Free YouTube Transcribe

Video transcript

Hands-On Cybersecurity and Ethical Hacking – Full Course

freeCodeCamp.org · 27,590 words · 126 min read

Want to search this transcript, jump the video from any line, or download it as TXT, SRT, or VTT?

Open in the transcript tool

Full transcript

Introduction

0:00In this course, you will learn the

0:01fundamentals of cyber security and

0:03ethical hacking using Kali Linux, and

0:06you'll learn how to protect systems from

0:07vulnerabilities. This beginner-friendly,

0:10practical, and hands-on course from

0:12Sunny covers essential techniques,

0:14tools, and ethical considerations. This

0:17course covers key topics like

0:18penetration testing, network security,

0:21and how to determine system

0:23vulnerabilities. Hello and welcome to

0:26this course where you are going to learn

0:28handson cyber security and ethical

0:31hacking from scratch. This course is

0:34suitable for beginners who have no prior

0:37knowledge of ethical hacking. Everything

0:40will be taught from level zero. By the

0:43end of this course, you will be very

0:46comfortable with Linux command line,

0:48various attacking tools, wireless

0:51security, defensive tools, end mapap,

0:53wire sharkark and many more tools. My

0:56name is Sanim Malu. I am a cyber

0:58security consultant and reverse

1:00engineer. I will be your instructor for

1:03this course. Now, let me quickly walk

1:06you through the course curriculum and

1:08what you will learn in this course. We

1:12will start with the fundamentals of Kali

1:14Linux such as copying, removing,

1:17renaming files, how to navigate your

1:20file system efficiently. Then we will

1:23move to Linux administration where you

1:26will learn the pseudo command, root

1:28user, how to create, remove, install and

1:31uninstall applications and more. Once

1:35fundamentals are done, we will move on

1:38to wireless security where you are going

1:40to learn how to perform Wi-Fi

1:44penetration testing and defend against

1:46Wi-Fi attacks. Then we will move to the

1:49Wireshark which is one of the most

1:52important tools in cyber security and

1:55learn how to use it. We will also cover

1:58N map and many more tools. Now let's

2:01dive into the practicals. We are going

What is Kali Linux

2:04to use Kali Linux operating system. If

2:07you don't have Kali Linux installed, I

2:10have a separate video on my channel for

2:12Kali Linux installation. So check that

2:15out first. Now let's dive into the

2:17practicals. Before we dive into the

2:20practicals, let me briefly explain what

2:23Kali Linux is. Kali Linux is an

2:26operating system that is specifically

2:29built for penetration testing and cyber

2:32security tasks. It is widely used for

2:36ethical hacking and cyber security tasks

2:38such as penetration testing, security

2:41research, computer forensic and reverse

2:44engineering. It has more than 300

2:46pre-installed hacking and forensic

2:49tools. Before we start using all the

2:52fancy tools, we need to learn the

2:55fundamentals of its command line. Now

2:58let's dive into the practicals. If you

3:01have not installed Kali Linux yet, I

3:04have covered the installation process in

3:06a separate video on my channel. Please

3:09watch that video first. If you want to

3:13learn beyond the basics, I have an

3:15advanced cyber security course on Udemy.

3:19Feel free to check it out. The link is

3:21in the description. Now, first thing

Basic Commands & Terminal Customization

3:24that we need to do is open the terminal.

3:27There are multiple ways to open the

3:30terminal. The easiest among all is press

3:34control + alt + t together and it should

3:38open up the terminal. This is the

3:41terminal. Or you can click on the

3:44applications icon or menu and in the

3:47search box type terminal. Click on

3:50terminal emulator. Or you can directly

3:54click on the terminals icon at the

3:57taskbar. Here it is. Click on it and it

4:00will definitely open up the terminal.

4:04Now before executing any commands I'm

4:06going to change the font size. As you

4:09can see the fonts are barely visible. So

4:13go to the file, click on preferences,

4:16click on appearance tab and click on on

4:19the change button and click on up arrow

4:24to increase the font size. I'm going to

4:26set it to 13. 13 works for me. Click on

4:30okay. Click on okay. As you can see now

4:33we have a much more readable font size.

4:37When we open the terminal we are

4:40presented with these two names separated

4:44by this symbol. Now this symbol can be

4:47anything. It is just a separator which

4:50separates these two names. Now name on

4:54your left side is the user name who is

4:57currently logged in. So type who am I

5:00command press enter. Who am I command

5:03displays the currently logged in user.

5:07So the current logged in user is Dimalu.

5:09It means Dimalu is using the system name

5:13on your right side is the host name or

5:16your system name. Type host name

5:18command. It displays the host name.

5:22Press enter. Now type clear. Clear

5:25command. As the name suggests, it clears

5:27the the terminal. Press enter. Now, next

5:31command that uh I'm going to type is

5:34date. D date prints the current date and

5:37time. Press enter. As you can see, this

5:40is the current date. I'm recording this

5:42video on this date. Now, type PWD. PWD

5:48stands for present working directory. It

5:52displays your present working directory

5:54where you are in your file system. Press

5:58enter. As you can see, my current

6:00working directory is Dimalu. Dimalu is

6:03the home directory for the user Dimalu.

6:06And we also have this dollar sign

6:10symbol, right? It also has a meaning.

6:13The dollar sign essentially represents

6:16the regular or normal users. In Linux,

6:20there are two types of users. Root user

6:24and regular users. The dollar sign

6:27represents the regular users. For now,

6:31you don't have to worry about users. We

6:34will get back to users in a dedicated

6:37section. The currently logged in user

6:40which is Dimalu is also a regular user.

6:44Now, before wrapping up this video, let

6:47me execute history command. The history

6:49command displays all the commands that

6:53you have executed previously. Press

6:55enter. As you can see, this is the list

6:58of commands that have been executed on

7:01this freshly installed Kali Linux

7:03machine. LS is an essential Linux

ls Command

7:06command. LS stands for list or listing.

7:10As the name suggests, it is used to list

7:14or display files and directories. You

7:17can view or check the contents of a

7:21specific directory or multiple

7:23directories with ls command. Now let's

7:26dive into the practicals. So type ls,

7:30press enter. By default, the ls command

7:33displays all the files and directories

7:36in your current working directory. So

7:38these are the files and directories in

7:40my current working directory which is

7:43home. And here we have two colors,

7:45right? the blue color and white color.

7:49The blue color represents directories

7:52and the white color represents files.

7:55The white color essentially represents

7:57all file types whether it is sh file or

8:02txt file, mp4 files, PDF files. All file

8:06types are represented by the white color

8:09in Kali Linux. Now the default ls

8:12command does not display the hidden

8:15files and directories. So if you want to

8:17list hidden content then type ls space-

8:22a parameter allows us to display or list

8:26all the files and directories including

8:29the hidden files and directories. Press

8:32enter. As you can see guys, we have

8:34files and directories that have dot at

8:38the beginning. The files and directories

8:41that have dot at the beginning, they are

8:43the hidden ones. Now let me execute ls

8:46again. As you can see, the default ls

8:49command displays contents of current

8:52working directory. Now I only want to

8:55list contents of a specific directory.

8:59Let's say I only want to see what is

9:02inside the desktop directory. Then type

9:06ls. Now specify name of the directory

9:09whose content you want to check desktop.

9:14So this time I am telling ls command

9:17that only list contents of this

9:21specified directory. It will display

9:23what is inside this specified directory

9:26uh desktop. Press enter. As you can see

9:29this time it is only uh listing contents

9:32of the desktop. Similarly, we can list

9:36contents of multiple directories as

9:39well. Just separate the directories with

9:42a space. Let's say etc. And this time ls

9:46command is going to list contents of

9:49desktop and the etc directory. Press

9:53enter. As you can see this is this is

9:55the contents of desktop and this is the

9:59contents of etc directory. In this way

10:02you can basically uh list contents of as

10:05many directories as you like. Just

10:08separate those directories with a space

10:11like this. This time it is going to list

10:13contents of these three specified

10:16directories. Press enter. As you can see

10:19guys, now the default ls command as you

10:22can see only displays the file and

10:25directory names. Right? However,

10:27sometimes we want more details such as

10:31file size, last modified date, etc. So,

10:35type ls space-l

10:38stands for long listing. It gives us a

10:42detailed information about the files and

10:45directories. Press enter. And first

10:48field from the right displays the

10:51directory or file name. Then we have

10:54this date and time. Right now this date

10:57and time automatically get updated when

11:01you modify a file or directory. In the

11:05context of a file when you modify or

11:08edit a file then this date and time get

11:12updated automatically. And in the

11:14context of a directory when you add a

11:18new directory or file to a directory

11:21then this date and time get updated. Or

11:25if you modify a file within a directory

11:29then the date and time of that

11:32particular directory also get updated.

11:35Now next field that we have is this. It

11:39displays the file size in bytes which is

11:43not very readable to us. So if you want

11:47a more readable format for displaying

11:50file and directory size then ls - l and

11:55hyphen hyphen h stands for human

11:59readable. Press enter. As you can see

12:02now we have file size in kilobytes,

12:06megabytes and gigabytes. iPhone h

12:08essentially displays file size in

12:11kilobytes, gigabytes and megabytes.

12:14And you don't have to you know write the

12:17hyphen H parameter separately. You can

12:21simply combine it with hyphen L or other

12:25parameters. Press enter. As you can see

12:27it is producing the same result. CD

cd Command

12:31stands for change directory. It is a

12:35simple command. As the name tells you cd

12:38allows us to navigate in our file

12:42system. So if you want to change

12:45directory or location then we have to

12:48use the cd command. So open your

12:51terminal. Let me type ls and execute pwd

12:56as well. Now my current working

12:58directory is home. I'm in my home

13:01directory. Right now let's say I want to

13:04switch or change my directory from

13:07current working directory to desktop.

13:10Then type cd space. Now specify the

13:15exact directory name where you want to

13:18switch desktop. Press enter. pwd. As you

13:22can see guys, my current working

13:24directory has been changed to the

13:27desktop.

13:29Now if you want to go one directory

13:33back, then type cd space two dots. It

13:38takes us one directory back in our file

13:42system. Press enter. pwd as you can see.

13:46Similarly, you can go multiple

13:48directories back with cd command. Type

13:51cd space two dots forward slash two dots

13:54again. It will take us two directories

13:58back. Press enter. pwd as you can see.

14:01And you can go as many directories back

14:05as you like with cd command. Just

14:08separate two dots with forward slash.

14:11Then it takes us that many directories

14:14back. Now what happens if you don't

14:18specify any directory name to the to the

14:22cd command right? My current working

14:24directory is desktop. Now if I type only

14:28cd command and don't provide any

14:31directory name then the cd command by

14:34default redirects us to the home

14:37directory. So press enter pwd. As you

14:41can see the current working directory

14:43has been changed from desktop to home.

14:47Sometimes we unintentionally or

14:49mistakenly execute the cd command which

14:52eventually redirects us to the home

14:55directory. So if you want to go to your

14:59previous working directory then type cd

15:02space and hyphen. It will take me to my

15:06previous working directory which was

15:08desktop. So press enter. As you can see

15:11guys, my directory has been changed to

15:14my previous working directory uh which

15:17is desktop. In this video, we will learn

Nano Editor

15:20how to create and modify text files

15:24using the nano text editor. Nano is a

15:27terminal based text editor that allows

15:30us to create, open and modify text files

15:34directly within the terminal. It is an

15:38easy to use and lightweight tool that

15:41offers features such as syntax

15:44highlighting, line numbering, search and

15:47replace, copy, cut and paste among

15:50others. In this video, we will cover the

15:53fundamentals of Nano. Now, Nano is one

15:57tool that you will be using on a daily

16:00basis. Now, let's jump into the

16:03practicals. type nano

16:07and press enter. We are inside the nano

16:11text editor. Now nano is absolutely

16:14ready to take the inputs. So let me type

16:17a few random text lines. Let's say this

16:20is a line number one. Now press enter

16:25for a new line. This is a new line.

16:28Press enter again.

16:31third line

16:34and at the bottom these are the options

16:37that we can use with the nano. First

16:41option that we have is controll G.

16:44Control + G is for help. It displays the

16:48documentation for nano in detail. So

16:52press control + G together. And uh here

16:56we have the the detailed information

16:59about the nano. Here we have the

17:02description for Nano, what it is and

17:04what it does. Now press the down arrow

17:07key to scroll through the entire

17:10documentation

17:12here. These are the options that we can

17:15use with Nano. So guys feel free to go

17:18through this uh this uh lengthy

17:21documentation. Now to exit out of this

17:24documentation, press Q. Then we have

17:28control O. Control O is for write out.

17:32Write out simply means saving the

17:34content to a file. I have not saved

17:38these lines into a file yet. So to save

17:41press control + O. Now here as you can

17:45see file name to write. Specify the file

17:48name where you want to save this

17:51content. Let me give let's say file name

17:54dummy. txt. Remember guys, by default

17:58the nano saves the file in your current

18:02working directory. My current working

18:04directory is desktop. So this dummy.txt

18:08file will be saved in in my desktop. Now

18:11press enter. As you can see root four

18:14lines at the top. Here we have the

18:17dummy.txt file where the content has

18:20been saved. Now to exit out of nano

18:25press control + x. Let me ls to check

18:30whether the file has been created or

18:33not. As you can see guys dummy.xt file

18:36has been created. Now I want to edit or

18:40modify this dummy.xt file using nano.

18:44Type nano dummy.xt.

18:48Provide the file name. Press enter. Now

18:51we have opened the dummy. TXT file

18:55successfully. Now we can you know modify

18:58this file however we like. So guys

19:01that's how you can create, save and

19:04modify contents of text files using nano

19:08text editor. Now before wrapping up this

19:12video, let me show you one uh trick that

19:15you can use for saving time. We can

19:19create the file at the beginning when we

19:23start nano. All you need to do is type

19:26nano and specify the file name new

19:29file.txt.

19:31Remember the way nano works if the file

19:34name that you specify if it already

19:38exists then it will open uh the existing

19:41file and if the file does not exist then

19:45nano will create the file. Press enter.

19:49As you can see, new file.ext has been

19:52created. Now we can write

19:56content to it. Press enter. For new

19:58line, press Ctrl O for saving the

20:02contents to the file. Press Ctrl + X to

20:07exit out of nano ls. As you can see, new

20:11file uh txt has been created. In this

cat Command

20:15video, we will take a look at the cat

20:17command. I can assure you that you will

20:20be using it on a daily basis. It is

20:24among the core commands of Linux. So,

20:27what does the cat command do? The cat

20:30command is a versatile multi-purpose

20:32command that can be used for a variety

20:35of tasks such as creating text files,

20:39viewing the content of files, appending

20:42text to existing files, etc. The CAT

20:45stands for concatenation. This is the

20:48first video on the CAT command. In this

20:50video, we will learn how to view the

20:53contents of a file and print line

20:56numbers as well. Now let's jump into the

20:59practicals. Let me ls I have these two

21:02files in my desktop and I want to view

21:06contents of uh let's say this dummy.txt

21:09file. So type cat and space. Now specify

21:14the file name whose content you want to

21:18view or print. I'm going to go with

21:21dummy.txt.

21:22So I'm telling cat that display or print

21:26the contents of this specified file. Let

21:30me press enter. As you can see guys,

21:32this is the contents of this dummy. TXT

21:36file. Now one thing that is missing is

21:39is the line numbers. CAD command does

21:42allow us to print line numbers as well

21:45which is a very convenient feature. So

21:48type cat, let's say dummy.xt txt and

21:53space hyphen n. It prints the line

21:57numbers. As you can see guys, now we

21:59have a very well formatted output and we

22:02have six line numbers, right? This is

22:04because these two are the blank lines.

22:08Blank lines also get counted. The get

22:11command also allows us to view contents

22:15of multiple files. All you have to do is

22:18tell the cat command those file names.

22:22Let's say cat space dummy.xt.

22:26Now space d1.txt.

22:29So you have to separate the file names

22:32with a space. And this time cat command

22:36is going to print contents of dummy.xt

22:39file and d1.txt

22:42file. Let me press enter. As you can see

22:45guys, this is the contents of first file

22:49and this is the uh this is the contents

22:51of D1 txt file. In this way, you can

22:55view contents of as many files as you

22:59like. Just separate file names with a

23:02space then it will print contents of all

23:06the specified files. Now I'm going to

23:10print contents of a file which is uh

23:13located in another directory right the

23:16d1 and dummy.txt these files are in my

23:19current working directory. I want to

23:21print contents of a file which is inside

23:24etc directory. The file name is passd.

23:27Now the passd file stores user account

23:31details. All the user accounts details

23:34are stored inside this passd file. Press

23:38enter. As you can see guys, these are

23:40the user accounts in my Linux system. I

23:44will get back to this past WD file in a

23:48dedicated video. We will continue where

Create Files Using cat

23:51we left off in the previous video. In

23:54this video, we will learn how to create

23:57files and append contents to existing

24:01files using the catch command. We will

24:04also learn how to concatenate multiple

24:08files into one. Now let's jump into the

24:11practicals to create a file using cat.

24:15Type cat. Now type the greater than

24:18symbol and specify the file name that

24:22you want to create. Let me create

24:24dummy.txt.

24:25Press enter. As you can notice, we have

24:28this uh cursor. It is essentially

24:31waiting for us to input something. Let

24:34me input a few random text line. This is

24:36a

24:39text line. Press enter for a new line.

24:44Line number two.

24:50Now to exit out of the cat, press

24:52control + C. Let me ls. As you can see,

24:56the file has been created. Let's check

25:00its contents.

25:02And these are the exact lines that we

25:06wrote uh inside the the dummy. TXT file.

25:09The cat command works pretty much like

25:12the output redirection operator. It

25:15overrides the contents of existing file.

25:19The way the cat command works, if the

25:23file doesn't exist, then it creates that

25:27file first and writes content to it. And

25:30if the file already exists, then it

25:33removes contents of that existing file

25:36and only keep or save the new content

25:40that you write to it. For example, I

25:43already have this file called dummy.txt.

25:46So if I

25:49write contents to this dummy.txt file

25:52then cat will remove the contents of

25:56this existing file and only keep the new

25:59content that you write to it. So let me

26:03write let's say

26:06this is a dummy file dummy file. Press

26:10enter. Let me exit out of the cat ls and

26:15let's check its contents. As you can see

26:18the existing content has been overritten

26:22or removed. It only kept the new

26:25content. So if you want to keep the

26:28existing content and append new content

26:32at the end then we have to use two

26:34greater than signs like this. Now

26:37specify the file name dummy.xt txt press

26:41enter

26:42line number two press enter line three.

26:47Now what the catch command will do is it

26:50will keep the existing content and the

26:54new content will be appended at the end

26:58of the file because we are using two

27:01greater than signs. Let me exit out of

27:04the cat

27:06lsc dummy.xt txt. As you can see, the

27:09existing content is still there and new

27:12content has been appended at the end of

27:15the file. So guys, that's how you can

27:17avoid content overwriting.

27:20Now let's learn how to concatenate

27:23multiple files into one. Let me change

27:26my directory to to desktop where I

27:29already have the multiple uh files.

27:32I have these two files. Let me first

27:35check their contents.

27:37This is the contents of D1.txt

27:40and uh this is the contents of

27:43dummy.txt. I want to merge contents of

27:47both of these files into one which is

27:50very easy. Type get and specify the file

27:53name. So let's say dy d1 txt.

27:58Now write the greater than sign. Then

28:00specify the file name where you want to

28:04merge the contents. So what the get

28:07command is going to do? It will take the

28:10contents of the files that you specify

28:14before the greater than sign then merge

28:18contents of these two files into this

28:21specified file merged dot txt. Press

28:25enter. ls the file merged txt has been

28:30created as you can see. Let me get out

28:32its contents. And this is the contents

28:35of contents of merge. .txt file.

28:38Remember when you merge the contents

28:41with cat it doesn't remove or alter the

28:46contents of the files. It only takes the

28:49contents of those files then save that

28:53into the file where you merge it. In

Create Directories

28:56this video we will learn how to create

28:59directories or folders in Linux.

