Wireless Auditing and Risk Assessment

Wireless Auditing and Risk Assessment

1. WLAN Discovery Tools

   • NetStumbler
     • Captures SSID,signal strength, AP name
     • GPS settings, MAC addresses
     • not work well with modern 64-bit systems
   • InSSIDer
     • commercial Wi-Fi network-scanning
     • Supports Windows and Mac OS
     • Performs scans
   • Kismet
     • runs on Linux
     • Works as a network sniffer and detector
     • determine network IP ranges
     • built-in channel hopping
   • HeatMapper
     • Locates and maps radio frequency
     • presents coverage overlaid
     • showing gaps and overlaps

2. Penetration Testing Tools

   • Metasploit
     • Open source software
     • assist administrators in “attacking” their networks
     • assess state of defense
     • Used for both pentesting and vulnerability assessments
   • Security Auditor’s Research Assistant
     • vulnerability scanner
     • Performs SQL injection, cross-site scripting (XSS) tests and etc
     • Integrates with Nmap

3. objectives

   • Password-Capture and Decryption Tools
     • Auditing and recovering passwords
       • Nessus
       • Aircrack-ng
       • PSK passwords
       • Win Sniffer
       • Ettercap
     • Dictionary-style attacks
       • word listed is encrypted in sequence
       • using same encryption method as the password
       • password crackers: Aircrack-ng, Cain & Abel, and John the Ripper
     • Brute-force attacks
       • comparing all possible combinations of characters
       • generally inefficient against strong, complex passwords
     • ways to overcome
       • Create strong passwords
       • Use different passwords for different applications
   • Network Enumerators
     • scan a network for active hosts
     • Detecting Windows shares
       • e.g : Legion from Rhino9
     • OS fingerprinting or port scanning
       • e.g : LanGuard
     • use wireless intrusion prevention system (WIPS)

4. Wireless Protocol Analyzers

   • theory : reveal and locate devices that are behaving contrary to the rules and protocols of the network
   • Aircrack-ng
     • network detector
     • built-in protocol analyzer
     • Runs on Windows and Linux
   • Airshark
     • wireless variant of the Wireshark protocol analyzer
     • use for wired Ethernet networks
     • discovering rogue AP
     • Runs network in promiscuous mode
     • pinpoint TCP conversations and threads

5. Network Management Systems

   • theory : Provides a single viewpoint that administrator can view
   • Enables use of SNMP
   • NMS applications-open source
     • e.g : OpenNMS, Nagios, and Zenoss
   • NMS applications-commercial
     • e.g : WhatsUp Gold, SolarWinds, IBM Tivoli

6. WLAN Hardware Audit Tools

   • Pineapple
     • pentesting and network auditing toolbox
     • runs application scripts Comes
     • use preconfigured attack software

7. WLAN Antennas

   • Omnidirectional antennas
     • have 360-degree coverage
   • semi-directional antennas
     • narrower broadcast beam
     • 180 degrees

8. Attack Tools and Techniques

   • Radio Frequency Jamming
     • Jamming of the 2.4 GHz and 5 GHz bands vulnerability
     • flood a frequency channel
   • Denial of Service
     • Sending packets with spoofed MAC addresses to AP
   • Hijacking Devices
     • uses death packets and then takes advantage on client devices attempt to reconnect
     • create a rogue access point