode

Unfortunately, not all WiFi cards support monitor mode on Windows. There’s a matrix available that you can use to check if your card is supported: https://secwiki.org/w/Npcap/WiFi_adapters.

I use either Alfa cards or, in this case, a NetGear A6210, which I bought at a local electronics store.

Requirement 2 – the npcap libraries

Since Wireshark 3.0 came out WinPCAP is no longer the default capture library installed. Instead, the npcap libraries are used, which replace the discontinued WinPCAP libraries. If you want to know more about the differences between the two, check this comparison. If you recently installed Wireshark 3.x (or later) you should automatically have replaced WinPCAP with npcap, unless you didn’t allow the installer to do that. Important: you need to make sure “Support raw 802.11 traffic (and monitor mode) for wireless adapters” is checked:

Requirement 3 – A tool to enable monitor mode

If you run Wireshark, you’ll notice that you have a “Monitor Mode” checkbox in the capture interface dialog for your WiFi cards. You can open that dialog from the main menu via “Capture” -> “Options” or by pressing CTRL-K. Unfortunately, even with npcap installed correctly it doesn’t seem to work if you click it (at least in my case), because the check mark disappears again after a short moment.

I’m not sure if that’s normal, but as far as I found out Wireshark can’t modify that setting because it doesn’t have the sufficient privileges to do that. You can either run Wireshark in administrative mode – which I strongly advise against, because it could allow malicious packets to compromise your system. Check out this blog post about “Attacking Wireshark” for details.

The much better plan is to use the wlanhelper utility in an elevated command prompt, which is why I added it specifically to the list of requirements. Fortunately, this comes as part of the npcap installation and is called wlanhelper.exe. You can find it in C:\Windows\System32\Npcap\

Check which mode your WiFi card is in using the “wlanhelper.exe” tool. You should run a command line prompt as administrator and change into the directory “C:\Windows\System32\npcap”. To check the current WiFi card mode, run this command (replace “Wi-Fi 2” with the name of your network card you want to manage):

C:\Windows\System32\Npcap>wlanhelper "Wi-Fi 2" mode
managed

“Managed” is the default mode that your card should usually be in. It means that it is ready to be used for normal WiFi connectivity. To put it into monitor mode you use the following command:

C:\Windows\System32\Npcap>wlanhelper "Wi-Fi 2" mode monitor
Success

But you may also see a result like this:

C:\Windows\System32\Npcap>WlanHelper.exe "Wi-Fi 2" mode monitor
Error: SetWlanOperationMode::SetInterface error, error code = 5 (Access is denied)
Failure

As you can see we got an error back, which is most likely caused by the fact that the command line prompt wasn’t started as administrator – so if you get this, close your command prompt and start it again, as administrator. If you’re not sure how to do that, follow these steps:

1. Press CTRL & ESC to open the start menu
2. type “cmd”, which should find the “Command Prompt” icon
3. Click “Run as Administrator” or (if you want to impress people standing behind you) press CTRL & Shift & Enter to launch the icon in administrative mode.
4. Confirm the User Access Control prompt

Now, we we run Wireshark again, we can “turn on” monitor mode (which we already did; we’re just telling Wireshark to try it to make it realize it works now):

As you can see, the “Link-layer Header” changes from “Ethernet” to “802.11 plus radio tap header”, which tells us that we’re now going to capture radio layer information as well. Now, when we start a capture on a card like that, we’ll see a different story:

We get a ton of management frames, and we also see the typical “Radiotap Header” that tells us about the radio layer. Exactly what we wanted.

Changing channels

One thing that will probably bug you is that Wireshark 3.x doesn’t yet come with a WiFi toolbar, which allows to change channels in a convenient way from the GUI. Unfortunately you’ll have to change channels manually until that problem is solved, and you can do that (again) with the help of the wlanhelper utility, using the according commands:

C:\Windows\System32\Npcap>wlanhelper
WlanHelper for Npcap 0.992 ( http://npcap.org )
Usage: WlanHelper [Commands]
or: WlanHelper {Interface Name or GUID} [Options]

OPTIONS:
mode : Get interface operation mode
mode <managed|monitor|master|..> : Set interface operation mode
modes : Get all operation modes supported by the interface, comma-separated
channel : Get interface channel
channel <1-14> : Set interface channel (only works in monitor mode)
freq : Get interface frequency
freq <VALUE> : Set interface frequency (only works in monitor mode)
modu : Get interface modulation
modu <dsss|fhss|irbaseband|ofdm|hrdsss|erp|ht|vht|ihv (VALUE)|..> : Set interface modulation
modus : Get all modulations supported by the interface, comma-separated