29:03Basically folders are called directories

29:05in Linux. Now let's jump into the

29:09practicals.

29:11Type make diir. Make dir is short for

29:15make directory. Now you have to specify

29:19the directory name that you want to

29:21create. Let me create let's say dummy.

29:24So I am basically telling the make

29:27directory command to create this dummy

29:31directory. That's as simple as that.

29:33Press enter. ls. As you can see, dummy

29:37directory has been created. Now, let's

29:41create multiple directories with a

29:44single make diir command. Type make diir

29:47d1 space d2. This time make diir command

29:53will create these two directories. Just

29:57separate the directory names with a

30:01space. Let me press enter. LS. As you

30:04can see, D2 and D1 directories have been

30:08created. And now what I want is is to

30:11create a directory within a directory. I

30:15want to create a tree of directories.

30:18For example, I want to create a

30:20directory called Sunny. And inside sunny

30:23I want to create subdirectory called dim

30:26timalu. So type uh make diir

30:31sun sunny / dimallu. Press enter. And we

30:35have an error. Can't create directory

30:38because if you want to create a

30:41directory within a directory then we

30:43have to specify hyphen p option. P

30:47stands for parent. It creates a

30:50directory within a directory. So if I

30:52press enter this time ls as you can see

30:55the sunny directory has been created.

30:58Let's check its contents.

31:02As you can see inside the sunny we have

31:04the dimallu directory. So guys that's it

31:07for this quick video. Thank you very

31:10much for watching. Welcome back

grep Command

31:12everyone. This is the first practical

31:14video on the grip command. In this

31:17video, we will learn what grip is and

31:20the fundamentals of grip. Grip stands

31:23for global regular expression print.

31:27Now, what does the grip do? The grip

31:29command is heavily used for searching

31:33text or text patterns in files. Let's

31:37say you have a large text file and you

31:40want to know if a particular word exists

31:45within the file or how many times it is

31:48there in the file then the grip command

31:51solves this problem very efficiently and

31:54easily. It makes searching through files

31:57very easy. Use cases of grip command are

32:01vast. It can be used for formatting

32:04output, searching patterns and analyzing

32:06logs efficiently. Now let's jump into

32:10the practicals. Let me switch my

32:12directory to the desktop. Now we are

32:16going to need a file to work with where

32:19we can perform the grip searches. So

32:22what I'm going to do is redirect the

32:25manual page of user add command uh to a

32:29file. This is the documentation for user

32:31ad. I'm going to redirect or save it

32:34into a file. Press Q to exit out of the

32:38documentation. Now type man user add.

32:40Type output redirection operator.

32:43Specify the file name where you want to

32:47save the manual page. Out. TXT. Press

32:51enter. ls. The file has been created.

32:54Let me quickly check its contents with

32:58hyphen n option press enter. As you can

33:01see in this file we have almost 500

33:05lines. These are enough lines to

33:08demonstrate the grip command

33:10efficiently. Now back to the grip. So

33:13type grip. First thing that I'm going to

33:16do is check the available options that

33:19we can use with grip. So help option is

33:22going to display all the available

33:24options that can be used with grip.

33:27Press enter. So these are the options

33:30that we can use with the grip command.

33:33So feel free to go through all these

33:35options. Grip is actually a very

33:38advanced command. So type uh grip space.

33:43Now grip needs minimum two options. the

33:47search term what you want to search for

33:50and the file name where you want to

33:53search. So provide the search term or

33:56pattern. I'm going to search for the

33:58word user.

34:00Write the search term within quotes

34:03space. Now specify the file name where

34:06you want to search out txt. So I am

34:11basically telling the grip command

34:14search for the word user in this

34:18specified file out dot txt. Press enter.

34:23As you can see guys, grip has printed

34:26all the lines that contain the searched

34:30term user. Right? The searched term or

34:34match is being highlighted with the red

34:38color. So by default it is going to

34:40print all the lines that contain the

34:43searched term. Now one thing which is

34:45missing here is the line numbers. I

34:49exactly don't know in which lines the

34:52grip has found the match. So to print

34:55the line numbers we have to use hyphen n

34:58option. So type grip n and search term

35:02is again going to be user file name

35:05out.txt. So this time grip is going to

35:09print the lines wherever it finds the

35:12word user. If I hit enter, as you can

35:15see on the on the left side, it is

35:18exactly telling us the line numbers

35:21wherever it found the match. Now the

35:25search that I conducted was in this file

35:29out.xt which is in my current working

35:32directory. Now we can also search in a

35:35file which is located in another

35:38directory.

35:40I'm going to search for the word dimallu

35:44in the file which is located inside etc

35:49directory

35:50pass wd. So what basically is going to

35:53happen this time grip command is going

35:55to search for the word dimallu in this

35:59specified location. location is ATC

36:03directory. Inside ATC directory, we have

36:06a file called pass WD. Now, pass WD file

36:09essentially stores information of all

36:12the user accounts on your system. So, it

36:15will check whether the user account

36:17demalu exists or not. I will get back to

36:20pass WD file in a dedicated video. So,

36:24press enter. As you can see, it did find

36:27the word dimalu or user account dimalu

36:31in this uh pass wd file. It means the

36:34user account dimalu does exist. Now what

36:37happens if uh the grip does not find the

36:41match or you provide a pattern that

36:44doesn't exist?

36:46In that case, grip doesn't provide any

36:49output. So that's pretty much it for

36:52this video, guys. Thank you very much

36:53for watching. In this video, we will

wc Command

36:55explore the WC command. It is a simple

36:59and useful tool. WC stands for word

37:03count. As the name suggests, WC counts

37:06the total number of words, lines, and

37:10characters in a given file. Now, let's

37:13jump into the practicals. I have this

37:16file called out.txt.

37:18I want to count or check how many words,

37:23characters and lines are in this

37:26particular file. So type wc space. Now

37:29specify the file name where you want to

37:33perform counting in out.txt.

37:38Now press enter. As you can see, we have

37:40some interesting details. First field

37:44from the right displays the file name.

37:47Then next field displays the total

37:50characters and this field displays the

37:54total words and first field from the

37:57left displays the total lines. Now I

38:00only want to print the total number of

38:03words. So type wc

38:08and hyphen w only prints the total

38:11words. As you can see the total words in

38:14the file out.xt txtr 200831.

38:20Similarly, you can print only lines WCL.

38:27And if you want to print the total

38:31letters or characters, then specify

38:34hyphen C. C counts how many characters

38:38are in the specified file. As you can

38:41see, now let me demonstrate the WC with

38:44a real world example. Let's say I want

38:46to check how many user accounts are on

38:49my system. Then WC - L etc pass WD.

38:57Now it will count how many lines are in

39:01the pass WD file. Press enter. As you

39:04can see there are total 59 lines which

39:07means there are total 59 user accounts

39:10in my system. So that's it for WC

39:13command guys. Thank you very much for

Output Redirection

39:15watching. In this video, we are going to

39:17learn about output redirection. Output

39:21redirection is a fundamental concept in

39:23the Linux command line that allows us to

39:27control the output of a command or

39:30program. In simple terms, it means

39:33taking the output of a command and

39:37redirecting or saving it to a file. When

39:40you execute a command in the terminal,

39:43by default, the output of that command

39:46is typically displayed in the terminal.

39:49However, with output redirection, you

39:52can save the output to a file. There are

39:56many situations where you might need to

39:59save the output of a command to a file

40:02instead of displaying it in the terminal

40:06such as analyzing the output later

40:08filtering or processing the output with

40:12other tools etc. So let me practically

40:15demonstrate what I just explained. Let

40:18me execute uh the ls command. This is

40:21the output of ls command right now.

40:24Output redirection allows us to redirect

40:28or save output that a command produces

40:32to a file. This is exactly what I'm

40:35going to do. I will take this output of

40:38ls command then redirect or save it to a

40:43file. The syntax is very simple. Type

40:46the command whose output you want to

40:49redirect. I'm going to go with the ls

40:52command. Now type the greater than sign.

40:54The greater than symbol is also known as

40:57the the output redirection operator. Now

41:01specify the file name where you want to

41:03save the output. out txt. Now the way

41:08output redirection works. If the file

41:11name that you specify does not exist,

41:14then it will create the file first then

41:18redirect output to it. And if the file

41:22already exists then it will redirect or

41:25save the output to the existing file.

41:29Let me hit enter. And this time we did

41:32not get any output. This is because by

41:35default Linux sends output of a command

41:39to the terminal. However, this time we

41:42used the output redirection operator. So

41:45the output was sent to this out. txt

41:50file not to the terminal. Now let me ls.

41:54As you can see the outtxt file has been

41:57created. Now let's check its contents.

42:01Get out.xt.

42:02As you can see guys inside out.xt file

42:07we have this content. This is the output

42:10of this ls command. This is exactly what

42:15we redirected to this out. txt file.

42:19This is as simple as that. Now let's do

42:22a few more examples. Let me execute a

42:25date command. This is the output of date

42:27command. Now let's uh redirect uh the

42:30output of date command to a file. Type

42:33date output redirection operator

42:36date.txt.

42:37This time output redirection operator is

42:40going to take output of date command

42:43then redirect it to this date. TXT file.

42:47Let me hit enter. ls the date dot txt

42:50file has been created. Let's get out its

42:53contents.

42:55As you can see guys inside uh date txt

42:58file. We have the output of date

43:01command. So similarly you can redirect

43:04output of any command uh to a file using

43:08the output redirection operator. Now you

43:11have to be a bit careful when

43:13redirecting output of a command to a

43:16file because the output redirection

43:20operator overrides or removes the

43:24contents of an existing file. For

43:27example, this date txt file already has

43:31uh some content. Right? Now if you

43:34redirect output of another command to

43:37this date txt file then it will remove

43:42or override the existing content and

43:45only keep the new content. Let me

43:48actually show you what I mean this time.

43:50What I'm going to do is redirect the

43:52output of uh ls command to the date txt

43:58file. Now the date txt file already

44:02exists right? It has already some

44:05contents inside it. Now this time the

44:08output redirection operator is going to

44:11redirect the output of this ls command

44:14to the date. TXT command and only keep

44:18the new content or output of this ls

44:22command. Let me press enter. Let's check

44:24the contents of date command. As you can

44:27see guys, the old or existing content

44:30has been removed. We only have the new

44:33content that we redirected it with the

44:37most recent command which is ls. Now if

44:40you want to maintain or keep the

44:43existing content of a file then we have

44:46to use the two output redirection

44:49operators. So let me redirect output of

44:52date command. This time use two output

44:55redirection operators like this date.

44:59TXT. Now when you use two output

45:03redirection operators, the output gets

45:07appended at the end of the file. So what

45:10it is going to do? It will take the

45:13output of date command then append or

45:16add it at the end of this specified

45:19file. Press enter. Let's get out

45:23contents of date dot txt file. As you

45:26can see guys, this is the existing

45:28content. It is still there. It has not

45:31been overritten. And the output of the

45:34previous command date has been appended

45:36at the end. That's how guys you can use

45:38the output redirection operator and

45:41avoid content overwriting.

Piping

45:44In this video we are going to cover

45:47pipes also known as piping. Piping is an

45:51essential part of the Linux command

45:54line. So what exactly is piping? In

45:58simpler terms, piping is the process of

46:01sending the output of one command to

46:04another. Piping combines two or more

46:08commands by sharing data between them.

46:12This is done using the pipe character

46:15between the two commands. Now why do we

46:19need to send output of one command to

46:22another or share data between them?

46:25Well, sometimes we have to use multiple

46:29commands or tools to complete complex

46:32tasks. So when you use different

46:36commands separately to get a single task

46:39done, it is a timeconsuming process,

46:43right? So why not combine multiple

46:46commands together instead of executing

46:49them separately? This is exactly what

46:52piping solves. Piping allows us to

46:56combine or connect multiple commands by

46:59sharing data or output between them. So

47:03instead of using multiple commands

47:06separately, we can combine them using

47:09piping. When one command sends its

47:12output to another command, the receiving

47:15command processes that output as its

47:18input. This essentially means that the

47:22output of one command becomes the input

47:25for the next command or the receiving

47:28command. Now let's jump into the

47:31practicals. Here I have this out txt

47:34file. Let me get out its contents. This

47:38is the output of this uh get command.

47:41Right now piping allows us to pipe or

47:45send output of one command to another.

47:49This is exactly what I'm going to do. I

47:51will send this output of get command to

47:54the grip command. Grip command will

47:56further process this output. Let me type

48:00the complete command. So type get

48:03out.txt.

48:05Now type the pipe character. This is the

48:08pipe character. This pipe character is

48:11typically above the enter key. Now, let

48:15me type the grip command. I'm going to

48:17search for the word user and let me open

48:21uh another terminal.

48:24I'm going to need it for a smooth

48:27explanation. Now, let me get out the

48:30contents of out txt file. Now, let me

48:33break down this this entire command. Now

48:36the way it is going to work since we are

48:39using piping the pipe character the

48:42Linux is going to send the output of

48:45this cat command to the grip command.

48:48This is the output of uh cat command.

48:51Right? Linux will send this output to

48:54the grip command. Now grip command will

48:57receive this output then search for the

49:02word user in this output or in these

49:06text lines. If it finds the word user in

49:10any of these lines then those lines will

49:13be uh printed or displayed. Now if you

49:16notice here I have not specified any

49:20file name. The grip command needs

49:23minimum two options. the search term

49:26what you want to search. I have

49:28specified the search term but I have not

49:31specified the file name where I want to

49:35search for this specified word user.

49:38This is because the grip is going to

49:41search for this word in this output that

49:46it receives from this command through

49:50piping. Let me press enter. As you can

49:53see guys, it has printed all the lines

49:55that that contain the searched term

49:59user. So that's how the piping works. So

50:02guys, the output of one command becomes

50:06input to another command or the command

50:09that is receiving it. Remember most

50:13Linux commands are designed to receive

50:16the output through piping. So the output

50:20of get command became input to the grip

50:23command and grip command searched for

50:26the word user in the output that it

50:30received. This is as simple as that. Now

50:33let's do a few more examples. Let me

50:36change my directory to home.

50:38Let me execute ls command. Now I want to

50:41check whether the directory desktop

50:44exists or not. Obviously it does exist.

50:48We all can see it. It is right there.

50:51However, if there are let's say hundreds

50:53of files and directories, then it

50:57becomes a bit hard to locate a specific

51:00file or directory. But with piping, we

51:04can easily solve such problems. All we

51:07have to do is send this output of ls

51:11command to the grip command, then search

51:13for the for the whatever file or

51:16directory you want. So let me type ls

51:20space type the pipe character. I'm going

51:23to search type grip. I'm going to search

51:25for the word desktop. So what basically

51:29is going to happen the Linux will send

51:32output of ls command. Let me close this

51:36terminal. This is not required. I'm

51:38going to open a new terminal.

51:42Now what basically is going to happen

51:44the Linux will send the output of this

51:47command which is this to grip command.

51:51Then grip command will search for the

51:54word desktop in this output and if it

51:59finds uh image then it will list that

52:03line. Press enter. As you can see guys

52:05it did find the word desktop. So the

52:09directory desktop does exist. So that's

52:12how guys the piping works. You can

52:15literally take output of any command

52:18then pipe that to another command.

Copy Files

52:21Copying files is a common task that you

52:24have to perform on a regular basis.

52:28Right? The command for copying files and

52:31directories is cp. CP stands for copy

52:34and it can copy both files and

52:37directories. Now let's jump into the

52:40practicals. I'm going to start with

52:42copying files and later we will copy

52:45directories as well. Let me execute ls.

52:48I'm going to use these files to

52:51demonstrate the cp command. So type cp.

52:54cp stands for copy. Now cp command needs

52:58minimum two options. the file name that

53:01you want to copy and the destination

53:05directory where you want to copy it. So

53:08I'm going to start with copying this

53:10dummy.txt file. So specify the name of

53:13the file that you want to copy dummy.txt

53:17space. Now specify the destination

53:20directory where you want to copy it. Uh

53:24I'm going to copy uh it in my current

53:26working directory. So specify a

53:29different name. Let's say dummy cp.txt.

53:34Now the copy command is going to take

53:37this dummy. TXT file and create its copy

53:41under this new name dummy cp.txt.

53:45Let me press enter. LS. As you can see

53:48guys, we have successfully copied dummy.

53:51TXT file. Here is the copy of dummy.txt

53:55txt file under this new name dummy

53:58cp.txt. Similarly, we can copy files to

54:02a specific location or different

54:05directory. What I'm going to do is uh I

54:08will copy this dummy.txt file to the

54:11downloads. Let me open a new tab. Change

54:14my directory to the downloads ls. As you

54:18can see, the downloads directory is

54:20currently empty. So, let's copy

54:22dummy.txt txt to the to the downloads.

54:26Type dummy.txt.

54:29Now provide the full path to downloads

54:32or wherever you want to copy it. Type

54:36homeward slash username

54:40which is demalu formeward slash

54:44downloads. Now this time the copy

54:47command will take uh the dummy.txt txt

54:50file and copy it to the specified

54:53location uh which is downloads. Let me

54:56press enter. Now let me ls here. As you

54:59can see the dummy txt file has been

55:02copied to the downloads.

55:05So that's how guys you can uh copy files

55:08uh with cp command. We can also give a

55:11different name while copying.

55:15type forward slash let's say dummy

55:19cp.txt.

55:20This time the the cp command is going to

55:24copy this file to the downloads

55:27directory under this new name dumcp.txt.

55:32Press enter.

55:35As you can see we have the file

55:37dumcp.txt.

55:40Now let's copy directories ls. I have

55:44this demo directory. I'm going to create

55:46a copy of this demo directory. Type uh

55:50cp space demo. Now specify the name of

55:54the directory

55:56demo 12. So copy command is going to

56:00take this demo directory and create its

56:03copy under this new name dem 2. Let me

56:07press enter. As you can see, we have an

56:10error. R not specified. If you want to

56:14copy directories, we need to specify

56:18hyphen r parameter. By default, copy

56:21command expects us to copy files. So if

56:24you want to copy directories, then we

56:27need to use the hyphen r parameter. So

56:31type hyphen r. This time the copy

56:34command is going to take this directory.

56:36then creates its copy under this new

56:40name dem12 in my current working

56:43directory. Let me hit enter. ls. As you

56:47can see guys, we have successfully

56:48created copy of demo directory under

56:51this new name. Now let's copy demo

56:55directory to another directory. I'm

56:58going to copy it to the downloads cpr

57:03demo. Now provide the path where you

57:05want to copy it. Home. Type the

57:08username.

57:10Downloads. This time copy command is

57:13going to take this demo directory and

57:16copy it to the specified destination

57:19which is downloads. Let me hit enter.

57:22Let me ls here. As you can see guys, the

57:25demo directory has been created. Right

57:29now let's copy multiple files or

57:33directories with a uh single cp command.

57:36What I'm going to do is I will copy dam

57:392 and app do c file uh to the downloads

57:44directory. So type cp ap c space. Now

57:50provide name of the file or directory

57:53that you want to copy. Let's say dam 2.

57:57Now provide the destination path home

58:00demalu sorry.

58:04Now since we are copying a directory

58:07along with file we need to provide

58:10hyphen r par parameter.

58:13Now the way this command is going to

58:14work copy command will copy these two

58:18specified file and directory to the

58:22downloads directory. You can copy any

58:24number of files or directories. Just

58:27separate them with a space like this.

58:30Now press enter. Let me go to the

58:34downloads

58:36ls. As you can see guys, here we have

58:38app dot C file and dem directory. That's

58:42how you can copy multiple files and

58:45directories with cp command. Just

58:48separate the files with a space. In this

Remove Files & Directories

58:52video, we will learn how to delete files

58:54and directories using the rm command.

58:58The rm command is short for remove. It

59:01is used to delete or remove files and

59:05directories. It is a straightforward

59:07command with a simple syntax. Now, let's

59:11jump into the practicals. I'm going to

59:13demonstrate the rm command using uh

59:16these dummy files and directories. So

59:20type rm. RM stands for remove space. Now

59:25we need to tell the rm command the file

59:29name that you want to remove. We are

59:32going to start with removing files.

