Perform Wireless Audit On An Access Point or A Router

312216205084
Riyaz Rafi Ahmed

Ex. No: PERFORM WIRELESS AUDIT ON AN ACCESS POINT OR A
Date: ROUTER AND DECRYPT WEP AND WPA
AIM:
To perform an wireless Audit of an Access point/Router and Decrypt WEP and WPA using
netstumbler tool.
DESCRIPTION :
NetStumbler (also known as Network Stumbler) aircrack on ubuntu is a tool for windows
that facilitates detection of Wireless LANs using the 802.11b, 802.11a and 802.11g WLAN
standards. It is one of the Wi-Fi hacking tool which only compatible with windows; this tool
also a freeware. With this program, we can search for wireless network which open and
infiltrate the network. It’s having some compatibility and network adapter issues.
Steps:
• Download and install Netstumbler
o It is highly recommended that your PC should have wireless network

card in order to access wireless router.
• Now Run Netstumbler in record mode and configure wireless card.
o There are several indicators regarding the strength of the signal, such as
GREEN indicates Strong, YELLOW and other color indicates a weaker
signal, RED indicates a very weak and GREY indicates a signal loss.
o Lock symbol with GREEN bubble indicates the Access point has
encryption enabled. MAC assigned to Wireless Access Point is displayed
on right hand pane.
o The next column displays the Access points Service Set Identifier[SSID]
which is useful to crack the password.
To decrypt use WireShark tool by selecting Edit->preferences->IEEE 802.11

Enter the WEP keys as a string of hexadecimal numbers as A1B2C3D4E5
312216205084
Riyaz Rafi Ahmed
Adding Keys: Wireless Toolbar

If you are using the Windows version of Wireshark and you have an AirPcap
adapter you can add decryption keys using the wireless toolbar.
If the toolbar isn't visible, you can show it by selecting View->Wireless
Toolbar. Click on the Decryption Keys. button on the toolbar:
This will open the decryption key management window.
As shown in the window you can select between three decryption modes:
None, Wireshark, and Driver:
RESULT:
Thus the program was executed and verified successfully.
312216205084
Riyaz Rafi Ahmed
Ex. No.: 8 DEMONSTRATE INTRUSION DETECTION SYSTEM (IDs) USING

Date: ANY TOOL (SNORT OR ANY OTHER S/W)
AIM:
To demonstrate intrusion detection system using Snort tool.
DESCRIPTION:
Snort is an open source network intrusion detection system (NIDS) has the ability to perform
real-time traffic analysis and packet logging on internet protocol (IP) networks. Snort
performs protocol analysis, content searching and matching. Snort can be configured in
three main modes: sniffer, packet logger, and network intrusion detection.
STEPS:
Snort Installation Steps
Getting and Installing Necessary Tools
Installaing Packages
Snort: <Snort_2_9_8_2_installer.exe>
WinPcap: <WinPcap_4_1_3.exe>
Snort rules: <snortrules-snapshot-2982.tar.gz>
Once Completed
1.Change the Snort program directory:
<c:\cd \Snort\bin
2.Check the installed version for Snort:
<c:\Snort\bin> snort -V
3.Check to see what network adapters are on your system

<c:\Snort\bin> snort -W>
Configure Snort with snort.conf
<snort.conf> is located in <c:\Snort\ect>
Contains nine steps:
1.Set the network variables
a. Change <HOME_NET> to your home network IP address range

<10.6.2.1/24> b. Change <EXTERNAL_NET> to <!$HOME_NET>
This expression means the external network will be defined as - any IP not part of
home network
c. Check for <HTTP_PORTS>
d. Change var <RULE_PATH> - actual path of rule files. i.e <c:\Snort\rules>