Final Words

Capturing Wireless on Windows got a lot easier now, and with npcap it’s also possible to capture on more recent cards than the old WinPCAP adapters which stopped at the 802.11n technology as far as I know. One thing to keep in mind: capturing in monitor mode means that the card becomes a “receive-only” card. So don’t be surprised when you lose connectivity if you have only one WiFi card in your system. If you need to stay connected to a wireless network while capturing it you need two cards – one in managed mode, one in monitor mode.

Время на прочтение
2 мин

Количество просмотров 40K

Друзья, всех приветствую!

В этой статье я покажу вам как использовать airmon-ng (скрипты из пакета aircrack-ng) для обнаружения беспроводных сетей вокруг нас. Затем мы деаутентифицируем клиентов определенной беспроводной сети, чтобы перехватить handshake, а затем расшифруем его, чтобы найти пароль WiFi.

Сеть, которую я буду атаковать, является моей собственной сетью, я не буду атаковать чужую сеть. Пожалуйста, не используйте эту информацию в неэтических целях. То, чем я здесь делюсь, предназначено только для образовательных целей.

Прежде чем приступить к работе, давайте посмотрим, что нам понадобится:

1. Сетевой адаптер WiFi, поддерживающий режим монитора.

2. Kali Linux или любой другой дистрибутив Linux с установленным пакетом Aircrack-ng.

3. Словарь паролей (список слов wordlist.txt).

Давайте начнем, первым делом мы должны проверить наличие WIFI-адаптера, что он подключен к Kali Linux, чтобы сделать это, пожалуйста, введите команду ниже:

Откройте терминал и введите:

kali@kali:~$ ifconfig

Здесь будут показаны все сетевые интерфейсы, подключенные к вашему устройству:

Если ваш беспроводной сетевой адаптер подключен и распознан в операционной системе, вы должны увидеть «wlan0«, как показано на фото выше. Обратите внимание, что имя может измениться, если у вас несколько подключенных беспроводных адаптеров.

Теперь для включения режима монитора введите следующую команду:

kali@kali:~$ sudo airmon-ng start wlan0

Режим мониторинга включен, теперь мы должны убить все PID, которые мешают работе адаптера, Эти процессы выделены красным цветом в примере выше. Убить процессы можно с помощью команды kill:

kali@kali:~$ kill 508 1420

Итак, теперь давайте обнаружим беспроводные сети вокруг нас. Для этого используем команду sudo airodump-ng wlan0:

kali@kali:~$ airodump-ng wlan0

Для того чтобы остановить процесс поиска и сохранить список обнаруженных сетей нажмите Ctrl + C:

Как вы можете видеть, обнаружена целая куча беспроводных сетей. Итак, вот BSSID или MAC-адреса беспроводных сетей в первом столбце. Меня интересует сеть под названием Kali на канале 1. Обратите внимание на номер канала и MAC-адрес целевой точки доступа. В моем случае:

• Channel: 1

• BSSID: 50:D4:F7:E5:66:F4

Далее мы будем использовать команду sudo airodump-ng -c 1 -w kali --bssid wlan0:

kali@kali:~$ airodump-ng -c 1 -w kali --bssid 50:D4:F7:E5:66:F4 wlan0

Итак, в этом окне мы перехватываем пакеты, пытаясь перехватить handshake, теперь откройте второе окно для деаутентификации клиентов из сети. Это действие ускорит перехват рукопожатия. Для деаутентификации мы будем использовать aireplay-ng:

kali@kali:~$ aireplay-ng -0 0 -a 50:D4:F7:E5:66:F4 wlan0

Пока мы не зафиксировали handshake, но как только я деаутентифицирую клиентов, мы получим рукопожатие WPA, как показано на изображении ниже:

Теперь нам нужно расшифровать handshake. В терминале вводим ls, чтобы перечислить все текущие каталоги и файлы. Выбираем файл с расширением «.cap», который должен называться kali-01.cap, и вводим следующую команду:

kali@kali:~$ aircrack-ng -w wordlist.txt kali-01.cap

Инструмент aircrack-ng сравнивает хэш внутри файла .cap с хэшами паролей, перечисленных в файле wordlist.txt, преобразуя каждую строку из текста в хэш, и если хэши совпадают, мы получаем пароль от WIFI.