59:34Later we will remove directories as

59:37well. So rm space. Now specify the file

59:40name that you want to remove. I'm going

59:43to remove this dummy.xt file which is in

59:46my current working directory. So type

59:48dummy txt. So rm command is going to

59:53remove this specified file dummy. TXT.

59:56Press enter. ls. As you can see guys,

59:59the file has been removed. Similarly, we

1:00:03can remove multiple files with a single

1:00:06rm command. Type rm space. Specify the

1:00:11file names. Let's say app dot c space.

1:00:14We need to separate uh files with a

1:00:18space appcp.txt

1:00:22and this time rm command is going to

1:00:25remove these two specified files. Press

1:00:29enter. ls. As you can see guys, both the

1:00:33specified files have been removed. And

1:00:37uh this way you can remove as many files

1:00:40as you like. just separate those files

1:00:43with a space. Now, let's remove files

1:00:47that are stored in a different

1:00:50directory. I'm going to remove uh files

1:00:54in my downloads directory.

1:00:57Let me change my directory to the

1:00:59downloads. Here I have all these uh

1:01:03dummy files. So, let me go back to my

1:01:06current working directory which is

1:01:08desktop. So type rm space. Now we need

1:01:12to provide the full path to the file or

1:01:16directory that you want to remove. So

1:01:20home type the username. Now downloads.

1:01:24Now inside downloads I have this file

1:01:27called dummy.txt.

1:01:29So after the destination directory

1:01:31forward slash then type the name of the

1:01:34file that you want to remove dummy.xt.

1:01:38So, rm command is going to remove this

1:01:41dummy.txt file which is stored in the

1:01:45downloads directory. Press enter. Let me

1:01:49go back to downloads.

1:01:51ls. As you can see guys, the file

1:01:54dummy.xt has been removed. Now let's

1:01:58remove directories. ls. I'm going to

1:02:01start with removing demo directory. So,

1:02:04rm demo. Press enter. As you can see, it

1:02:08is a directory. Just like the the cp

1:02:11command, we need to specify hyphen r

1:02:15parameter when removing directories. So,

1:02:19type rm - r. Provide the name of the

1:02:23directory that you want to remove. Press

1:02:26enter. ls. As you can ls, as you can see

1:02:29guys, the directory demo has been

1:02:33removed. Similarly, we can remove uh

1:02:36directories that are stored in a

1:02:39different location or directory. The

1:02:43syntax is same. Type rm - r. Provide the

1:02:48path to the directory that you want to

1:02:50remove. Downloads. In downloads, I have

1:02:54directory called demo. So, let me type

1:02:56the name of the directory. This time rm

1:02:59command is going to remove the demo

1:03:02directory which is inside the the

1:03:04downloads directory. Hit enter. Let me

1:03:08ls. As you can see guys, the demo

1:03:10directory has been removed. Now let's

1:03:13discuss some of the options that can be

1:03:16used with the rm command. Now one of the

1:03:20most commonly used options with rm

1:03:23command is hyphen f. F stands for force.

1:03:27It basically forcefully removes the

1:03:30files and directories. Now what happens

1:03:33is that there are certain files that you

1:03:37can't remove with the simple rm command.

1:03:41We need to provide hyphen f to remove

1:03:46specific files or directories. Now files

1:03:49that are right protected can't be

1:03:52removed with simple rm command. Now,

1:03:56right protected files are those that

1:03:59can't be modified or edited. Let me

1:04:03create one such file.

1:04:05I'm going to make this demo.txt file as

1:04:09write only. So, type ch mode. You don't

1:04:12have to worry about the ch mode command.

1:04:14We will get back to it in a dedicated

1:04:17section. For now, I just want to create

1:04:20a write protected file just to

1:04:22demonstrate rm command. ch mode user I'm

1:04:27going to take away right permission on

1:04:30demo txt file press enter now as you can

1:04:35see guys in the desktop we have this

1:04:38lock sign it means that this is a right

1:04:41protected file and it can't be modified

1:04:44or edited let me ls now let me try to

1:04:48remove it uh with default rm command

1:04:51demo txt press enter as you can see

1:04:54Guys, we have this prompt remove

1:04:58protected regular empty file demo.txt.

1:05:01Now here we have to uh specify n for no.

1:05:05If you don't want to remove then type n.

1:05:08And if you want to remove then type yes

1:05:12or y. Y stands for yes. Now I don't want

1:05:15to remove uh this demo.ext file yet. So

1:05:19I'm going to specify n. Press enter. Now

1:05:23if you want to bypass this prompt then

1:05:27we have to use hyphen f parameter. So

1:05:31type rm - f specify the file name and uh

1:05:38press enter. As you can see guys this

Types of Users

1:05:40time

1:05:42the rm command did not display this uh

1:05:47prompt remove protected regular file. it

1:05:51directly removed the file. So hyphen f

1:05:55parameter essentially bypasses uh this

1:05:59prompt and forcefully removes the files

1:06:02or directories. And if you have let's

1:06:05say a write protected directory then you

1:06:08have to specify hyphen r parameter like

1:06:12this hyphen rf then specify the right

1:06:16protected directory. Let's say we have a

1:06:19right protected directory demo. Then

1:06:21this command is going to remove this

1:06:24write protected directory and bypass the

1:06:28prompt that uh rm command typically

1:06:31displays when removing write protected

1:06:35files or directories. So that's it for

1:06:38rm command guys. Thank you very much for

1:06:39watching. Welcome back everyone. In this

1:06:41section, we will discuss two important

1:06:44aspects of Linux. User management and

1:06:47performing administrative tasks. This is

1:06:50one of the most important sections in

1:06:53this course. Before we dive into root

1:06:56user, sudo command and other advanced

1:06:58topics in upcoming videos. It is

1:07:01essential to understand user types.

1:07:04Linux users have different levels of

1:07:07access and permissions based on their

1:07:10type. Therefore, understanding users and

1:07:13their types is important. In this video,

1:07:17we will explore the different types of

1:07:19users in Linux. So, what is a computer

1:07:22user? First, a computer user is

1:07:24essentially someone who interacts with a

1:07:28computer system and uses its resources

1:07:31to perform tasks. These tasks include

1:07:35accessing files, running programs, and

1:07:38utilizing all the other features the

1:07:40system offers. In short, anyone who uses

1:07:43a computer for various activities is

1:07:46considered a computer user. Now, Linux

1:07:50is a multi-user operating system. Now,

1:07:53what does multi-user mean? A multi-user

1:07:56operating system allows multiple users

1:08:00to access and use a system

1:08:02simultaneously. This means several user

1:08:05accounts can be logged in at the same

1:08:09time. In a multi-user environment, we

1:08:12can create separate or multiple user

1:08:15accounts. Each user has their own

1:08:18account with a unique username and

1:08:21password. This allows users to log in

1:08:24with their login credentials and access

1:08:28their own files and resources without

1:08:31interfering with each other. Remember,

1:08:33each user in a multi-user operating

1:08:36system has their own files. By default,

1:08:39one user can't access files of other

1:08:42users on the system. Linux automatically

1:08:45manages the resources and security of

1:08:49each user account. Linux, Mac OS, and

1:08:52Windows are all multi-user operating

1:08:55systems. You can create multiple user

1:08:57accounts in each of these systems. In

1:09:00the upcoming videos, you will learn how

1:09:03to create and manage multiple user

1:09:05accounts on Linux practically. Now,

1:09:08there are three types of users in Linux.

1:09:11Not only in Linux, but in Windows as

1:09:14well. There are three main types of

1:09:16users. Regular users, root user and

1:09:20system users. Let's start with regular

1:09:23users. Regular users in Linux are also

1:09:27known as normal users, standard users or

1:09:30non-admin users. Regular users have

1:09:34limited system access. They can perform

1:09:37basic standard tasks such as browsing

1:09:40the internet, storing and accessing

1:09:42their data, playing media, and creating

1:09:46files etc. However, a regular user can't

1:09:49perform any administrative tasks such as

1:09:53installing, uninstalling applications,

1:09:55modifying system settings, accessing or

1:09:57deleting configuration files, and

1:10:00managing system directories and tools.

1:10:03In short, regular users don't have

1:10:06ability or permission to utilize and

1:10:09access files and tools that are

1:10:12specifically designed for performing

1:10:15administrative tasks. Now, let's address

1:10:18the real question. Why regular user

1:10:20accounts exist? What problems do they

1:10:23solve? As we discussed earlier, regular

1:10:26user accounts have limited privileges or

1:10:29access to a system. Uh this allows users

1:10:32to utilize and access the system without

1:10:35being able to modify system files or

1:10:39other protected administrative files and

1:10:43tools. This limited access helps

1:10:46maintain system security. Organizations,

1:10:49schools and universities commonly use

1:10:52regular user accounts for this very

1:10:55reason. Let's take an organization as an

1:10:58example. Organizations and corporations

1:11:01often have multiple employees who

1:11:04typically use the same computer system,

1:11:07right? To ensure security and privacy,

1:11:10each user is assigned a unique username

1:11:14and password. Users log in using their

1:11:17credentials. Each user's files are

1:11:20stored separately and one user can't

1:11:24access the files of another user without

1:11:27proper authorization.

1:11:29Regular user accounts as we have

1:11:31discussed have limited privileges. This

1:11:33means they can't damage or access system

1:11:36files nor can they perform

1:11:39administrative tasks. By using regular

1:11:42user accounts, users can benefit from

1:11:46all the essential functionality the

1:11:48system offers without risking accidental

1:11:51or intentional harm to the system

1:11:54through administrative access. They can

1:11:57create their own files, perform office

1:12:00work, but can't access administrative

1:12:02tools. This restriction on accessing

1:12:06only their own files inherently makes

1:12:09regular user accounts more secure.

1:12:12Windows is also a multi-user operating

1:12:14system. You may be familiar with guest

1:12:17accounts. The guest account in Windows

1:12:20is also a regular user account with

1:12:23limited system access. The second type

1:12:25of user is the root user also known as

1:12:29administrative user. Root will be

1:12:32covered in the next video because it

1:12:35deserves a dedicated video. Now let's

1:12:37discuss system users. System users in

1:12:41Linux as well as in Windows. A system

1:12:44user refers to a user account created

1:12:47for computer system or an application to

1:12:51execute specific tasks or functions.

1:12:54System users are created during the

1:12:57installation of operating system and

1:12:59applications. Some applications use a

1:13:02dedicated system user account to carry

1:13:06out their operations. System users

1:13:08typically run in the background. They

1:13:10are not directly relevant to your

1:13:13day-to-day tasks. We don't interact with

1:13:17them directly, but they are used by

1:13:20specific applications to carry out their

1:13:23operations in the background. These

1:13:25tasks include running demons or services

1:13:28in the background. Specific applications

1:13:31such as antivirus software also use

1:13:34dedicated system account to scan the

1:13:37system. System users don't have a login

1:13:40shell meaning they can't log into the

1:13:42system directly. In this video we will

Root User

1:13:46learn about the root user. Root is the

1:13:49most important user on a Linux system.

1:13:53In the previous video we discussed that

1:13:56regular users can't perform

1:13:58administrative tasks. However, someone

1:14:01eventually needs to perform

1:14:04administrative tasks. Right? And that is

1:14:07where the root user comes in. The root

1:14:10is a special user account on Linux. It

1:14:13is essentially the admin or

1:14:15administrative user account on the Linux

1:14:18system. All administrative tasks are

1:14:22performed by the root user account. The

1:14:25root user is also known as the super

1:14:29user. The root user has complete control

1:14:32over the system. It can perform any

1:14:35operation on a system such as installing

1:14:38or uninstalling applications, accessing,

1:14:41deleting and modifying any system and

1:14:44configuration files. In short, the root

1:14:47user controls and accesses everything.

1:14:50The root user account is created

1:14:53automatically during the installation of

1:14:56Linux. Each Linux system has the root

1:14:59user by default. In the upcoming video,

1:15:02we will be putting theory into practice.

sudo Command (Administrative Tasks)

1:15:08Finally, we will put everything we have

1:15:10learned in the last two videos into

1:15:13practice. In this video, we will learn

1:15:15about the pseudo command and how to use

1:15:19it to perform administrative tasks. We

1:15:22will also cover how sudo is related to

1:15:26the root user as well as who is allowed

1:15:29to use the sudo command. This video is

1:15:32going to be very important and probably

1:15:35one of the longest videos in the entire

1:15:37course. So make sure to watch the

1:15:40complete video and don't skip anything.

1:15:42Let's dive into the practicals. In the

1:15:45previous two videos, we learned that a

1:15:48regular user can't perform

1:15:51administrative tasks. Right? Now, let's

1:15:53actually verify if it is true or not.

1:15:58Now, how can you tell whether you are

1:16:00logged in as a regular user or the root

1:16:04user? Well, a regular user is denoted by

1:16:08the dollar sign. As you can see, it

1:16:10means that the currently logged in user

1:16:12Dimalu is a regular user and the root

1:16:16user is denoted or represented by the

1:16:19pound symbol. We will get back to it

1:16:22later. Now, what I'm going to do is I

1:16:24will try to install an application which

1:16:27is uh an administrative task. So, type

1:16:31app install WC.

1:16:34Don't worry about the apt command. We

1:16:36will get back to it in a dedicated

1:16:39section. Apt is basically used for

1:16:41installing or uninstalling applications.

1:16:44Now let me press enter and see what

1:16:46happens. As you can see guys, we have

1:16:49two errors. The first error says

1:16:52permission denied. It means that the

1:16:54currently logged in user Dimalu does not

1:16:58have permission to execute this command.

1:17:02And second error says that are you root.

1:17:06It means that you need to be the root

1:17:09user to execute this command. Only root

1:17:12user is allowed to execute this command.

1:17:16Now there are two primary ways to

1:17:19perform administrative tasks on a Linux

1:17:22system. Either you need to log in as the

1:17:26root user or you can use the pseudo

1:17:30command to perform administrative tasks.

1:17:34Now logging in as root user is not

1:17:36recommended especially for beginners

1:17:40because it can be very dangerous. The

1:17:42major problem with logging in as the

1:17:45root user is that the root user executes

1:17:49commands without alerting you or giving

1:17:53any warnings. No matter how dangerous

1:17:56the command is, you are not warned

1:17:59before making system changes or

1:18:02executing commands. This means that you

1:18:05will not have any opportunity to review

1:18:09the changes before they are implemented

1:18:12which can lead to serious problems. For

1:18:15example, you could accidentally delete

1:18:18essential system files rendering your

1:18:21system unusable or unstable. For these

1:18:25reasons, it is considered dangerous to

1:18:28log in as root or operate your system as

1:18:32root. Even experienced users avoid

1:18:35logging in as root unless it is

1:18:38absolutely necessary. So what is the

1:18:40safe way to perform administrative

1:18:43tasks? To safely perform administrative

1:18:46tasks, we can use the pseudo command.

1:18:51Pseudo command allows regular users to

1:18:54run commands with the same power or

1:18:58privileges as the root user. This means

1:19:02you don't need to log in as the root

1:19:05user to perform administrative tasks.

1:19:09You can simply use the sudo command. The

1:19:12term sudo stands for super user do where

1:19:16su stands for super user and do stands

1:19:20for perform or execute. Remember the

1:19:24root user is also known as the super

1:19:28user.

1:19:29Now let's see how we can use the pseudo

1:19:32command to perform administrative tasks.

1:19:36The syntax is simple. Just type the

1:19:39pseudo command before the command that

1:19:41you want to execute. Now I'm going to

1:19:44execute the same apt install WC command.

1:19:48App install

1:19:51WC. Press enter. Type your password.

1:19:55Press enter. As you can see guys, now

1:19:58the command is working. Apt is asking me

1:20:01whether I want to continue the

1:20:03installation or not. Type Y. Y is for

1:20:07yes, N is for no. I'm going to type Y to

1:20:10proceed with installation. Press enter.

1:20:13Now app is going to download the

1:20:16required files for WC then install it

1:20:19automatically.

1:20:22The installation is complete. And now

1:20:24let me verify the installation. Type WC.

1:20:28Press enter. As you can see guys, WC is

1:20:31up and running. So guys, that's how you

1:20:34can basically use the pseudo command to

1:20:37perform administrative tasks. Just type

1:20:40the pseudo command before the actual

1:20:42command that you want to execute. Now

1:20:45let me execute another command that

1:20:47needs pseudo privileges. There is a

1:20:50command called fd disk which is used for

1:20:53managing partitions.

1:20:55Press enter. As you can see, permission

1:20:58denied. Now I'm going to type sudo then

1:21:02f disk

1:21:05- l. Press enter. As you can see guys,

1:21:08now the command has been executed

1:21:11successfully. So guys, if you encounter

1:21:14errors like this permission denied, then

1:21:18just write the pseudo command before the

1:21:21actual command, then the command will be

1:21:24executed. This is as easy as that. And

1:21:27there is another tool called airmon ng.

1:21:30If I press enter, as you can see, run it

1:21:33as root. It means it also needs the

1:21:36pseudo privileges. If I type pseudo,

1:21:39press enter. Now as you can see this

1:21:41command has been executed successfully.

1:21:44So guys whenever you want to perform

1:21:47administrative tasks or encounter errors

1:21:50like run it as root or

1:21:54permission denied then just write the

1:21:57pseudo command before the actual command

1:22:00then everything will be fine.

1:22:04Now let's address a very important

1:22:06question. who can access or use the sudo

1:22:10command. Remember, not every regular

1:22:13user can use the sudo command. Only

1:22:16users who have been granted pseudo

1:22:19privileges or permission to use the sudo

1:22:22command can use or access it. By

1:22:26default, only one regular user account

1:22:29has permission to use the sudo command.

1:22:33The user account that you create or set

1:22:36up during installation is allowed to use

1:22:39the pseudo command. When you install

1:22:42Ubuntu, Kali Linux or any Linux based

1:22:45operating system, you have to set up a

1:22:47user account and password for that

1:22:50account during the installation. Right?

1:22:53The user account that you set up during

1:22:56installation is automatically given

1:22:58permission to use the pseudo command.

1:23:02Only that particular user can use the

1:23:05pseudo command. Any user accounts that

1:23:08you create after the installation can't

1:23:11access the pseudo command. They have

1:23:13limited access to the system and can't

1:23:16perform administrative tasks or use the

1:23:20pseudo command. Now, how do you know

1:23:23whether a user account can access or

1:23:26have permission to use the pseudo

1:23:29command? It is simple. We need to use

1:23:32the ID command to verify that. Now, type

1:23:36ID space. Now, specify the username that

1:23:39you want to check sudo permissions for.

1:23:43I'm going to check whether the dimallu

1:23:46user has permission to use sudo or not.

1:23:49Type username. Press enter. Here we have

1:23:52a lot of information. We will dissect

1:23:55this information in a dedicated section.

1:23:58For now, here you only need to see if

1:24:01the sudo is mentioned here or not. Here

1:24:05we have groups. So groups equal to and

1:24:08here it is sudo. As you can see guys,

1:24:11sudo is here. It means the user Dimalu

1:24:14is part of the pseudo group. So the

1:24:18demalu user has permission to access the

1:24:21sudo command. Now I have another user

1:24:24account on my system which is guest and

1:24:28let me press enter to see if it has

1:24:31access to the sudo command or not. Press

1:24:34enter. As you can see guys, this is a

1:24:37regular user account that I created

1:24:39after installing the Kali Linux. And

1:24:42here uh we don't have sudo mentioned

1:24:45anywhere. It means that the guest user

1:24:49does not have access to the pseudo. It

1:24:52can't use or access the pseudo command.