312216205084
Riyaz Rafi Ahmed
e. Change var <PREPROC_RULE_PATH> - actual path of preprocessor rule files
i.e <c:\Snort\preproc_rules>
f. Comment <#> <SO_RULE_PATH> - as windows Snort doesn't use shared

object rules
g. Configure trusted <white.list> and untrusted <black.list> IP address -

reputation preprocessor
2.Configure the decoder

a. No changes in this part
b. Set the default directory for Snort logs i.e

<c:\Snort\logs> 3.Configure the base detection engine
a. No changes in this part

4.Configure dynamic loaded libraries
a. Change the dynamic loaded library path references
i.e. <dynamicpreprocess direc

c:\Snort\lib\snort_dynamicpreprocessor> i.e. <dynamicengine direc
c:\Snort\lib\snort_dynamicengine\sf_engine.dll> b. Comment out
<dynamicdetection directory> declaration 5.Configure preprocessors
a. Many Preprocessors are used by Snort - Check Snort manual before setting
them.
b. Comment on <inline packet normalization preprocessor> This preprocessor
is used when Snort is in-line IPS mode>
c. For general purpose Snort usage - check these preprocessors are active
frag3
stream5
http_inpect
ftp_telnet
smtp
dns
ssl
sensitive_data
6.Confgiure output plugins
a. Be default Snort uses only one output plugings -
<default:unified2> b. Want to use Syslog output pluging - activate
it by uncommenting.
1. Uncomment and edit the syslog output line
<output alert_syslog: host=127.0.0.1:514, LOG_AUTH LOG_ALERT>
312216205084
Riyaz Rafi Ahmed
Note: If you are going to use syslog - install <Syslog
Server> c. Uncomment metadata reference lines
<include classification.config and include

reference.config> 7.Customise your rule set
a. Initial test, reduce the number of rules loaded at start-up, uncomment

<local.rules> b. First time users, comment most of include statements.
8.Customise preprocessor and decoder rule set
a. Uncomment the first two lines in Step 8
<include
$PREPROC_RULE_PATH\preprocessor.rules>
<include $PREPROC_RULE_PATH\decoder.rules>
b. If you enables the sensitive_data preprocessor <step 5>

uncomment <include $PREPROC_RULE_PATH\sensitive-
data.rules>
c. Make sure rules you declare - available in <c:\Snort\preproc_rules>
9.Customise shart object rule set
a. Comment on lines
b. Uncomment <include threshold.conf>
Generating Alerts
This is for validation of Snort
1. Open <local.rules> in a text editor
2. Start typing this:
<alert icmp any any -> any any (msg:"ICMP Testing Rule"; sid:1000001; rev:1;)
<alert tcp any any -> any 80 (msg:"TCP Testing Rule"; sid:1000002; rev:1;)
<alert udp any any -> any any (msg:"UDP Testing Rule"; sid:1000003; rev:1;)
3. Save as <local.rules>
4. Open <CMD> and run it as <ADMINISTRATOR>
5. Start Snort <c:\Snort\bin> snort -i 2 -c c:\Snort\etc\snort.conf -A console
6. Open <CMD> no need to be an ADMINISTRATOR
7. Send a <PING> command to your local gateway: <c:\> ping 10.6.0.1>
8. Open a web browser and browse to any web page
You can see the alerts Snort produces and shows it in First terminal
OUTPUT:
312216205084
Riyaz Rafi Ahmed
RESULT:
Thus the program was executed and verified successfully.

Perform Wireless Audit On An Access Point or A Router

Uploaded by

Copyright:

Available Formats

Perform Wireless Audit On An Access Point or A Router

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Perform Wireless Audit On An Access Point or A Router

Uploaded by

Copyright:

Available Formats

312216205084

Riyaz Rafi Ahmed

o It is highly recommended that your PC should have wireless network

• Now Run Netstumbler in record mode and configure wireless card.

To decrypt use WireShark tool by selecting Edit->preferences->IEEE 802.11

Adding Keys: Wireless Toolbar

Ex. No.: 8 DEMONSTRATE INTRUSION DETECTION SYSTEM (IDs) USING

3.Check to see what network adapters are on your system

a. Change <HOME_NET> to your home network IP address range

d. Change var <RULE_PATH> - actual path of rule files. i.e <c:\Snort\rules>

f. Comment <#> <SO_RULE_PATH> - as windows Snort doesn't use shared

g. Configure trusted <white.list> and untrusted <black.list> IP address -

2.Configure the decoder

b. Set the default directory for Snort logs i.e

a. No changes in this part

a. Change the dynamic loaded library path references

i.e. <dynamicpreprocess direc

<include classification.config and include

a. Initial test, reduce the number of rules loaded at start-up, uncomment

b. If you enables the sensitive_data preprocessor <step 5>

You might also like