Теперь все, что вам нужно сделать, это подождать, пока вы не увидите «KEY Found (ваш ключ здесь 😉)».

Всем спасибо за внимание!

Putting your WiFi card on monitor mode in Windows 10 can be a useful skill to have, especially if you’re interested in network security or troubleshooting WiFi-related issues. Monitor mode allows your WiFi card to capture all wireless network traffic around you, providing valuable insights into the network’s behavior and potential vulnerabilities.

In this blog post, we will explore the reasons why you should learn how to put your WiFi card on monitor mode in Windows 10. We will also provide detailed steps for different methods to achieve this and discuss what to do if you encounter any obstacles along the way. So, let’s dive in and expand our understanding of monitor mode on Windows 10!

Video Tutorial:

Why You Need to Put WiFi Card on Monitor Mode

Putting your WiFi card on monitor mode can offer several advantages. Here are a few reasons why you should consider learning this skill:

1. Network Monitoring and Security: Monitor mode allows you to capture and analyze all wireless network traffic around you. This can be invaluable for network monitoring and security purposes. By examining the packets, you can identify potential security threats, unauthorized access points, or unusual network behavior.

2. Troubleshooting WiFi Issues: If you’re experiencing connectivity or performance issues with your WiFi network, putting your WiFi card on monitor mode can help diagnose the problem. By examining the network traffic, you can identify potential sources of interference, weak signal areas, or misconfigurations that may be causing the problem.

3. Learning and Research: Putting your WiFi card on monitor mode can be a great way to learn about wireless network protocols, packet analysis, and network behavior. It allows you to observe how different devices interact with the network and can help you deepen your understanding of network protocols and security.

Now that we understand why putting your WiFi card on monitor mode can be beneficial, let’s explore different methods to achieve this in Windows 10.

Method 1: Using Native Windows Commands

Putting your WiFi card on monitor mode using native Windows commands is a straightforward method. Follow the steps below:

Step 1: Open Command Prompt as Administrator by right-clicking on the Start menu and selecting «Command Prompt (Admin).«

Step 2: In the Command Prompt window, type the following command and press Enter: «netsh wlan show interfaces«

Step 3: Look for the WiFi interface name under «Name» in the output. Note down the name of the interface.

Step 4: Now, enter the following command to put the WiFi card on monitor mode: «netsh wlan set hostednetwork mode=allow«

Step 5: Finally, start the hosted network by entering the command: «netsh wlan start hostednetwork«

Pros:
1. Native Windows commands, so no need for additional software.
2. Can be done directly from the Command Prompt.
3. Provides quick access to monitor mode functionality.

Cons:
1. Limited configuration options compared to third-party tools.
2. May require administrative privileges to execute the commands.

Method 2: Via Third-Party Software – Wireshark

Wireshark is a popular third-party software used for network analysis and monitoring. It also provides the ability to put your WiFi card on monitor mode. Follow the steps below to achieve this:

Step 1: Download and install Wireshark from the official website (https://www.wireshark.org/).

Step 2: Launch Wireshark and go to the «Capture» menu.

Step 3: In the «Capture» menu, select «Options» to open the «Capture Options» dialog.

Step 4: In the «Capture Options» dialog, select your WiFi interface from the list, and ensure that the «Monitor Mode» checkbox is checked.

Step 5: Click «Start» to start capturing network traffic in monitor mode.

Pros:
1. Wireshark is a powerful network analysis tool with extensive functionality.
2. Provides detailed packet analysis and filtering options.
3. Supports capturing network traffic in monitor mode.

Cons:
1. Requires a separate software installation.
2. May have a steeper learning curve for beginners.

Method 3: Using Acrylic WiFi

Acrylic WiFi is another third-party software that offers advanced WiFi analysis features, including putting your WiFi card on monitor mode. Follow the steps below to use Acrylic WiFi:

Step 1: Download and install Acrylic WiFi from the official website (https://www.acrylicwifi.com/).

Step 2: Launch Acrylic WiFi and click on the «Monitor» button in the toolbar.

Step 3: Select your WiFi interface from the list of available interfaces.

Step 4: Click on the «Turn On» button to enable monitor mode for your WiFi card.

Pros:
1. Acrylic WiFi provides a user-friendly interface for WiFi analysis.
2. Offers additional features like signal strength analysis and network map visualization.
3. Can easily switch between monitor and managed modes.