1:24:56Again guys, I'm wrapping up this video

1:24:58with the note that only the user account

1:25:01that you create or set up during the

1:25:04installation has the access to the sudo

1:25:07command. user accounts that you add

1:25:10after uh installation don't have

1:25:13permission to use the pseudo command. In

1:25:16this video, we are going to look at the

ip addr Command

1:25:19IP adder command. This is a very

1:25:22important command for administrators and

1:25:25you will be using it a lot. So, what is

1:25:28it? The IP adder command is used to

1:25:31display information about the network

1:25:34interfaces such as Ethernet or wireless

1:25:37network adapter on your computer. It

1:25:40provides network details like IP address

1:25:43assigned to each interface, network

1:25:45masks, MAC address and other network

1:25:48related details. By using this command,

1:25:51you can easily check and manage your

1:25:54network settings. Now let's jump into

1:25:57the practicals. Type IP

1:26:02sorry IP space adder space show. Now the

1:26:07IP adder command with show parameter

1:26:11displays all the installed network

1:26:14interfaces on your system. So press

1:26:16enter. As you can see guys, these are

1:26:19the installed network interfaces along

1:26:22with their configurations. The first

1:26:25interface that we have is the LO. LO

1:26:28stands for loop back. It is up and

1:26:31running. The loop back is also known as

1:26:34the local host. This is the address for

1:26:37the loop back. Now loop back is not a

1:26:40physical network interface, right? It is

1:26:43a virtual interface. You can't use the

1:26:47loop back for connecting to a network.

1:26:51The loop back points to your own system.

1:26:54It can't communicate with external

1:26:57networks. The loop back is not that

1:26:59important for now. I will get back to

1:27:02loop back when we will set up the Apache

1:27:05web server. Now the most important part

1:27:08for us is this ETH0.

1:27:11The Ethernet network interface is

1:27:15represented by the ETH0 in Kali Linux.

1:27:20I'm connected to my network using

1:27:22Ethernet. So under the Ethernet I have

1:27:26all the network configuration details.

1:27:29As you can see this is the IP V4

1:27:33address. Inet essentially means IP

1:27:35address. BRT is short for broadcast

1:27:38address. This is the broadcast address.

1:27:40And here we have the MAC address. The

1:27:44MAC address is known by different names

1:27:48such as ether

1:27:50link or hardware address. So this is the

1:27:54MAC address. And down here we have the

1:27:56IPv6 address as well. Now here we don't

1:28:00have the details for wireless card or

1:28:03wireless interface. Right? This is

1:28:05because a virtual machine can't access

1:28:09the built-in wireless card because it is

1:28:12already being used by your main

1:28:15operating system or your host operating

1:28:18system. But if you connect an external

1:28:22wireless card then that will be listed

1:28:26here. A wireless card is represented by

1:28:30WLAN zero. So if or when you connect an

1:28:34external card then IP adder command will

1:28:38display that card as well under the name

1:28:42WLAN0. You will see something like WLAN0

1:28:47in this list of interfaces. Now the show

1:28:51parameter is not

1:28:54mandatory if you only want to list the

1:28:58installed network interfaces. So just

1:29:01type IP adder IP space add header then

1:29:04it will uh print all the network

1:29:07interfaces along with their

1:29:09configuration details and instead of

1:29:12using adder we can use its shortand

1:29:16which is a. So IP space a press enter as

1:29:20you can see it is producing the same

1:29:23result as the last command which was

1:29:26this. So IP A is the shortand for adder.

Install Packages

1:29:32In this video we will finally learn how

1:29:35to install packages or applications from

1:29:38the terminal. It is actually easy. Type

1:29:41sudo. Now before actually installing a

1:29:45new application, we should always run

1:29:47the apt update command. It will update

1:29:51your local repositories which will help

1:29:53the package manager to download the

1:29:57latest possible version of the

1:29:59application that you are downloading as

1:30:02we discussed in the previous video. So

1:30:04let me quickly run the

1:30:07update command. So type apt update. It

1:30:09will uh update your local database.

1:30:12Press enter. Let the update command

1:30:15finish. Now the update command is

1:30:17complete. We are good to go. Now we can

1:30:20proceed with installation. So type sudo

1:30:24apt. The apt as we discussed in the

1:30:27previous video allows us to install,

1:30:30remove and update packages. So after apt

1:30:35type install install parameter allows us

1:30:38to specify name of the package or

1:30:41application that you want to install.

1:30:44I'm going to install let's say WC. So

1:30:46type the name of the package that you

1:30:49want to install. So this command is

1:30:52going to install the specified package

1:30:55WC. Remember guys, apt will only be able

1:30:58to install the specified package if it

1:31:02is available in the repositories. Now

1:31:05press enter. Provide your password. Let

1:31:08me scroll up a little. And here these

1:31:12are the dependencies that apt is going

1:31:15to install because WC needs all these

1:31:18dependencies to function properly. Now

1:31:21scroll to the bottom here we have this

1:31:23prompt continue. If you want to continue

1:31:26or proceed with installation then we

1:31:29need to type Y. Y is for yes N is for

1:31:33no. I'm going to proceed with

1:31:35installation. So type Y. Press enter and

1:31:38it will take a few seconds or probably a

1:31:42minute to complete the downloading and

1:31:45installation.

1:31:48All right, the installation is complete.

1:31:50Now let's verify whether the WC has has

1:31:54been installed or not. Type WC. Press

1:31:57enter. As you can see guys, WC is up and

1:32:01running. So installation was successful.

1:32:04Similarly, you can install any other

1:32:07package or application that you want.

1:32:10Let me install another application.

1:32:14Type sudo. The steps remain same.

1:32:18Type apt install. After install, specify

1:32:22name of the package that you want to

1:32:25install. I'm going to install htop. HTOP

1:32:27is basically a system monitoring tool.

1:32:30Press enter.

1:32:32And uh the installation is almost

1:32:36complete. As you can see installation is

1:32:38complete. Now type htop to verify its

1:32:42installation.

1:32:43Press enter. As you can see guys, this

1:32:46is the the htop. We are inside edtop and

1:32:50at the bottom it is displaying all the

1:32:53running processes on my system and in

1:32:56the top half it is displaying the system

1:33:00resources being consumed like RAM

1:33:04processor etc. Now press Q to exit out

1:33:07of the edtop. So guys that's how you can

1:33:11basically install the applications. The

1:33:14syntax for installing every application

1:33:17is same after install parameter specify

1:33:22name of the package or application that

1:33:24you want to install and if the specified

1:33:28package is available in the repositories

1:33:31then the package will be installed.

1:33:34Thank you very much guys. In this video

Remove Packages

1:33:36we are going to learn how to remove or

1:33:39uninstall packages uh from terminal. So

1:33:43type sudo

1:33:45space. The tool for removing packages is

1:33:50apt. The same tool that we used for

1:33:52installing applications. After apt, type

1:33:56remove. Now specify a name of the

1:33:59package or application that you want to

1:34:03remove. I'm going to remove WC. So apt

1:34:06is going to remove the specified package

1:34:10WC. Press enter. provide your password

1:34:14and here as you can see removing the

1:34:17package name we'll see type n if you

1:34:19don't want to continue uninstallation

1:34:22and if you want to proceed with

1:34:24uninstallation type y press enter and it

1:34:28will uninstall the package as you can

1:34:31see it has been uninstalled now guys

1:34:34after executing the remove command we

1:34:38need to execute the auto remove command

1:34:41command and uh let me type apt

1:34:44auto remove. Now what happens is that

1:34:48the remove command only removes the main

1:34:52executable file. It does not remove the

1:34:56dependencies that were installed with a

1:34:59package. It basically removes the

1:35:01dependencies that are no longer

1:35:04required. So press enter. And if I

1:35:07scroll up, as you can see guys, it is

1:35:09going to remove all these dependencies

1:35:12that were installed with WC. Now type Y

1:35:16to proceed with uninstallation.

1:35:22It will complete the uninstallation. Now

1:35:25as you can see command has been executed

1:35:27successfully. Now let's uh verify

1:35:30whether WC is still there or not. So

1:35:32type WC. As you can see guys, WC is no

1:35:36longer showing up. It has been removed

1:35:40successfully. Similarly, you can remove

1:35:42any application or installed package

1:35:46that you want. Just specify name of the

1:35:50installed package after the remove then

1:35:53it will remove that package. So thank

1:35:55you very much guys. That's it for this

Introduction to Nmap

1:35:57video. In this section we are going to

1:36:00learn how to use N mapap. N MAP is an

1:36:03extremely important tool in cyber

1:36:06security. Whether you are a network

1:36:08engineer, cyber security analyst or an

1:36:11ethical hacker, NAP is useful for

1:36:14everyone in general. It is a tool that

1:36:17should be part of your cyber security

1:36:20skill set. Now, what is N MAP? N MAPAP

1:36:22is an advanced information gathering

1:36:25tool that hackers and pentesters use to

1:36:29obtain information about the systems

1:36:32they intend to hack or test. Now what

1:36:35happens is that before actually hacking

1:36:38a system, attackers need to collect

1:36:41information about their target system.

1:36:44Hackers search for openings or possible

1:36:47access points for infiltration. N MAP

1:36:50provides this information quite easily

1:36:53and masterfully. N MAPAP is a port

1:36:56scanning tool. It scans for open ports,

1:36:59vulnerabilities and various services

1:37:01running on a system. This is the first

Scan Ports

1:37:04practical video on N MAP. In this video,

1:37:08we will learn the fundamentals of N

1:37:11MAPAP scanning and analyze all three

1:37:14states of a port. Now, let's jump into

1:37:17the practicals. So, open your terminal

1:37:20and type n map. The first thing that I

1:37:24always like to do when learning a new

1:37:27tool is check the options that it

1:37:30offers. So, type n mapap two hyphens

1:37:33help. The help parameter displays all

1:37:37the options that can be used with n map.

1:37:40So, press enter. As you can see, these

1:37:43are the options or available options

1:37:45that can be used with n map. Let me tell

1:37:48you guys, NAPAP is a very advanced tool.

1:37:52Therefore, it offers all these options.

1:37:54So, feel free to go through uh this this

1:37:57uh documentation.

1:37:59Now, type n map space. Now, before

1:38:03scanning the target network, you should

1:38:06always check whether it is up and

1:38:09running or not because if it is not

1:38:12running, then it is pointless to scan.

1:38:16So type hyphen S uppercase P. S stands

1:38:20for scan. P stands for ping. In the

1:38:23background, N MAPAP conducts the ping

1:38:26scan to check whether the specified host

1:38:29is up and running or not. Now specify

1:38:32the name of the host. You can either

1:38:34specify an IP address or a domain name.

1:38:39I'm going to specify the domain name

1:38:41scanme.nmap.org.

1:38:45Remember guys, you can't randomly scan

1:38:48any website on internet with N MAPAP. It

1:38:52is illegal. Fortunately, N MAPAP

1:38:54provides this specific server or

1:38:58subdomain that we can use for learning N

1:39:02MAPAP or practicing N map or if you have

1:39:06your own server or domain then you can

1:39:09specify that as well. Now the way this

1:39:12command is going to work, N map MAPAP

1:39:14will conduct the ping scan in the

1:39:16background to check whether the provided

1:39:19host is running or not. Press enter. As

1:39:22you can see one host up. It means the

1:39:25specified host is is up and running. Now

1:39:28we can proceed further with the

1:39:31scanning. Type n map. Type the name of

1:39:36your target network. scan me dot nm

1:39:39mapap.org.

1:39:42Now this is the default n mapap scan

1:39:45without any options. By default n mapap

1:39:49scans the most popular 1,00 ports. If

1:39:54you don't provide any options like this

1:39:56then n mapap will scan the most popular

1:40:001,00 ports. So press enter. It is going

1:40:03to take uh some time to complete the

1:40:05scan because NAPAP has to go through all

1:40:09the 1,00 popular port numbers and

1:40:12determine their state whether they are

1:40:15open or filtered. As you can see guys,

1:40:18the scan is complete. Now let's analyze

1:40:21the result. The first nice thing that

1:40:24the N map does is it prints the IP

1:40:28address. As you can see in the brackets,

1:40:30we have this IPv4 address. This is the

1:40:34IPv4 address of this specified host.

1:40:38Now, instead of using this domain name,

1:40:41we can directly use this IPv4 address.

1:40:45So, what I'm going to do is copy this

1:40:47IPv4 address. And here is the IPv6

1:40:51address for this domain name. Now let's

1:40:54analyze the actual result which is this.

1:40:58So here we have 987

1:41:01port numbers closed and remaining 13 are

1:41:05either open or filtered. We have three

1:41:07columns here. Port port column displays

1:41:10the port number. State column displays

1:41:14the state of a port. There are two

1:41:17possible states of a port. Either it can

1:41:20be open or filtered. We'll get back to

1:41:23it in a minute. Then we have service

1:41:26column. It displays the service running

1:41:28on a port. For example, the port number

1:41:3122. It is open and the service running

1:41:35on port number uh 22 is SSH. The default

1:41:39port for SSH is 22. Now what does the

1:41:43open port mean? It means that this port

1:41:47is accepting connections or ready to

1:41:50accept connections. The SSH essentially

1:41:54allows us to access servers or computers

1:41:58remotely from anywhere. So if the SSH

1:42:01port is open, it means you can access uh

1:42:04a server or computer remotely from

1:42:08anywhere. You just need to provide the

1:42:11correct login credentials. Now what does

1:42:14the open port mean from a hacker's

1:42:17perspective? Well, if the legitimate

1:42:20users can access or log in the SSH, so

1:42:24can hackers. Hackers can basically hack

1:42:27the SSH service by brute forcing its

1:42:31login credentials or if the SSH version

1:42:35is vulnerable, then they can exploit

1:42:38that particular vulnerability. So an

1:42:41open port can be vulnerable if it is not

1:42:44properly protected. Then we have port

1:42:47number 25 which is filtered. Now what

1:42:50does the filtered port number mean? It

1:42:52means it is probably protected by a

1:42:56firewall. Only the authorized person can

1:43:00access the port number 25 or you can say

1:43:04only the authorized users can connect to

1:43:07port number 25. We have a plenty of open

1:43:11ports such as FTP. FTP is similar to

1:43:15SSH. The only difference is that SSH is

1:43:18secure. Communication on SSH is

1:43:21encrypted whereas on FTP the

1:43:25communication is carried out in plain

1:43:27text. So that's it for this video guys.

1:43:31Thank you very much for watching and if

1:43:33you have any questions then let me know.

Wi-Fi Security: System Requirements & Wireless Card

1:43:40Hello and welcome to this course where

1:43:42you will learn wireless security from

1:43:45scratch. This course is suitable for

1:43:48absolute beginners who want to learn

1:43:51about Wi-Fi attacks and defense. How

1:43:55attackers hack a Wi-Fi network and how

1:43:58to detect and protect against Wi-Fi

1:44:02attacks. To learn defensive strategy,

1:44:04first we need to understand how a Wi-Fi

1:44:08network is compromised. Then we will be

1:44:11able to develop a good defensive

1:44:13strategy. By the end of this course, you

1:44:16will be able to secure your Wi-Fi

1:44:19network from all potential threats. This

1:44:23is a detailed course where everything

1:44:26will be covered from scratch. You will

1:44:29be taught how things work behind the

1:44:32scenes or attacks, not just commands.

1:44:35Now, you need an external wireless card

1:44:38for Wi-Fi penetration testing. These are

1:44:41the recommended cards suitable for Wi-Fi

1:44:45pentesting that you can consider

1:44:47purchasing. They are all compatible and

1:44:50supported by Kali Linux. We are going to

1:44:54use Kali Linux for Wi-Fi penetration

1:44:57testing. Kali Linux has all the tools

1:45:00pre-installed that we need for Wi-Fi

1:45:03penetration testing and security. In

1:45:06this video, we will learn how to connect

1:45:09your wireless network card to Kali Linux

1:45:12and address the common errors that may

1:45:16arise initially. Now, let's dive into

1:45:19the practicals. Before you plug in or

1:45:23connect your wireless card, we need to

1:45:26upgrade the system. So type sudo app.

1:45:29First we need to update the

1:45:31repositories. Now provide your password.

1:45:34Let the update command. Finish.

1:45:40Now once the update command completes

1:45:42then we need to execute upgrade command.

1:45:46So type sudo

1:45:48upgrade. Press enter. Now type Y. Press

1:45:53enter. Let the upgrade command. Finish.

1:45:57It is very important. Now once the

1:45:59upgrade command finishes, now we are

1:46:02good to go. Now plug in or connect your

1:46:05wireless network adapter to your USB

1:46:09port. To use your wireless card in your

1:46:13Kali Linux virtual machine, go to the

1:46:15devices, click on USB, and your wireless

1:46:20network cards name should appear in this

1:46:23list. I have an alpha network card that

1:46:26uses an Athereious chipset. As you can

1:46:29see, it is listed here. So, click on

1:46:32your network card or appropriate network

1:46:36card. I'm going to click on Athere.

1:46:38Now once selected Kali Linux is going to

1:46:41take around 15 to 20 seconds to set up

1:46:46everything when you use your wireless

1:46:49network card for the first time in Kali

1:46:52Linux. Now wait for uh 15 to 20 seconds.

1:46:55Now to verify whether your card is

1:46:58detected by Kali Linux or not, type IP

1:47:03space a press enter. As you can see

1:47:06guys, WLAN zero, my wireless card has

1:47:09been detected. W stands for wireless,

1:47:12LAN stands for local area network and

1:47:15the number zero represents the card

1:47:19number. Each wireless card has a unique

1:47:21number assigned to it. The first

1:47:23wireless card that you connect is

1:47:25assigned number zero. If you connect

1:47:27another card, that card will be assigned

1:47:30number one. In case if your card is not

1:47:34appearing or Kali Linux has not detected

1:47:37it then disconnect your card then

1:47:39reconnect again and repeat the same

1:47:43steps. Go to the devices USB click on

1:47:47Ethereos or whatever chipset your card

1:47:50is using. Now let me verify again. As

1:47:53you can see WLAN zero it has been

1:47:55detected. Once detected, now you can use

1:47:58your wireless card to connect to a Wi-Fi

1:48:02network. Click on the networks icon.

1:48:05Click on available networks. Now select

1:48:08the Wi-Fi network that you want to

1:48:11connect to. As you can see now,

1:48:13sometimes you might encounter errors

1:48:15like this.

1:48:18Can't attach USB device. Failed to

1:48:22attach the USB device. In case if you do

1:48:25encounter such an error then solution is

1:48:28simple. Disconnect your wireless card

1:48:32then reconnect again. Now go to the

1:48:35devices USB. As you can see my network

1:48:38card is already selected. If it is

1:48:41already selected then you don't need to

1:48:44do anything. Just wait for a few seconds

1:48:47and type IP

1:48:50IPA to verify it as you can see. And if

1:48:53it is not uh selected then select your

1:48:57chipset then it should automatically

1:49:00solve the problem. In case you have a

1:49:03different network card and Kali Linux is

1:49:06not detecting it, post your questions in

1:49:09the Q&A section. I will definitely

1:49:11answer your queries there. If you have a

1:49:14network card that I recommended Kali

1:49:17Linux will detect them automatically.

1:49:20you don't need to install drivers for

1:49:23them if you use Alpha series cards. Now

1:49:26once uh the wireless card is detected

Introduction to Aircrack-ng

1:49:30now we are good to go. Now let's talk

1:49:32about the tools that we are going to use

1:49:34for wireless penetration testing. The

1:49:37tool that we are going to use is air

1:49:40crackng. Now air crackng is not a single

1:49:43tool rather it is a complete suite. It

1:49:47is collection of many tools. Airng is

1:49:51the best tool out there for testing

1:49:54wireless security. Each tool within air

1:49:57crackng is designed for specific tasks.

1:50:01For example, air crack suite has a tool

1:50:04called aerodyump. Aerodyump is used for

1:50:08capturing packets. And uh then we have

1:50:12uh airmon nng which is used for

1:50:16controlling the monitor mode. The air

1:50:18crackng itself is used for cracking

1:50:22passwords. There are many more tools uh

1:50:25in the air crack suite that we will

1:50:27explore as we progress through the

1:50:30course. Now we need to verify whether

1:50:33air crackng is detecting the wireless

1:50:36card or not. So type sudo

1:50:41airmong press enter. Provide your

1:50:44password. As you can see, Airmon NG has

1:50:46also detected the wireless card. It

1:50:50means this card is compatible with

1:50:52Airmon NG. Now, we are good to go.

1:50:56Remember guys, you will need to repeat

1:50:59the same steps each time you want to use

1:51:03your wireless adapter in your Kali Linux

1:51:06virtual machine. Right. After plugging

1:51:09in the card, you need to go to the

1:51:11devices USB, then select uh your

1:51:14wireless card. In this video, we will

Monitor Mode vs Managed Mode

1:51:17discuss managed and monitor modes. A

1:51:20wireless network card can operate in two

1:51:24modes, managed and monitor mode. In

1:51:27managed mode, also known as normal mode,

1:51:30the wireless network adapter is used for

1:51:33standard tasks such as connecting to

1:51:37Wi-Fi networks, accessing the internet,

1:51:39and utilizing other network resources.

1:51:43Monitor mode, on the other hand, is

1:51:45entirely different. It allows us to

1:51:48intercept or capture all network traffic

1:51:51being transmitted over a specific Wi-Fi

1:51:55network or all surrounding wireless

1:51:58networks within its range. Wireless

1:52:01cards operate in managed mode by

1:52:03default, allowing you to connect to

1:52:06Wi-Fi networks. However, to capture or

1:52:09monitor network traffic, we need to

1:52:12switch or change the network card to

1:52:16monitor mode. In monitor mode, a

1:52:18wireless network adapter can capture

1:52:21wireless network traffic within its

1:52:23range. Now, let's discuss the real

1:52:26question. Why do we need to capture

1:52:29wireless network traffic? Well, to hack

1:52:33a Wi-Fi network, certain information is

1:52:36required. This information can be

1:52:39obtained by capturing packets and

1:52:42monitor mode allows you to capture those

1:52:45required packets. Specifically, we need

1:52:48the four-way handshake which can be

1:52:50intercepted using monitor mode. However,

1:52:54it is important to note that this mode

1:52:57is often used for legitimate purposes by

1:53:01network administrators, security

1:53:03professionals, and researchers. They use

1:53:06it to monitor and analyze wireless

1:53:08network traffic for troubleshooting,

1:53:11security testing and research purposes.

1:53:14In the next video, we will enable the

1:53:16monitor mode. In this video, we will

Enable Monitor Mode

1:53:19finally learn how to enable and disable

1:53:23monitor mode as well as how to restart

1:53:25the network manager. Now, let's jump

1:53:28into the practicals. First connect or

1:53:32plug in your wireless network card. I

1:53:35have already plugged in mine. Uh let me

1:53:38verify that. Type ip space a. Press

1:53:41enter. As you can see here it is wln

1:53:44zero. I'm going to put a wl zero into

1:53:47the monitor mode. So type sudo

1:53:51airmon nng. Airmon nng is part of the

1:53:54air crack suite. It is used for

1:53:58controlling the monitor mode including

1:54:01enabling and disabling it. Now before

1:54:04enabling the monitor mode, we need to

1:54:07check for processes that might cause

1:54:10problems later. There are certain

1:54:13processes that might put your card back

1:54:16to the managed mode from monitor mode.

1:54:20So let's check those processes. Pass

1:54:22check parameter. It will list those

1:54:24processes. Press enter. As you can see,

1:54:28found two processes that could cause

1:54:30problems. Now we need to terminate these

1:54:33processes. It is easy. After check type

1:54:36kill, kill parameter is going to kill or

1:54:39terminate those processes. Press enter.

1:54:42As you can see this process has been

1:54:45terminated. Now we are good to go. Type

1:54:48sudo demon space type start space. Now

1:54:54specify the name of your wireless card

1:54:57that you want to put into the monitor

1:55:00mode. For me, it is WLAN0. Now, Airmon

1:55:03NG is going to start the monitor mode on

1:55:07this specified wireless card. WLAN 0.

1:55:12Press enter. As you can see, monitor

1:55:15mode enabled for WLAN 0 on WLAN0

1:55:20mon. It means that the specified

1:55:23wireless card WLAN0 has been put into

1:55:26the monitor mode under uh the new name

1:55:30WLAN0

1:55:32mon. And if you want to use or access

1:55:36the monitor mode, then we have to use

1:55:39this name WLAN 0 M O N or whatever name

1:55:43it is after this particular part. Now

1:55:47let's actually verify whether the card

1:55:49is in monitor mode or not. Type ip space

1:55:53a at the bottom. As you can see wlan

1:55:56zero mon the card is indeed in the

1:55:59monitor mode. We can also use iw config

1:56:03command to verify the monitor mode.

1:56:06Press enter. As you can see mode

1:56:09monitor. Now once your card is in

1:56:12monitor mode, you can't use it for

1:56:15general purpose like connecting to the

1:56:18Wi-Fi networks. In monitor mode, we can

1:56:20capture traffic and monitor all the

1:56:23Wi-Fi networks within your network cards

1:56:27range. We will do that in the next

1:56:30video. Now, let's learn how to put your

1:56:33card back to the managed mode. At some

1:56:36point you will need to put your card

1:56:39back to the managed mode right once you

1:56:42are done with uh Wi-Fi pen testing. So

1:56:45type sudo

1:56:48airmon ng stop. Now type name of your

1:56:53monitor mode which is w lan 0 m o n for

1:56:58me. Now airmon ng is going to stop the

1:57:01monitor mode w0

1:57:04mon. Press enter. As you can see guys,

1:57:07monitor mode disabled for WLAN0.

1:57:11And now let me list interfaces IP space

1:57:15A. As you can see guys, the card is back

1:57:19to the managed mode. Uh let me actually

1:57:23type Iw config. Press enter. As you can

1:57:27see mode managed. Now after putting your

1:57:31card back to the managed mode, you

1:57:34should always restart your network

1:57:36manager. So type sudo system sorry

1:57:41systemctl

1:57:42space restart type network

1:57:48manager. Make sure that n is in

1:57:51uppercase and m also must be in

1:57:54uppercase. Now what this command is

1:57:56going to do, it will reset your network

1:57:59configurations, fix common problems and

1:58:02your card will become ready to be used

1:58:05in managed mode. Press enter. Now

1:58:10command has been executed successfully.

1:58:13Now click on your uh network icon. As

1:58:16you can see guys, now my wireless card

1:58:19is up and running. That's it for this

1:58:22video guys. Thank you very much for

Scan Wi-Fi Networks & Capture Traffic

1:58:23watching. In this video, we will learn

1:58:25how to detect or discover Wi-Fi networks

1:58:29within your network adapters range,

1:58:33explore the fundamentals of Aerodyump NG

1:58:35scan, and save the network traffic to a

1:58:39file. This is definitely going to be an

1:58:42exciting and informative video. So,

1:58:45let's dive into the practicals. The

1:58:48first thing that you are going to do is

1:58:50put your wireless network adapter into

1:58:54the monitor mode. I have already enabled

1:58:57monitor mode. Let me verify that. Type

1:59:00IP space A. Press enter. As you can see,

1:59:03WLAN0. My card is already in the monitor

1:59:07mode. We need the monitor mode for

1:59:10capturing wireless network traffic and

1:59:13discovering Wi-Fi networks. Once your

1:59:16card is in monitor mode, we are good to

1:59:19go. Now type sudo

1:59:22aerodyump nng. Aerodyump nng is also

1:59:26part of the air crack suite. Aerodyump

1:59:30is a powerful tool used for capturing

1:59:33wireless network traffic. It also

1:59:36discovers and displays information about

1:59:39the nearby Wi-Fi networks. Now after

1:59:43aerodyump specify name of your monitor

1:59:46mode which is WL0 mon for me. Now this

1:59:50particular aerodyump command is going to

1:59:53discover and display information about

1:59:57all the available Wi-Fi networks within

2:00:00the range of your wireless card. Let me

2:00:03press enter. As you can see guys, the

2:00:06aerodyump is scanning for the nearby

2:00:09Wi-Fi networks. It scans and lists all

2:00:14the nearby Wi-Fi networks within the

2:00:17range of your wireless card. Now, we

2:00:20have a lot of information here, right? I

2:00:23will break down everything. We have two

2:00:25sections here. In the first half, it

2:00:28displays all the Wi-Fi networks that it

2:00:31has detected along with their

2:00:34information. In the bottom half, it

2:00:36displays the devices that are connected

2:00:39to these Wi-Fi networks. Now, first

2:00:42thing that we have to understand is what

2:00:46all these columns mean, what information

2:00:50they represent. Now, the first field is

2:00:53BSS ID. BSS ID refers to the MAC

2:00:57address. Each wireless access point or

2:01:00wireless router has a MAC address. For

2:01:03example, the MAC address for uh the

2:01:05network cyborg is this. Then we have

2:01:08PVR. PVR indicates the signal strength.

2:01:12It basically tells us how close uh we

2:01:15are to a Wi-Fi network. If the PVR value

2:01:20is around 70 or above 70, then it means

2:01:24the signal strength is weak. If it is

2:01:28below 60, then uh the signal strength is

2:01:31considered average. And if this value is

2:01:34below 40 then it means the signal

2:01:37strength is strong. You are close to a

2:01:40Wi-Fi network or you have a very

2:01:43powerful wireless card. Then we have

2:01:46beacons column. It displays the total

2:01:50beacon packets that a Wi-Fi network has

2:01:53transmitted. A Wi-Fi network uses beacon

2:01:57packets to announce its presence. On

2:02:01average, a Wi-Fi network sends around 10

2:02:04beacon packets per second. In simple

2:02:06terms, through beacon packets, a Wi-Fi

2:02:09network basically tells the nearby

2:02:11wireless devices, I am available. You

2:02:14can connect to me if you have the proper

2:02:17authority. Then we have data column. It

2:02:21displays the number of packets captured

2:02:24by the network card on each listed

2:02:28network. Here remember guys, aerodyump

2:02:30is capturing or listening to the network

2:02:34traffic of each network that it has

2:02:37detected or listed. Here later in the

2:02:40video I will demonstrate how to save the

2:02:43captured packets. Data field helps us to

2:02:47understand the amount of data traffic on

2:02:50the network. And next is forward slash

2:02:54s. It stands for seconds. It shows the

2:02:57average number of data packets a network

2:03:00has transmitted each second calculated

2:03:04over the last 10 seconds. And then we

2:03:07have CH. CH stands for channel number.

2:03:11It displays the channel number on which

2:03:14the wireless access point or wireless

2:03:17network is operating. Then we have MB.

2:03:21MB displays the maximum speed supported

2:03:25by a Wi-Fi network. And next is ENC. ENC

2:03:30is short for encryption. It indicates

2:03:33the type of encryption protocol the

2:03:36network uses for encrypting packets. 95%

2:03:41of networks still use WPA2. Although

2:03:44WPA3 is available which is updated

2:03:47version of WPA2, it is considered more

2:03:51secure. However, WPA2 remains the most

2:03:54widely used encryption protocol with

2:03:57over 95% of networks still using it.

2:04:02WPA2 makes sure that data sent or

2:04:05received over a wireless network is

2:04:08encrypted. And next is cipher. Cipher

2:04:12refers to the specific algorithm used

2:04:14for encrypting and decrypting data

2:04:18within the encryption process. CCMP is

2:04:21specifically used with WPA2. It offers

2:04:25significantly more security compared to

2:04:29older protocols like WP and TKIP used in

2:04:34WPA. And next is O A U T. O refers to

2:04:39the authentication method used to

2:04:42protect against unauthorized access to

2:04:45the network. It specifies how devices

2:04:48are authenticated before being allowed

2:04:51to connect to the network. PSK stands

2:04:54for pre-shared key indicating that the

2:04:58Wi-Fi network utilizes a shared

2:05:00password. All users are required to use

2:05:04the common network password to connect

2:05:07to the network. To access the PSK Wi-Fi

2:05:11network, you will need to enter the

2:05:14correct Wi-Fi password. And the last

2:05:16column is ESS ID. It basically displays

2:05:20the name of Wi-Fi networks. Here we have

2:05:23two Wi-Fi networks, Cyborg and Sunny.

2:05:27And in the bottom half a dump displays

2:05:30devices that are connected to these

2:05:33Wi-Fi networks. First column BSS ID it

2:05:36displays MAC address of the wireless

2:05:39access point or wireless router. And

2:05:41station column displays MAC address of

2:05:44the device which is connected to a

2:05:47network. For example, this MAC address

2:05:51or wireless device is connected to this

2:05:55Wi-Fi network. And if a device is not

2:05:59connected to any Wi-Fi network, then you

2:06:02will see something like not associated.

2:06:05Not associated means the wireless device

2:06:08has not connected to any Wi-Fi network.

2:06:11It is still searching for Wi-Fi networks

2:06:14to connect. Now like I discussed earlier

2:06:17we can save the packets that aerodyump

2:06:21is listening or capturing. Now here the

2:06:24aerodyump is basically listening to the

2:06:27traffic of all these detected devices.

2:06:30We can save the traffic that it is

2:06:32capturing to a file. So press control +

2:06:35c to exit out of aerodyump. Okay. So

2:06:38type aerodyump ng wl0mon

2:06:42then type write. Write parameter allows

2:06:45us to specify the file name where you

2:06:49want to save the captured packets. Now

2:06:53you can specify a specific directory

2:06:55where you want to save. If you don't

2:06:58specify any specific directory then it

2:07:01will save the files in your current

2:07:04working directory. Now provide a file

2:07:07name. Let's say captured

2:07:10packets.

2:07:12Now Airdump is going to monitor the

2:07:14network traffic of all the Wi-Fi

2:07:18networks within its range and then save

2:07:21the traffic into this specified file

2:07:23captured packets. The files will be

2:07:26saved in your current working directory.

2:07:29Let me press enter.

2:07:32Now let me exit out of uh a dump by

2:07:36pressing control + C. Now type ls. As

2:07:39you can see, Aerodyump has created these

2:07:41different files. Aerodyump basically

2:07:44saves uh captured packets in different

2:07:47files. We have files with CAP extension

2:07:51CSV

2:07:52net XML ATC. However, only relevant file

2:07:56for us is this cap. We can open the cap

2:08:01files in Wireshark. Let's actually do

2:08:03that. type wireshark space and then

2:08:07specify the file name that you want to

2:08:09open. Now what Wireshark is going to do,

2:08:11it will open uh this specified file. Let

2:08:15me press enter.

2:08:18As you can see guys, inside uh this file

2:08:21we have the packets that the AOD dump

2:08:25captured. So guys, that's how you can

2:08:28save the captured packets uh to a file.

2:08:33So that's it for this video guys. Thank

2:08:35you very much for watching. In this

Scan 5GHz Wi-Fi Networks (Theory)

2:08:37video we will learn how to scan Wi-Fi

2:08:40networks operating on the 5 GHz

2:08:43frequency band. This is a theoretical

2:08:45video. Practical aspects will be

2:08:48demonstrated in the next video. There

2:08:51are certain things about 5 GHz networks

2:08:54that we need to understand before diving

2:08:57into the practical aspects. By default,

2:09:00a dump only scans and list networks in

2:09:04the 2.4 GHz band as we saw in the

2:09:08previous video. Now, what if a network

2:09:11is using only the 5 GHz band? Most

2:09:16networks use dual bands, but some

2:09:19specifically use only 5 GHz frequency

2:09:23band. To scan the 5 GHz networks, we

2:09:26have to use the band option in Aerodyump

2:09:29NG. Remember, this is important to scan

2:09:32or discover 5 GHz networks. Your network

2:09:36card must also support the 5 GHz band.

2:09:40That's the prerequisite. Now, we need to

2:09:43use the band parameter with a dump to

2:09:46scan for 5 GHz networks. The band option

2:09:50allows you to specify different bands or

2:09:54a combination of bands that you want to

2:09:57scan. Aerodyump supports two bands 2.4

2:10:00GHz and 5 GHz. We can also combine both

2:10:05which enables us to scan for both 2.4

2:10:08and 5 GHz networks. Now to scan and list

2:10:125 GHz networks, we need to use band a

2:10:16parameter with aerodyump. The letter A

2:10:20represents the 5 GHz band. We will

2:10:23demonstrate this practically in the next

2:10:25video. There are other options for the

2:10:28band parameter as well. B represents 2.4

2:10:31GHz band using the old 802.11b

2:10:36standard and G represents the 2.4 GHz

2:10:41band using the 802.11g

2:10:44standard which is more common. G is also

2:10:47the default mode. If you don't specify

2:10:49any bands, by default, a dump runs with

2:10:53the G option. And if you want to scan

2:10:56for both bands, you can use band AG

2:11:00option. Remember, specifying multiple

2:11:02bands can increase workload on your

2:11:05system and potentially slow down

2:11:07scanning. We will continue where we left

Scan 5GHz Wi-Fi Networks (Practical)

2:11:10off in the previous video. So in this

2:11:13video I will demonstrate how to scan for

2:11:165 GHz networks practically also how to

2:11:20scan for both 2.4 and 5 GHz networks

2:11:25simultaneously. Now let's dive into the

2:11:27practicals. So type sudo

2:11:31aerodyump ng space two hyphens type

2:11:35band. The band parameter allows us to

2:11:39specify the frequency band that you want

2:11:43to scan for. I want to scan the 5 GHz

2:11:47frequency band or Wi-Fi networks. Uh so

2:11:50type A. As we discussed in the previous

2:11:53video, A represents the 5 GHz frequency

2:11:58band. Now specify name of the monitor

2:12:01mode which is WLAN 0 mon. Now this

2:12:05particular aerodyump command is only

2:12:08going to discover and display the 5 GHz

2:12:13Wi-Fi networks or Wi-Fi networks using

2:12:16the 5 GHz frequency band. Remember guys,

2:12:20your wireless network adapter must

2:12:23support the 5 GHz band. Then only the

2:12:28Aerodyump will be able to scan and list

2:12:31the 5 GHz networks. Press enter. As you

2:12:35can see, Aerodyump has uh detected the 5

2:12:38GHz network. Uh it is still scanning. If

2:12:41it finds other 5 GHz Wi-Fi networks,

2:12:45then those will be listed as well. Now,

2:12:48how do you exactly know whether

2:12:51Aerodyump is scanning the 5 GHz networks

2:12:55or frequency band? Well, check out this

2:12:58particular section CH. It is showing the

2:13:02range of uh channels that it is

2:13:05scanning. The range of 5 GHz channels is

2:13:10from 36 to 165. On the other hand, range

2:13:14of 2.4 GHz channels is from 1 to 14. As

2:13:20you can tell, it is scanning between 36

2:13:24to 165. So guys, that's how you can scan

2:13:28and detect only 5 GHz networks. Now, I

2:13:33live in a very remote area, that's why I

2:13:36only have uh very few 5 GHz Wi-Fi

2:13:40networks. If you live in a densely

2:13:43populated area, then you might see a lot

2:13:46of 5 GHz networks. Now, let's scan the

2:13:522.4 GHz networks. I'm going to exit out

2:13:55of a dump by pressing Ctrl + C. Now, by

2:13:59default, the Aerodyump scans for the 2.4

2:14:03GHz networks. If you don't specify the

2:14:06band parameter, then by default, it is

2:14:09going to scan for 2.4 GHz networks.

2:14:12However, you can explicitly specify if

2:14:16you want to scan the 2.4 GHz band. So

2:14:21type band and specify G. G represents

2:14:24the 2.4 GHz band. Press enter. As you

2:14:28can see, this time it is only scanning

2:14:31the networks that use 2.4 GHz frequency

2:14:35band. As you can see the channel

2:14:37section. Now let's scan both 2.4 and 5

2:14:41GHz bands. To scan both, we need to

2:14:45provide A and G values to the band

2:14:48parameter. As you can see, I have

2:14:49specified A which represents 5 GHz and G

2:14:54which represents the 2.4 GHz frequency

2:14:58band. Now, this particular command is

2:15:00going to scan for both 2.4 and 5 GHz

2:15:05Wi-Fi networks. Remember guys, when you

2:15:08scan the multiple bands, it also

2:15:11increases the load on your system

2:15:14resources like RAM and processor. Press

2:15:17enter. Now check out the channels

2:15:20section. It is scanning the both bands

2:15:24from 1 to 14 and 36 to 165. That's how

2:15:28guys you can scan a particular band or

2:15:31multiple bands. That's it for this video

2:15:34guys. Thank you very much for watching.