Cons:
1. Requires a separate software installation.
2. Some advanced features may be available only in the paid version.

Method 4: Using CommView for WiFi

CommView for WiFi is a professional WiFi analysis tool that supports monitor mode. Here’s how to use CommView for WiFi to put your WiFi card on monitor mode:

Step 1: Download and install CommView for WiFi from the official website (https://www.tamos.com/).

Step 2: Launch CommView for WiFi and click on the «Capture» tab.

Step 3: From the main toolbar, click on the «Start» button to start capturing network traffic.

Step 4: Select your WiFi interface from the dropdown menu.

Step 5: Click on the «Options» button to open the «Options» dialog.

Step 6: In the «Options» dialog, go to the «Advanced» tab and check the «Enable monitor mode» checkbox.

Step 7: Click on the «OK» button to save the settings and start capturing network traffic in monitor mode.

Pros:
1. CommView for WiFi is a professional-grade tool for WiFi analysis.
2. Offers advanced features like packet decoding and network statistics.
3. Provides extensive customization options for capturing network traffic.

Cons:
1. Requires a separate software installation.
2. Can be more complex to use compared to other methods.

What to Do If You Can’t Put WiFi Card on Monitor Mode

If you encounter any issues or obstacles while trying to put your WiFi card on monitor mode, here are a few potential fixes:

1. Update WiFi Drivers: Outdated or incompatible WiFi drivers can prevent the monitor mode feature from working correctly. Ensure that you have the latest drivers installed for your WiFi card by visiting the manufacturer’s website.

2. Check Hardware Compatibility: Not all WiFi cards support monitor mode. Verify if your WiFi card is compatible with monitor mode by checking the manufacturer’s specifications or consulting online resources.

3. Disable Antivirus or Firewall: Sometimes, antivirus or firewall software can interfere with monitor mode functionality. Temporarily disable these security programs and try putting your WiFi card on monitor mode again.

Bonus Tips

Here are three bonus tips to further enhance your monitor mode experience:

1. Learn Packet Analysis: To make the most out of monitor mode, develop your packet analysis skills. Familiarize yourself with common network protocols, packet structure, and analysis techniques to extract valuable insights from captured packets.

2. Explore WiFi Security Tools: Monitor mode is often used for WiFi security analysis. Explore other WiFi security tools like Aircrack-ng, Kismet, or Fern WiFi Cracker to expand your toolkit and improve your WiFi security knowledge.

3. Stay Within Legal Bounds: It’s important to use monitor mode responsibly and abide by the law. Ensure that you’re using monitor mode only on networks you have permission to analyze, and respect privacy and security considerations.

5 FAQs

Q1: Can I use monitor mode on any WiFi card?
A: No, not all WiFi cards support monitor mode. Check the specifications of your WiFi card or consult the manufacturer’s website to determine if it is capable of monitor mode.

Q2: Are there any legal restrictions on using monitor mode?
A: The use of monitor mode is subject to local laws and regulations. It is crucial to use monitor mode responsibly and only on networks you have permission to analyze. Make sure to adhere to privacy and security considerations.

Q3: Can I put my internal WiFi card on monitor mode on Windows 10?
A: Yes, it is possible to put an internal WiFi card on monitor mode in Windows 10, provided that the card supports monitor mode. Refer to the manufacturer’s specifications or consult online resources to check if your internal WiFi card is capable of monitor mode.

Q4: Can I use monitor mode to capture network traffic on devices other than my own?
A: No, monitor mode can only capture network traffic within range of your own WiFi card. It cannot be used to capture traffic on devices outside your network or on networks you do not have permission to analyze.

Q5: How can I determine if monitor mode is working correctly?
A: Once you’ve put your WiFi card on monitor mode, you can use network analysis software like Wireshark or Acrylic WiFi to capture and analyze network traffic. If you see captured packets in these applications, it indicates that monitor mode is functioning correctly.

Final Thoughts

Putting your WiFi card on monitor mode in Windows 10 can greatly enhance your network analysis capabilities and help you troubleshoot WiFi issues effectively. Whether you choose to use native Windows commands or third-party software like Wireshark, Acrylic WiFi, or CommView for WiFi, monitor mode enables you to capture and analyze wireless network traffic with ease.

Remember to use monitor mode responsibly, adhere to the law and ethical considerations, and always respect privacy and security concerns. With practice and a deep understanding of packet analysis techniques, monitor mode can become a powerful tool in your network analysis arsenal.