2:15:35In this video we are going to discuss

What is a 4-Way Handshake

2:15:38the four-way handshake. In a wireless

2:15:41network, data is transmitted through the

2:15:45air using radio waves. Right? Since the

2:15:48data travels through the air, it is

2:15:51always vulnerable to interception. If

2:15:55the network is not properly protected,

2:15:59hackers can easily intercept and steal

2:16:02your information by capturing the

2:16:05unencrypted or unprotected data. This

2:16:09can lead to compromised devices and

2:16:13stolen personal information across the

2:16:16network. Therefore, we need a mechanism

2:16:19to protect the data. As we have seen in

2:16:22the previous video, data can easily be

2:16:25intercepted. This is where the four-way

2:16:28handshake comes in. It refers to the

2:16:32initial exchange of four packets between

2:16:36a client device like your laptop or

2:16:39phone and a wireless access point you

2:16:42are trying to connect to. As we

2:16:45discussed in the cryptography section,

2:16:48keys or encryption keys are used to

2:16:52encrypt data, right? So to encrypt

2:16:55wireless data, we need encryption keys.

2:16:59The four-way handshake is the process of

2:17:02generating encryption keys. Encryption

2:17:05keys generated by a successful four-way

2:17:09handshake are also known as session

2:17:12keys. The keys generated during the

2:17:16four-way handshake are used to encrypt

2:17:19data between the client device and

2:17:22wireless access point. The four-way

2:17:25handshake establishes a secure

2:17:27connection between client device and a

2:17:30wireless network so they can communicate

2:17:34securely over an encrypted channel.

2:17:37After a successful four-way handshake,

2:17:39the client device and the wireless

2:17:42access point can communicate securely.

2:17:45This allows the client to access the

2:17:48internet securely. data gets encrypted

2:17:51and even if attackers intercept this

2:17:54encrypted data they will only see

2:17:58scrambled or encrypted information not

2:18:01the original data itself. Now to hack a

2:18:05Wi-Fi network we need to capture

2:18:08four-way handshake. Capturing four-way

2:18:10handshake is essential. Four-way

2:18:13handshake contains all the necessary

2:18:16details to initiate the password

2:18:19cracking process. By capturing we main

2:18:22intercepting a successful four-way

2:18:25handshake. The four-way handshake is

2:18:28essentially the exchange of four packets

2:18:31between a client device and a wireless

2:18:35router or wireless access point. We need

2:18:38to intercept four packets of four-way

2:18:42handshake to initiate the password

2:18:45cracking. The encryption keys used to

2:18:49encrypt traffic are derived from a

2:18:52combination of Wi-Fi password, SSD, MAC

2:18:57address of the access point, MAC address

2:19:00of the client and nons values among

2:19:03other elements. All this information is

2:19:06used to generate the encryption keys or

2:19:10session keys. These elements undergo a

2:19:13cryptographic function to generate

2:19:15session keys which encrypt data during

2:19:19the Wi-Fi session. It is important to

2:19:22note that these elements are not

2:19:25directly combined to generate session or

2:19:28encryption keys. Instead, they go

2:19:31through four distinct steps within

2:19:34four-way handshake processor. I'm not

2:19:37going to cover the entire four-way

2:19:39handshake in detail because it requires

2:19:42a separate crash course to fully

2:19:44understand it. To crack Wi-Fi password

2:19:47and learn the process, you don't need to

2:19:51understand the exact steps. They are not

2:19:55essential at all. understanding the

2:19:58concept and its function is sufficient.

Capture a 4-Way Handshake

2:20:02This video is going to be very

2:20:04important. In this video, we will

2:20:06capture a four-way handshake. Capturing

2:20:10a valid four-way handshake is essential

2:20:13for cracking the password. Without a

2:20:16valid four-way handshake, we can't

2:20:18initiate the password cracking process.

2:20:21First we need to capture the four-way

2:20:24handshake and save it to a file. Once

2:20:27captured then this file can be used to

2:20:31launch the password cracking attack.

2:20:34First thing that we need to do is

2:20:38collect some essential information about

2:20:41the target network. We need certain

2:20:44information to hack or test a Wi-Fi

2:20:48network such as its MAC address and

2:20:51channel number. So type sudo

2:20:56aerot dump ng. Now specify name of your

2:21:00monitor mode which is w0 m o n for me.

2:21:04Now, a dump command is going to discover

2:21:07and display all the available Wi-Fi

2:21:10networks within the range of my wireless

2:21:14network adapter. Press enter. Now, keep

2:21:18scanning until your target network

2:21:21appears in this list. As you can see, my

2:21:25target network has already been

2:21:27detected, which is this Sunny. I'm going

2:21:30to test or hack my own Wi-Fi network.

2:21:34Once your target network gets detected,

2:21:37then you can exit the AO dump. Now I'm

2:21:40going to note down the MAC address and

2:21:43channel number of my target network in a

2:21:47file. So let me open a new terminal tab

2:21:50and I'm going to open nano to note down

2:21:53the details. MAC address

2:21:56and channel number.

2:21:59Let me copy the MAC address. This is the

2:22:04MAC address of my target network which

2:22:07is Sunny. Let me paste it here.

2:22:12And the channel number is 9. Now we need

2:22:16to monitor the network traffic of our

2:22:20target network. So type sudo space

2:22:28aotump nng space two hyphens bs ID bss

2:22:34ID refers to the MAC address. Now here

2:22:37we need to specify the MAC address of

2:22:41your target network. So what I'm going

2:22:45to do is uh copy the MAC address of my

2:22:49target network and paste it here. Now

2:22:53type- C hyphen C stands for channel. Now

2:22:57provide the channel number where your

2:22:59Wi-Fi network is broadcasting on. Mine

2:23:02is uh on 9

2:23:05space. Now specify the right parameter.

2:23:08Write parameter allows us to save the

2:23:11captured packets into a file. Now

2:23:14specify name of the file. I'm going to

2:23:17specify handshake.

2:23:20The aerodyump is going to save the

2:23:23packets that it captures in this uh

2:23:26specified file handshake. The file will

2:23:29be saved in your current working

2:23:32directory. Now what basically is going

2:23:34to happen the aerodyump is going to

2:23:38monitor or capture the network traffic

2:23:42of this particular Wi-Fi network. Then

2:23:46the packets that it captures will be

2:23:49saved to this file called handshake. And

2:23:53of course at the end you have to specify

2:23:55the monitor mode name which is wl0 m o n

2:23:59for me. Now press enter. As you can see

2:24:03guys, check out the channel. It is fixed

2:24:06at 9. So it is only capturing all the

2:24:09traffic going through this specified

2:24:12Wi-Fi network then saving that to the

2:24:16specified file which is handshake. Now

2:24:18the primary target of this video is to

2:24:21capture handshake. Right? So how to

2:24:23capture the four-way handshake? either a

2:24:27new device has to connect to the target

2:24:31network or an existing device has to

2:24:34disconnect then reconnect to the

2:24:37network. So as soon as a new device

2:24:40connects or reconnects to the network

2:24:43then the four-way handshake will be

2:24:47captured. Let me demonstrate this. What

2:24:49I'm going to do is I am already

2:24:52connected to my network, right? Let me

2:24:55disconnect from the network. Now, as

2:24:59soon as I reconnect, the four-way

2:25:01handshake will be captured. Let me

2:25:04reconnect.

2:25:07Uh, click on connect. As you can see,

2:25:10guys, WPA handshake, the four-way

2:25:12handshake for this Wi-Fi network has

2:25:17been captured. Now, we don't need to

2:25:20monitor the network traffic anymore.

2:25:24Once you capture the four-way handshake,

2:25:26you can exit. Press Ctrl + C to exit out

2:25:29of the AO dump. Now, let me ls. As you

2:25:32can see guys, we have handshake files

2:25:35with different formats like CSV, net XML

2:25:40and cap. Now, the file that we need is

2:25:44this handshake dot cap. We need this

2:25:47file to initiate the password cracking

2:25:51process. Before that we have to actually

2:25:53verify whether the four-way handshake is

2:25:57valid or not. It can be done using

2:26:00wireshark.

2:26:02Let me copy the handshake01.cap

2:26:06file. I'm going to open it in wireshark.

2:26:11So type wire chart. Paste the file name

2:26:13or type the file name. Press enter.

2:26:17Now in the filter bar type E A P O L

2:26:22press enter. Now E A P stands for

2:26:26extensible authentication protocol over

2:26:29LAN. It is a network communication

2:26:32protocol used for authenticating network

2:26:35devices. Now here as you can see we have

2:26:38four packets being exchanged between a

2:26:43wireless device and the Wi-Fi network.

2:26:46We have exact four packets. It means the

2:26:48four-way handshake was successful

2:26:51because a successful four-way handshake

2:26:53exchanges four packets between a

2:26:56wireless device and the Wi-Fi network or

2:26:59wireless access point. Now guys, this

2:27:03four-way handshake is extremely

2:27:06important. Four-way handshake is

2:27:08required to initiate the password

2:27:11cracking process. Okay. So, keep this

2:27:14handshake.

2:27:16file safe. We are going to need it later

2:27:19when we will crack the Wi-Fi password.

2:27:23Now guys, as you can tell, this method

2:27:26of capturing four-way handshake is not

2:27:29very efficient, right? We have to wait

2:27:32someone to connect to the network or uh

2:27:35someone to disconnect uh from the

2:27:38network then reconnect. It can be

2:27:40timeconsuming.

2:27:42We will address this problem in the next

2:27:44video. In this video, we will discuss

2:27:47the deauthentication attack which is

2:27:50essential for capturing four-way

2:27:53handshake and launching advanced attacks

2:27:56like evil twin attacks. Therefore, it is

What is a De-authentication Attack

2:27:59important to understand how it works. In

2:28:02the previous video, we captured a

2:28:05four-way handshake. Right? To capture

2:28:07four-way handshake, either a new device

2:28:11needs to connect to the network or an

2:28:15existing device needs to disconnect and

2:28:19then reconnect to the network. Right?

2:28:22Here we have an obvious problem. Right?

2:28:24In most cases, people are already

2:28:28connected to the network and new client

2:28:31devices may take a lot of time to

2:28:35connect. There you have to wait

2:28:38patiently. Now to address this problem,

2:28:41we have something called a

2:28:43deauthentication attack. A

2:28:45deauthentication attack works by

2:28:48disconnecting devices that are already

2:28:51connected to the network. In simpler

2:28:55terms, the deauthentication attack kicks

2:28:58off or disconnects devices from the

2:29:02network by sending deauthentication

2:29:05frames to all devices on the network.

2:29:08Once you disconnect devices, most

2:29:11devices reconnect automatically, right?

2:29:14So as soon as client reconnects whether

2:29:17manually or automatically the aerodyump

2:29:21captures four-way handshake

2:29:23deauthentication frames as we discussed

2:29:26in the fundamentals section are used to

2:29:30disconnect devices from the network. How

2:29:33a deauthentication attack basically

2:29:35works? The attackers pretend to be the

2:29:39router or access point by spoofing the

2:29:43router's MAC address and SSID or its

2:29:47name. They then send the authentication

2:29:50frames to the devices connected to the

2:29:54network on behalf of the router. The

2:29:57attacker uses router's MAC address and

2:30:00sends the authentication frames to the

2:30:03connected devices. When client devices

2:30:07receive deauthentication frames, they

2:30:10assume the frames are sent by the router

2:30:14or network. They immediately disconnect

2:30:18as soon as they receive the

2:30:20deauthentication frames. And when the

2:30:23user or client device reconnects, the

2:30:27four-way handshake gets captured. There

2:30:30is no default mechanism to verify

2:30:34whether the frames are coming from a

2:30:37legitimate router or attackers. Only

2:30:40latest 802.11x

2:30:43standard has automatic protection

2:30:45against deauthentication frames by

2:30:48default. That's how deauthentication

2:30:51attack works and is used by hackers.

Capture 4-Way Handshake Using De-authentication Attack

2:30:55We will continue where we left off in

2:30:58the previous video. In this video, we

2:31:00will learn how to capture the four-way

2:31:03handshake using the deauthentication

2:31:05attack and also fix the common errors

2:31:09you may encounter during the

2:31:11deauthentication attack. A

2:31:13deauthentication attack serves two

2:31:16purposes. One, capturing the four-way

2:31:18handshake and two, disrupting the

2:31:21network services. Now, let's dive into

2:31:24the practicals. Make sure that your

2:31:27wireless card is in monitor mode. I have

2:31:30already enabled monitor mode. Let me

2:31:33verify that. Type IP space A. Press

2:31:36enter. As you can see, WL0,

2:31:39my card is already in monitor mode. Once

2:31:42your card is in monitor mode, we should

2:31:44be good to go. First thing that I'm

2:31:46going to do is collect the MAC address

2:31:48and channel number of my target network.

2:31:52We are going to need both for launching

2:31:55a deauthentication attack as well as

2:31:57monitoring the traffic of my target

2:32:00network which will help us to capture

2:32:02the four-way handshake. So type sudo

2:32:06aerodyump sorry a dump ng space. Now

2:32:11specify name of uh your monitor mode

2:32:14which is wl0mon for me. Press enter. Now

2:32:18keep scanning until your target network

2:32:21appears in this list. And mine has

2:32:25already been detected. As you can see,

2:32:27my target network is Sunny. Press

2:32:30control + C to exit out of a dump. I'm

2:32:33going to note down the MAC address and

2:32:36channel number of my target network. So

2:32:40let me copy the MAC address

2:32:43and I'm going to open a new terminal

2:32:46tab. type nano and uh I'm going to note

2:32:51down the details in this uh file. Press

2:32:55control shift + v to paste

2:32:59and the channel number is uh five.

2:33:06Now I'm going to monitor the traffic of

2:33:09my target network. So type sudo

2:33:12aerodyump space

2:33:16type ps ID. Now

2:33:19copy and paste the MAC address of of

2:33:23your target network. After BSS ID paste

2:33:27the MAC address.

2:33:29Now type C. C is for channel number. Now

2:33:34type the channel number of your target

2:33:36network which is five for me. Space. Now

2:33:40type write. The write parameter as we

2:33:42already discussed in the previous

2:33:44practical video. It allows us to save

2:33:47the packets that Aerodyump captures to a

2:33:50file. So specify a file name where you

2:33:53want to save the packets. Four-way

2:33:58handshake. By default this file will be

2:34:01saved in my current working directory.

2:34:04And the last thing that uh a dump needs

2:34:07is the name of your monitor mode which

2:34:09is WLAN0 mon for me. So this particular

2:34:13aerodyump command is going to monitor

2:34:15the traffic of this specified Wi-Fi

2:34:18network and the packets that it captures

2:34:22will be saved to this specified file

2:34:254-way handshake. Now press enter. As you

2:34:29can see, it is capturing the packets and

2:34:32saving them into the specified file.

2:34:35Now, we need to launch the

2:34:37deauthentication attack. So, keep this

2:34:40aodm command running. I'm going to open

2:34:43a new terminal tab. Now, to execute the

2:34:46deauthentication attack effectively, we

2:34:48need to configure the network card to

2:34:51the channel number where the target

2:34:54network is operating. Sometimes you will

2:34:56encounter errors like WLAN zero mon is

2:34:59on channel N and AP uses another

2:35:03channel. To fix this problem, we need to

2:35:06set the wireless card to the channel

2:35:09number of your target network. So type

2:35:13uh sudo IW config space. Now specify

2:35:19name of your uh monitor mode. Then

2:35:22channel. Now type the channel number

2:35:24where your target network is operating.

2:35:27For me it is five.

2:35:30This command is going to configure the

2:35:33wireless card to listen on channel

2:35:36number five or whatever channel number

2:35:38you specify. It will stick to this

2:35:41specific channel number and won't hope

2:35:44to others. Now press enter. Provide your

2:35:47password and the command has been

2:35:50executed successfully. Now we are ready

2:35:52to launch the deauthentication attack.

2:35:55So type sudo airplayng. Now airplane is

2:35:59also part of the air crack suite. It is

2:36:02used for uh generating deauthentication

2:36:06packets or frames. Now space two hyphens

2:36:10type de

2:36:12parameter allows us to generate

2:36:15deauthentication packets. Now you have

2:36:18to uh tell the o parameter how many deau

2:36:21authentication packets you want to

2:36:24generate. Let's say 100. So the o will

2:36:27generate 100 de authentication packets

2:36:29or whatever number you specify here. Now

2:36:32type a. A is for access point. Now we

2:36:36need to specify the MAC address of the

2:36:39access point or target network. And let

2:36:44me copy the MAC address of my target

2:36:47network and paste it here. Now type WLAN

2:36:52zero. Type the name of your monitor

2:36:55mode. So that's all the AirPlay NG

2:36:58command needs. Now let me break down

2:37:00this entire command. The AirPlay NG is

2:37:03going to generate 100 deauthentication

2:37:07packets. Then send those packets to the

2:37:11devices that are connected to this Wi-Fi

2:37:15network or access point. And when the

2:37:18devices receive the deauthentication

2:37:22packets, they will automatically

2:37:24disconnect. And when they reconnect then

2:37:28the aerodyump is going to capture the

2:37:30four-way handshake because we are

2:37:33monitoring the traffic of that network.

2:37:36Right? Make sure that uh the aerodyump

2:37:39command is running now. Let me press

2:37:42enter. As you can see guys, it is

2:37:44sending the de authentication packets to

2:37:47this uh Wi-Fi network.

2:37:50Now as you can see guys, my device has

2:37:52been disconnected. Now what happens if I

2:37:56reconnect to my network? Let me switch

2:37:58to Aerodyump. Let me reconnect to my

2:38:01network.

2:38:03Click on connect. Now it is not able to

2:38:06reconnect because the deauthentication

2:38:10attack is still going on. As you can

2:38:12see, as long as this deauthentication

2:38:14attack is uh ongoing, devices will not

2:38:18be able to connect or reconnect to the

2:38:21network. Let me attempt to reconnect

2:38:24again.

2:38:27Now the authentication attack will stop

2:38:30uh after sending the 100 packets. As you

2:38:34can see it has sent the 100 packets. Now

2:38:37let me attempt to reconnect. Now it

2:38:40should work.

2:38:42Click on connect. As you can see guys,

2:38:44it has successfully captured the

2:38:48four-way handshake. So guys, that's how

2:38:50the deauthentication attack works. It

2:38:54sends the deauthentication packets to

2:38:57the devices connected to your target

2:39:00network and forces them to disconnect.

2:39:04And when they reconnect, the aerodyump

2:39:07captures the four-way handshake. Now

2:39:10that we have captured four-way

2:39:11handshake, we don't need to a dump keep

2:39:14running. So I'm going to exit it by

2:39:16pressing Ctrl + C again. Back to the

2:39:20back to the deauthentication attack. The

2:39:23number that you specify after de

2:39:26parameter, it will generate and send

2:39:29those many packets. If I specify let's

2:39:31say uh 10,000, then it will generate

2:39:3410,000 deauthentication packets. Now

2:39:38there is another way to execute the same

Wordlists & Dictionary Attacks

2:39:40deauthentication attack. What you can do

2:39:43is specify zero -0 then zero. Now what

2:39:48airplane is going to do the -0 is short

2:39:53for the o parameter and when you provide

2:39:56the value zero then air play nng is

2:40:00going to send unlimited or infinite

2:40:04deauthentication packets. Let me press

2:40:06enter. Now it is going to keep sending

2:40:10the deauthentication packets unless you

2:40:14stop it manually. Right? So to stop uh

2:40:16this uh deauthentication attack you have

2:40:18to exit manually. So press Ctrl C to

2:40:22exit out of the airplane ng as I

2:40:24mentioned the -0

2:40:28is short for the o parameter. You can

2:40:31also specify a specific number to it.

2:40:35Let's say five six. It will generate six

2:40:38deauthentication packets this time and

2:40:42it should stop after generating six

2:40:44deauthentication packets as you can see.

2:40:46So guys that's how you can execute a

2:40:48deau authentication attack. Now let me

2:40:51type ls. As you can see guys the aot

2:40:54dump has generated all these files. The

2:40:58only file that we are going to need is

2:41:01this file with cap extension. We will

2:41:05need this for cracking the Wi-Fi

2:41:08password or initiating the password

2:41:11cracking process. This is very very

2:41:12important. So what I'm going to do is

2:41:15copy this file to my desktop. Let me

2:41:18copy it. Type cp.

2:41:21And uh now specify the name of the

2:41:23destination directory. Desktop D is in

2:41:27uppercase. Press enter. Let me change my

2:41:30directory to desktop

2:41:33ls. As you can see here is the file. We

2:41:36are going to need this file for

2:41:38initiating the password cracking

2:41:40process. So make sure that you keep the

2:41:43four-way handshake file that you

2:41:46captured. In this video we will discuss

2:41:48several topics including what a word

2:41:51list is a dictionary and brute force

2:41:53attacks and how Wi-Fi password cracking

2:41:57works. Understanding these attacks is

2:42:00essential for both. protecting your

2:42:03network from such threats and

2:42:05effectively following the practical

2:42:08demonstrations in the next video. In a

2:42:10dictionary attack, a hacker attempts to

2:42:13crack the password by using a word list.

2:42:17Now, a word list is essentially a text

2:42:20file that contains thousands or even

2:42:23millions of potential passwords. There

2:42:26is a very popular word list called

2:42:29royu.txt.

2:42:30Rocky.txt word list contains millions of

2:42:34real world passwords. The passwords

2:42:37stored in the royu.txt

2:42:39come from multiple sources such as most

2:42:43commonly used passwords, weak passwords

2:42:46chosen by users, and passwords that were

2:42:50leaked online after a security breach.

2:42:53These passwords are still in use today.

2:42:57Most importantly, rocket.txt txt is not

2:42:59a list of random guesses but the actual

2:43:03passwords used in the real world.

2:43:06Similarly, all other word lists also use

2:43:09common passwords or those leaked after a

2:43:13breach. Let's briefly discuss how word

2:43:16lists are used to crack Wi-Fi passwords.

2:43:20The tool used for cracking Wi-Fi

2:43:22passwords is air crackng. Air crack uses

2:43:26a word list to crack the wireless

2:43:29network key or password. First, we need

2:43:33to capture a valid four-way handshake.

2:43:36Once the handshake is captured, a crack

2:43:39ng uses a word list to perform a

2:43:43dictionary attack. When a tool uses a

2:43:46word list to crack a password, it is

2:43:49called a dictionary attack. The way ear

2:43:52crackng works is it reads passwords from

2:43:56a word list then hashes each password

2:43:59using the same algorithm as the WPA2

2:44:03protocol. These hashed passwords are

2:44:06compared to the captured four-way

2:44:08handshake. If a match is found, the

2:44:12password is cracked. Remember in a

2:44:15dictionary attack the password can only

2:44:18be cracked if it is present in the word

2:44:21list. If the correct password is not

2:44:24there, the attack will fail. This is a

2:44:27very basic overview of how it all

2:44:30actually works. But it is enough for you

2:44:33to understand how the cracking works.

2:44:37Explaining everything in detail would

2:44:39require a crash course in cryptography

2:44:42which is beyond the scope of this

2:44:44course. Now let's discuss a brute force

2:44:46attack. A brute force attack involves

2:44:49trying every possible combination of

2:44:52characters or numbers for a password.

2:44:55For example, if a password is eight

2:44:58characters or digits long, a brute force

2:45:01attack would test all possible eight

2:45:04character or digit combinations until

2:45:06the correct password is found.

2:45:09Eventually, there will be one correct

2:45:11password among all possible

2:45:14combinations. Airng can perform both

2:45:17brute force and dictionary attacks.

2:45:19Dictionary and brute force attacks are

2:45:22different. A dictionary attack uses a

2:45:24pre-made list of common or leaked

2:45:28passwords to guess the correct password.

2:45:31On the other hand, a brute force attack

2:45:34tries every possible combination of

2:45:36characters until the correct password is

2:45:39found.

Crack / Recover Wi-Fi Password

2:45:40In this video, we are finally going to

2:45:43learn how to crack the Wi-Fi password or

2:45:46initiate the password cracking process.

2:45:50Before we do that, remember that you

2:45:52need a valid four-way handshake file to

2:45:56begin or start the password cracking

2:45:59process. I already have captured a valid

2:46:02four-way handshake. If you already have

2:46:04a valid four-way handshake file, then we

2:46:07are good to go. If you don't, you need

2:46:10to capture the four-way handshake first.

2:46:13It is an essential component required

2:46:16for password cracking. Now let's dive

2:46:19into the practicals. I have saved my

2:46:22four-way handshake file in my desktop.

2:46:25So I'm going to change my directory to

2:46:27desktop. I recommend you do the same.

2:46:30Switch your directory to where you have

2:46:33the four-way handshake file saved.

2:46:37LS as you can see here is my four-way

2:46:39handshake file. Now we are good to go.

2:46:41Type sudo air crackng. Air crack ng as

2:46:46the name suggests it is used for

2:46:49cracking passwords or Wi-Fi passwords to

2:46:52be specific. Now air crack needs minimum

2:46:56two options a valid four-way handshake

2:46:59and a word list. So first parameter that

2:47:02it needs is the four-way handshake. So

2:47:04specify name of the four-way handshake

2:47:07file. I'm going to copy it and paste it

2:47:11here. And if you have four-way handshake

2:47:15file stored in another directory, then

2:47:17specify path to that directory. Since I

2:47:21have four-way handshake file in my

2:47:23current working directory, I only need

2:47:25to specify the file name. Now, second

2:47:28parameter that it needs is the word list

2:47:31that you want to use for cracking the

2:47:34password. Kali Linux has many built-in

2:47:38word lists and one of them is royu.txt.

2:47:42Rockyu.txt is probably the most popular

2:47:45word list in world. So we have to

2:47:48specify the path to royu.txt. Before we

2:47:52do that, there are a few things that we

2:47:54need to do. Open a new terminal tab. We

2:47:59need to change directory to word lists.

2:48:02So type cd user share. The word lists

2:48:06are stored uh in this directory called

2:48:10word lists. This is the complete path.

2:48:13Press enter. ls here. As you can see

2:48:15guys, we have royu.txt.g

2:48:19file. For now, the royu.txt is zipped.

2:48:23In order to use royu.txt file, first we

2:48:27need to unzip it. Then we will be able

2:48:30to use it with airg or any other Kali

2:48:34Linux tool. To unzip type sudo

2:48:38gunzip space. Now specify name of the

2:48:42rocky.txt.gz

2:48:45file.

2:48:48Now gunip is going to unzip this

2:48:51rocky.ext.gz

2:48:53file. Press enter. It will take a few

2:48:57seconds to unzip.

2:49:00ls. As you can see guys, rocky.ext file

2:49:03has been unzipped. Now, Roku.ext has

2:49:07probably more than a million passwords.

2:49:10What I'm going to do is check how many

2:49:13passwords are stored in this rocky.txt

2:49:17file. So, let me pipe the output of cat

2:49:22command to wc command. So, type pipe

2:49:25character. Now, wc

2:49:28l press enter. As you can see guys, the

2:49:33rock.txt txt has over 1 million

2:49:37passwords. No, no, no, no. Not 1

2:49:39million, rather over 14 million

2:49:43passwords stored inside this royu.xt

2:49:47file. I can't view the passwords of

2:49:50royu.txt file because if I open uh this

2:49:53file, then the terminal will crash. The

2:49:56terminal will not be able to handle

2:49:59these many lines. But what I'm going to

2:50:02do is check the let's say first 10

2:50:06passwords. It is easy. Type cat

2:50:10rocket.txt. Pipe it to head command-

2:50:14n let's say 100. The head command is

2:50:17going to display the first 100 lines or

2:50:21passwords in this file. Press enter. As

2:50:24you can see guys, these are the

2:50:25passwords in the rocky.txt file. There

2:50:28are millions of such common passwords.

2:50:31Now we need to specify path to this

2:50:34rocky.txt file in air crackng. So back

2:50:38to the airrng. Now after providing the

2:50:42name of four-way handshake file specify

2:50:45w

2:50:46stands for word list. And now you have

2:50:48to specify path to the word list. So

2:50:51type forward slash user

2:50:55shareward slash

2:50:58word lists then rocku dot

2:51:02rocku.txt.

2:51:03Let me resize my terminal a bit. Now air

2:51:06crackng is going to initiate the

2:51:09password cracking process and it will

2:51:11use this uh specified word list. Make

2:51:14sure that you have provided a valid

2:51:16four-way handshake file and correct path

2:51:19to royu.txt. txt word list. Now press

2:51:22enter.

2:51:24As you can see guys, the air crack has

2:51:27started the cracking process. It is

2:51:30currently testing around uh 6 550 or 600

2:51:35passwords per second. But this number

2:51:39can be different and significantly

2:51:42higher for you if you have a high-end

2:51:45computer.

2:51:50As you can see guys, key found. This is

2:51:53what a cracked password looks like. This

2:51:57is the password of my Wi-Fi network. Now

2:52:01I can use this password or key to access

2:52:04my Wi-Fi network or access my cracked

2:52:08Wi-Fi network. Remember guys, the

2:52:10success of a dictionary attack depends

2:52:13on whether the password is in word list

2:52:16or not. If the password is in the word

2:52:19list, then it will be cracked. If not in

2:52:23the word list, then it won't be cracked.

2:52:27Now, passwords that contain only numbers

2:52:30are very easy to crack. In fact, a

2:52:33purely numerical password can be cracked

2:52:36within minutes without any problems.

2:52:40Like this, the numerical passwords are

2:52:42easiest and most vulnerable to cracking.

2:52:46However, if a password is stronger and

2:52:49includes numbers, letters, special

2:52:51characters, uppercase and lowerase

2:52:53characters, such passwords are very hard

2:52:56to crack. Often impossible to crack.

2:52:59Even passwords based on common

2:53:01characters can still be vulnerable, but

2:53:04it takes significantly longer time to

2:53:07crack. I know this is very simple. I

2:53:09just wanted to show you how to use a

2:53:12word list to crack passwords. We will

2:53:15use more effective and sophisticated

2:53:19password hacking techniques in the

2:53:21upcoming video. Thank you very much guys

2:53:24for sticking around. In the previous two

Detect De-authentication Attacks /Threats

2:53:26sections, we have seen how attackers can

2:53:28exploit or hack Wi-Fi networks using

2:53:32various methods. Right now, in this

2:53:34section, I will demonstrate how to

2:53:36detect and protect your network from all

2:53:40possible Wi-Fi attacks. This is the

2:53:42first video of the section. In this

2:53:44particular video, we will focus on

2:53:46detecting deauthentication attacks. The

2:53:50deauthentication attacks are central to

2:53:52both dictionary and able twin attacks.

2:53:55Right? The able twin attack specifically

2:53:58depends on a successful deauthentication

2:54:01attack to function properly. Without a

2:54:03successful deauthentication attack, the

2:54:06able twin attack is not impactful at

2:54:09all. Therefore, if we can detect the

2:54:13deauthentication attack, it makes

2:54:15safeguarding the network easier. In this

2:54:18video, we will learn how to detect

2:54:21deauthentication

2:54:22attacks using Wireshark. Now, let's jump

2:54:25into the practicals. I'm going to

2:54:27execute the deauthentication attack on

2:54:30my own network and then capture packets

2:54:35or deauthentication packets in

2:54:37Wireshark. Before we do that, we need

2:54:40some network details to launch the

2:54:43deauthentication attack such as the MAC

2:54:46address of the target network and the

2:54:48channel number where it is broadcasting

2:54:51on. Now, let me scan all Wi-Fi networks

2:54:54around me so I can note down the

2:54:56required details to launch the

2:54:59deauthentication attack.

2:55:02Aerodyump.

2:55:04Now specify the name of your monitor

2:55:06mode.

2:55:09As you can see guys, my target network

2:55:11has appeared in this list. This is the

2:55:14network sunny. I want to execute the

2:55:16authentication uh attack on my network.

2:55:19Now once your target network appears

2:55:21here, press control + C to exit. Now I'm

2:55:24going to open uh open a new terminal

2:55:27window and note down the details. MAC

2:55:31address. This is the MAC address of my

2:55:34target network.

2:55:38Now let me note on the channel number

2:55:42where it is broadcasting on. Channel

2:55:44number is 11. Now we need the MAC

2:55:47address. If you use the AirPlay NG to

2:55:50execute the authentication attack and if

2:55:52you use MDK4 then you only need channel

2:55:57number. I'm going to use the MDK4.

2:56:01So type sudo mdk4

2:56:05space specify the name of your monitor

2:56:08mode. Now d is for deauthentication

2:56:12attack. It launches the deauthentication

2:56:14attack. Now C is for channel number. You

2:56:18have to specify the the channel number

2:56:20where your target network is

2:56:22broadcasting on. For me it is 11. Now

2:56:25guys, before I execute this attack, I'm

2:56:28going to open my wire shark so we can

2:56:30capture the deauthentication packets.

2:56:34Later we will analyze those packets to

2:56:37identify the attack.

2:56:40And uh now in this uh window of

2:56:43interfaces you will see the monitor mode

2:56:46here as you can see WLAN zero mon. So

2:56:48click on double click on your monitor

2:56:50mode

2:56:52and as you can see wireshark has started

2:56:56capturing the network traffic. Remember

2:56:59the wireshark is capturing all the

2:57:01network traffic. So count for captured

2:57:04packets will easily go in thousands

2:57:06within a few seconds. Now let me execute

2:57:09the deauthentication attack. Let me

2:57:11press enter.

2:57:13As you can see, it is sending a plenty

2:57:16of deau authentication packets per

2:57:18second over thousand uh per second on

2:57:21average. Wireshark is capturing

2:57:23everything. So guys, when you put your

2:57:25card into the monitor mode, you will not

2:57:28be able to identify the deauthentication

2:57:31attack because wire sharkark literally

2:57:34captures all your network traffic. Now

2:57:37what I'm going to do is stop the

2:57:39capturing packets. Click on the red

2:57:41button and I'm going to stop the de

2:57:43authentication attack as well. So we

2:57:46literally have uh over 100,000 packets

2:57:50as you can see. Now detecting the

2:57:52deauthentication packets among these

2:57:55thousands of packets is very difficult.

2:57:58Here we can use something called a

2:58:00filter. We need to use the filter for

2:58:04displaying only the deauthentication

2:58:07packets. So filter for that is type wan0

2:58:12dot fc dot type underscore then sub type

2:58:20equal to 12. Now in management frames

2:58:24the subtype 12 represents the

2:58:26deauthentication frames and 11

2:58:29represents the authentication frames.

2:58:31Right? We discussed uh this in the

2:58:33fundamentals section. Now press enter.

2:58:37This filter will display only the

2:58:40deauthentication

2:58:42frames or packets. As you can see guys,

2:58:44under the info column, these are all

2:58:47deauthentication frames. We literally

2:58:49have thousands of deauthentication

2:58:52frames. So it is certainly a

2:58:55deauthentication attack, right? Remember

2:58:58a router or wireless access point never

2:59:01sends this many deauthentication frames.

2:59:04In case of some maintenance or

2:59:06troubleshooting, it typically sends

2:59:08maybe 50 or something deauthentication

2:59:11frames. But if the count for

2:59:13deauthentication frame is anything above

2:59:1650, then it certainly is a

2:59:18deauthentication attack. Now click on

2:59:22any deauthentication packet and at the

2:59:24bottom let me expand the 8011 deau

2:59:29authentication flags. Now here we have a

2:59:31field called type subtype de

2:59:33authentication in bracket we have a

2:59:36hexad decimal number 0x000000

2:59:39c. If you convert this hexad decimal

2:59:41number into binary sorry decimal you

2:59:43will get 12. Now here we have the

2:59:46transmitter address which is this this

2:59:49MAC address. Now if I go back to my

2:59:51details that I have noted down, as you

2:59:54can see guys, this is the same MAC

2:59:56address. It means the deauthentication

2:59:59frames are coming from this MAC address.

3:00:02This MAC address or device is uh sending

3:00:04the de authentication packets. Now this

3:00:07is the MAC address of the target router

3:00:11or target network. But here the router

3:00:14did not send these deauthentication

3:00:18frames, right? It is the attacker who

3:00:21basically masked or spoofed this MAC

3:00:24address then sent the deauthentication

3:00:26frames on behalf of the network or

3:00:30target network. So guys that's how you

3:00:32can basically detect the

3:00:34deauthentication

3:00:35frames in Wireshark. This is as easy as

3:00:39that. Now this method of detecting

3:00:42deauthentication attack is not very

3:00:46efficient because when you put your card

3:00:49into the monitor mode and capture

3:00:52packets using Wireshark, the Wireshark

3:00:55essentially captures thousands of

3:00:57packets, right? the account for captured

3:01:00packets will easily go in millions and

3:01:03uh at some point Wireshark will

3:01:05eventually crash if you keep capturing

3:01:08packets for a longer period of time. So

3:01:12in the next video I will show you an

3:01:15efficient way to detect the

3:01:18authentication attack.

3:01:22Wireshark is a complicated tool, right?

3:01:25So in this video I'm going to simplify

Wireshark Tutorial

3:01:28Wireshark for absolute beginners. So

3:01:31guys if you are you know someone who is

3:01:34new to Wireshark or struggling with it

3:01:37then trust me by the end of this video

3:01:40you will be able to use Wireshark

3:01:43efficiently.

3:01:46Wireshark is a special tool used for

3:01:48monitoring computer networks. Wireshark

3:01:52helps you to you to see what is

3:01:54happening when your computer sends and

3:01:57receives a data. It monitors or captures

3:02:01all the network traffic. Wireshark is is

3:02:04of course free and open-source tool.

3:02:09Wireshark is a must know tool for

3:02:12security analysis. It is often used to

3:02:15detect and analyze network security

3:02:18threats such as hacking attempts

3:02:20unauthorized access to sens sensitive

3:02:23data and it can easily identify attacks

3:02:26or suspicious traffic on your network.

3:02:30It is a go-to tool for cyber security

3:02:33analysts.

3:02:36Wireshark can be used to analyze network

3:02:40traffic in real time to identify and

3:02:43resolve network related problems such as

3:02:46slow performance, dropped packets and

3:02:49other connectivity related issues as

3:02:52well.

3:02:54Developers can use Wireshark to

3:02:57understand how protocols work and

3:03:00identify issues related to their

3:03:02implementation. These are just you know

3:03:05the main uses of Wireshark. It is a very

3:03:09vast tool. It can be used for you know

3:03:12many other things.

3:03:14Now to download and install Wireshark go

3:03:18to the wireshark.org

3:03:20click on download. Here we have files

3:03:23for Linux, Mac and Windows. So download

3:03:27the appropriate file according to your

3:03:29operating system. Here, as you can see,

3:03:32guys, uh we do not have files for 32-bit

3:03:35systems, right? This is because

3:03:37Wireshark 4.0 or higher versions do not

3:03:41support 32bit systems, right? So, if you

3:03:45have an older uh computer or 32-bit

3:03:48system, then you have to download this

3:03:51uh this file 3.6.1.

3:03:54So, click on this down arrow. From here

3:03:57you can download 32bit file for your

3:04:01operating system. And I'm not going to

3:04:03go through the installation steps

3:04:05because installation process is very

3:04:08simple on all operating systems on

3:04:11Windows. Make sure that you do not check

3:04:14or uncheck anything during the

3:04:16installation. Right? Keep clicking on

3:04:19next. Next, then your installation will

3:04:22be successful. If you come up with any

3:04:24problems dur during the installation or

3:04:27any part of the video then let me know

3:04:30in the comment section and I will

3:04:32happily answer everything.

3:04:38All right. So once your installation is

3:04:40complete then open your Wireshark

3:04:44and this is the welcome window of

3:04:46Wireshark. It displays all the installed

3:04:50network interface cards and this list is

3:04:53going to be different for everyone. Most

3:04:56likely you are not going to see all

3:04:58these you know uh local area connections

3:05:01because they are not real or physical

3:05:05cards. They are created by my virtual

3:05:08machines. Now there are two inbuilt

3:05:11network cards on each system. Ethernet

3:05:15and wireless card. Ethernet is simply

3:05:18represented by Ethernet on Windows and

3:05:22wireless card is represented by Wi-Fi

3:05:25and on Linux the wireless card is

3:05:28represented by WLAN0 and Ethernet is

3:05:32represented by ETH0 on most Linux uh

3:05:37distributions. Now to start capturing

3:05:39packets you have to select one of these

3:05:42physical network cards. Now which one

3:05:45exactly you have to select? Well, it

3:05:48depends on your connectivity, how you

3:05:51are connected to your uh network or how

3:05:54you are accessing the internet. I'm

3:05:56connected to my network through Wi-Fi or

3:05:59wireless card. So, I'm going to select

3:06:01Wi-Fi. As you can see, it is showing uh

3:06:04some spikes, right? These spikes are

3:06:07indicating that there are some, you

3:06:09know, activities going on this

3:06:11particular interface. We also have

3:06:14spikes on on adapter for loop back

3:06:16traffic interface as well. Well, this is

3:06:20uh the local host. It does not capture

3:06:23your network's traffic. It only, you

3:06:26know, monitors your uh system traffic.

3:06:28This is not that important. Again, guys,

3:06:31I'm going to uh select Wi-Fi to start

3:06:33capturing packets. So, double click on

3:06:36the appropriate interface.

3:06:39As you can see, Wireshark is capturing

3:06:42packets right at the top. You can see

3:06:45capturing from Wi-Fi. Right now, first

3:06:47thing that I'm going to do is explain

3:06:51what all these different sections or

3:06:54components mean, what information they

3:06:57represent. So, go to the view. View menu

3:07:01allows us to control uh the components

3:07:04that you want to appear in your display

3:07:07area. As you can see, Wireshark has

3:07:10already pre-selected some of the

3:07:12components for us. First three selected

3:07:15components are main toolbar, filter

3:07:17toolbar, and status bar. This is the

3:07:20main toolbar. It contains the functions

3:07:23that you are going to use on a regular

3:07:26basis. I will get back to all these

3:07:29functions later in the video. Then we

3:07:32have uh filter bar. This is the filter

3:07:34toolbar. Here you can type your filters.

3:07:37Filters are basically used to hide

3:07:39unnecessary traffic. I will get back to

3:07:42filters later as well. For now, just uh

3:07:45remember that if you want to type and

3:07:48apply uh the filters, then this is the

3:07:51place where you can type the filters.

3:07:54Then we have a status bar at the bottom.

3:07:57This is the status bar. As you can see,

3:07:59it basically gives you a brief summary

3:08:02of captured or lost packets. Then we

3:08:06have packet list. This section is called

3:08:10packet list. Packet list displays or

3:08:14contains all the captured packets. Every

3:08:17single packet that Wireshark captures is

3:08:21going to be displayed or listed here.

3:08:24And then we have packet details. As you

3:08:27can see guys, the packet list uh section

3:08:31only gives you a brief overview of each

3:08:35captured packet. Now if you want to

3:08:38analyze packets in detail then you can

3:08:41use packet details section. For example,

3:08:44I'm going to let me stop the session

3:08:46first. I'm going to click on packet

3:08:48number 139. Now down here packet details

3:08:52section is displaying a detailed

3:08:55information about the selected packet.

3:08:57As you can see frame number 139. Now

3:09:00here you can analyze uh the selected

3:09:02packet in detail. Now let me click on

3:09:05different packets. As you can see the

3:09:07information keeps changing as I click on

3:09:10different packets. Then we have packet

3:09:14bytes on your right side. This section

3:09:18or panel is called packet bytes. It

3:09:21displays information in its raw or

3:09:24original form. Right? As you can see the

3:09:27default format is hexadimal and you can

3:09:30also change it to to binary. So click on

3:09:33the blank space. Click on as bits. Now

3:09:35as you can see information is in raw

3:09:38binary. I'm going to revert back to the

3:09:41to the hexodimal format because it is a

3:09:44little more presentable than uh than

3:09:46binary. And if your packet contains uh

3:09:50plain textual information, then that

3:09:54information will also be displayed here

3:09:56as it is in its raw form. Now go to the

3:10:01view. Let's say you do not want packet

3:10:04byes section. Then click on this packet

3:10:07bytes or whatever you want to hide. Now

3:10:09as you can see it has been completely

3:10:11hidden. So to get it back go to the view

3:10:15again click on packet byes. Now it is

3:10:18back here. Now let me walk you through

3:10:21what all these uh columns mean. Right?

3:10:24So first column that we have is N O. N O

3:10:28is short for number. It basically

3:10:31displays the packet number. Each packet

3:10:34is going to have a unique number. As you

3:10:36can see the first packet that Wireshark

3:10:39captures uh is automatically assigned uh

3:10:42number one second packet two and so on.

3:10:45Then second column is time. Time uh time

3:10:49column displays the exact time when a

3:10:52packet was captured. Right? Now the

3:10:54default format for displaying time is

3:10:58not uh not you know that uh uh

3:11:00presentable right. So let's change it

3:11:04first. So go to the view now. Click on

3:11:08time display format from from first half

3:11:11select time of the day. Again go to the

3:11:14view time display format from uh lower

3:11:18half select seconds. Now as you can see

3:11:20we have a much better or presentable

3:11:23format for displaying the timing of

3:11:26captured packets. Then we have source. A

3:11:30source column displays the IP address of

3:11:33sender who has you know sent the packet.

3:11:37Destination column displays the IP

3:11:39address of uh receiver where the packet

3:11:42has been delivered. So let me select

3:11:45let's say packet number uh 30. Sender of

3:11:48the packet number 30 is this IP address

3:11:51192.68

3:11:52uh 68 and it has delivered this packet

3:11:56to uh this uh device 35

3:11:59uh 3. Then protocol column displays the

3:12:03packet type whether it is TCP, ICM, ICMP

3:12:06or UDP packet. Length column displays

3:12:10size of each packet in bytes. Info

3:12:15column it gives you a brief overview of

3:12:19each captured packet. So that's what all

3:12:22these columns mean. Now let's uh go

3:12:25through all the uh toolbar functions.

3:12:29Red button stops the current running

3:12:32session and first button from left

3:12:35starts a new session. So click on it. As

3:12:39you can see before starting a new

3:12:41session, Wireshark is asking me whether

3:12:43you want to save already captured

3:12:47packets. So I'm going to click on save.

3:12:50Then give it a file name. Let's say

3:12:53packets. Now you don't have to write any

3:12:56extension after the file name. Remember

3:12:59Wireshark automatically saves your

3:13:02packets with pcap or pcapng extension.

3:13:06pcapng is the default extension for

3:13:09saving wireshark files. Click on save.

3:13:13Now a new session has been started. Then

3:13:16third button restarts a new session. So

3:13:18if you want to restart a new session

3:13:21when you already have a session running

3:13:24then click on this button. And here also

3:13:26if you want to save already captured

3:13:30packets then click on save before

3:13:32continuing. This time I'm going to go

3:13:34with continue without saving. Then third

3:13:38fourth button is capture options.

3:13:41capture options button cannot be

3:13:44accessed when you have a session

3:13:46running. So let me stop the session

3:13:49first. Now if I click on the capture

3:13:51option button as you can see now it is

3:13:54working. Now capture options uh window

3:13:58displays all the network interface cards

3:14:01just like your your welcome window. The

3:14:04only difference is that it gives you a

3:14:07much better control over interfaces. As

3:14:10you can see, we have additional options

3:14:12such as promiscuous mode and monitor

3:14:16mode. Okay, I will get back to capture

3:14:18options later. Then we have open a

3:14:22capture file button. So this button

3:14:25allows you to open a already saved file.

3:14:29So click on it. Now I'm going to double

3:14:32click on the file that I saved a few

3:14:35seconds ago. So double click on the

3:14:37file. Now continue without saving. Now

3:14:39as you can see at the top packets

3:14:42dotpcapng wireshark is reading packets

3:14:46from this particular file. Then next

3:14:49button that we have is save this capture

3:14:53file. So this button basically gives you

3:14:56option to save your packets quickly. So

3:14:59click on the button write the file name

3:15:02then click on save. It will save the

3:15:04packets. Now another way to save uh

3:15:07packets is go to the file, click on save

3:15:10as. Then next button is close. So close

3:15:14button takes you back to your welcome

3:15:17window as you can see. So let me start

3:15:19the session again.

3:15:22Now next button that we have is find. So

3:15:25click on the button. It basically allows

3:15:28us to search for packets based on

3:15:32different types of values. As you can

3:15:34see, we have a drop-own menu here. So,

3:15:36click on the down arrow and uh let me

3:15:39start with let's say string. Now, in

3:15:41this box, type a string or text. Let's

3:15:44say payload.

3:15:47Now, let me click on find. As you can

3:15:49see, guys, it is highlighting the

3:15:52package that contains the word payload

3:15:56right here. As you can see, so when you

3:15:58select the string option, whatever you

3:16:00type here, Wireshark is going to search

3:16:03for that particular uh text or string in

3:16:06each packet. Wherever it finds the word

3:16:09payload, then it will highlight those

3:16:12packets. As you can see, for now, it is

3:16:13highlighting packet number 55. Now, if I

3:16:16click on find, it is highlighting the

3:16:18next packet that contains the word

3:16:21payload like this. Then we have hex

3:16:24value option. Let me select it. Now here

3:16:26you can search by hexadimal values as

3:16:29well. So let's say 4 a. Now click on

3:16:33find. As you can see on the packet bytes

3:16:36panel 4 a is highlighted. And in the

3:16:40packet list section wire sharkark is

3:16:42highlighting the exact packet that

3:16:45contains this value. Then we have

3:16:48display filter. We have not covered uh

3:16:50the display filters yet. Right? Once you

3:16:53you will learn display filters then you

3:16:56will automatically learn to use this

3:16:58feature for now. You don't have to worry

3:17:01about it. Then next two buttons uh that

3:17:04we have are right and left arrow. So

3:17:07right arrow button basically takes you

3:17:10one packet up from your current

3:17:13position. My current uh position is let

3:17:15me click on it. So if I click on left

3:17:18arrow button, it will take you one

3:17:20packet up and right button it's going to

3:17:23take me one packet down from my current

3:17:26position. Then we have go to uh

3:17:28specified packet. Click on the button

3:17:31here in the box. Type the packet number

3:17:34let's say five and click on go to go to

3:17:38packet. Then as you can see it has taken

3:17:40me to the packet number five. It is

3:17:42being highlighted. So whatever number

3:17:45you type in here in this box, wire

3:17:48sharkark will take you to that

3:17:50particular packet. Then we have uh up

3:17:54and down arrow keys. The up arrow key is

3:17:58going to take you to the first captured

3:18:01packet in the list. Click on it. As you

3:18:03can see, it is highlighting the first

3:18:06packet in the list and down arrow key

3:18:08takes you to the last captured packet.

3:18:11Right. Next button that we have is uh

3:18:14this automatically scroll to the last

3:18:16packet during live capture. So when you

3:18:19enable this button, it will

3:18:20automatically take you to the you know

3:18:23last packet that Wireshark captures

3:18:25during the live session. As you can see

3:18:28it has uh this light blue background

3:18:31color right it means it is enabled

3:18:34right. If I click on it now it is

3:18:36disabled. It is advised that you know

3:18:39always keep it enabled. Now next button

3:18:42basically enables the packet coloring.

3:18:45As you can see we have packets with

3:18:48different colors right TCP packets have

3:18:51a different color and ARP packets have a

3:18:54different color. So what uh basically

3:18:56wireshark does it assigns a unique color

3:19:00to most commonly used protocols or

3:19:03filters so we can easily identify the

3:19:06packets. Right? So when I'm going to see

3:19:08this light pink color, I can

3:19:10automatically recognize yeah this is a

3:19:12an ARP packet. Now if you want to find

3:19:16out which color is associated with which

3:19:19filter or protocol, then go to the view,

3:19:23click on coloring tools. Now here you

3:19:26can basically see which color is

3:19:29associated with which filter or

3:19:31protocol. UDP protocol is going to have

3:19:34this light gray background color. So

3:19:38feel free to go through the list. You

3:19:40can even customize these colors. Let's

3:19:42say for ARP you want a different color.

3:19:45So click on the AR. Then down here click

3:19:48on background. Then select a color of

3:19:50your choice. Then click on okay. And

3:19:54after that click on okay. Then color

3:19:57will be changed. In the same way you can

3:19:59change foreground or text color as well.

3:20:02Select the color, click on okay, then

3:20:04click on okay. Changes will be applied

3:20:07right away. Then next buttons that we

3:20:09have are plus and minus. Plus button

3:20:12basically is used to increase the font

3:20:15size as you can see and minus button is

3:20:18is for decreasing the font size and

3:20:22button next to minus button sets the

3:20:25font size to default. If I click on it,

3:20:28as you can see, the font size has been

3:20:31set to uh the default. Now the last

3:20:34button uh resize or sets the packet

3:20:38columns size to to default. As you can

3:20:41see my destination column is overlapping

3:20:44the source column. Right now if I click

3:20:47on this uh last button, as you can see

3:20:50the size has been set to to the default.

3:20:53Now I can see contents of each column

3:20:56easily.

3:20:59Filters are used to hide or filter out

3:21:03unnecessary traffic. For example, here

3:21:06as you can see I have thousands of

3:21:08packets. Right now let's say I only want

3:21:12to see HTTP packets in my packet list

3:21:17section. All other traffic is irrelevant

3:21:20or useless to me. In that case, if I

3:21:24manually try to locate every single HTTP

3:21:28packet among thousands of packets, then

3:21:31it is going to take a lot of time,

3:21:33right? So to solve this problem, we have

3:21:37something called filters. Filters allow

3:21:41us to exactly see what you want to, you

3:21:45know, analyze and see in in your packet

3:21:48list section. For example, I only want

3:21:51to see HTTP packets. Then all I have to

3:21:55do is type a valid HTTP filter. Then

3:21:58Wireshark is only going to show all the

3:22:01HTTP packets and other traffic will be

3:22:04hidden. So this is as simple as that. We

3:22:07have two types of filters in Wireshark.

3:22:11Display and capture filters. Display

3:22:14filters are used or applied on already

3:22:18captured traffic. As you can see, I

3:22:20already have you know captured packets.

3:22:23Here I can apply the display filters and

3:22:27I will get back to to uh capture filters

3:22:30later. Now let's do some practical

3:22:33examples of display filters. Display

3:22:36filters can be written and applied here

3:22:39in the uh filter uh display filter bar.

3:22:42So I'm going to start with filtering

3:22:44HTTP traffic. So traffic uh filter for

3:22:47filtering HTTP traffic is just HTTP. So

3:22:51type HTTP. As you can notice when you

3:22:54type a correct or valid filter,

3:22:56Wireshark automatically changes

3:22:59background color to green. Green

3:23:02background means a valid filter. Now if

3:23:04I type something that wireshark does not

3:23:07recognize then background color changes

3:23:11to to pink. So green means valid, pink

3:23:15means invalid filter. Now how to apply

3:23:18the filter? We have two options. First

3:23:21press enter. Now as you can see filter

3:23:24has been applied under the protocol

3:23:27column. Wireshark is only displaying the

3:23:31HTTP traffic because this is exactly

3:23:34what I have told Wireshark only show me

3:23:38HTTP traffic. Now another way to apply

3:23:41filters is click on this uh right arrow

3:23:45on your right side. Click on it then

3:23:47filter will be applied. You can clear

3:23:50filters by clicking on this cross

3:23:52button. Now as you can see we are back

3:23:54to the normal. Now let's uh filter let's

3:23:58say DNS packets. So filter for that is

3:24:01DNS. Hit enter. Now as you can see

3:24:03Wireshark is only displaying the DNS

3:24:06packets. Now I want to see let's say TCP

3:24:10packets only. So filter is TCP. As you

3:24:14can see it is only showing the TCP

3:24:16traffic. In the same way let let's say I

3:24:20want to see UDP packets. So filter for

3:24:22that is UDP. Now let me see whether I

3:24:26have any ARP packets. So type the ARP,

3:24:29hit enter and yeah this is the ARP

3:24:32filter for filtering ARP packets. In the

3:24:36same way you can filter all the possible

3:24:38you know network traffic. All you have

3:24:41to do is remember the protocol name then

3:24:45type that in here in the filter bar. Now

3:24:48let's filter encrypted or HTTPS traffic.

3:24:53Your first guess might be HTTPS. Right?

3:24:57As you can see, this is not a valid

3:24:59filter, right? So to filter secure or

3:25:02HTTPS traffic then you have to type TLS.

3:25:07So press enter. As you can see now

3:25:09Wireshark is showing all the encrypted

3:25:12traffic. TLS filter uh makes sense

3:25:15because uh HTTPS protocol is actually

3:25:19combination of HTTP and TLS. TLS takes

3:25:25the HTTP traffic then encrypts it and

3:25:29that makes the HTTPS protocol. Sorry I

3:25:32forgot to add S. Now till now we have

3:25:36used or filtered one type of traffic

3:25:40only. Right now let's say I want to see

3:25:44ARP and DNS packets simultaneously. It

3:25:47can be done through something called

3:25:49operators or operator. So type uh DNS

3:25:54then write or and ARP or operator is

3:25:59used to combine multiple filters. So

3:26:02here I am basically telling Wireshark if

3:26:05you find DNS packets or ARP packets then

3:26:09show me all those packets. So if I hit

3:26:13enter then Wireshark as you can see it

3:26:15is displaying all the DNS and ARP

3:26:18packets. In this way you can combine as

3:26:21many filters as you like. So let me add

3:26:25another filter TLS or ICMP. Okay. So

3:26:29feel free to add as many filters as you

3:26:32like and or operator can be uh written

3:26:36with two pipes as well like this UDP.

3:26:41This is also a valid filter or ARP. See

3:26:46guys uh the or operator pretty much

3:26:49works uh as it works with you know uh

3:26:52programming languages. So here it can be

3:26:54used to combine multiple filters. Now uh

3:26:58let's use uh not operator. So type not

3:27:03and TCP. Now what does it mean? Not

3:27:06operator basically negates the value

3:27:09that you supply to it. Here I'm telling

3:27:12not operator that okay don't show me TCP

3:27:15packets. Show me everything but not the

3:27:19TCP packets. So if I hit enter, you are

3:27:22not going to see any single TCP packets

3:27:25in the list. As you can see

3:27:29and not operator can be can be written

3:27:32with exclamation symbol as well. So

3:27:35exclamation TCP. It is also a valid

3:27:39filter. Now let's filter traffic by port

3:27:43numbers. So type uh let's say TCP. I

3:27:46want to filter traffic on port number uh

3:27:50let's say 80. 80 port is for HTTP,

3:27:53right? So if I hit enter, it is not a

3:27:56valid filter. Sorry, I forgot to add

3:27:59equal to signs. So port number 80 means

3:28:02it is going to uh list all the HTTP

3:28:05traffic. Here also you can use or

3:28:07operator or TCP.ORT

3:28:12EQ means equal to 443. So EQ or equal to

3:28:18sign both are same. So if you hit enter

3:28:22now this time I'm telling wireshark if

3:28:24you find https or htt http traffic then

3:28:29list all those packets. So 443 port

3:28:33number is obviously for secure or https

3:28:38traffic. Now let's cover another very

3:28:41important filter called IP header. IP

3:28:45adder filter is basically used for

3:28:48filtering traffic by IP addresses. Let's

3:28:51say you want to check all the packets

3:28:55that a particular IP address has sent or

3:28:58received. So write IP dot adder equal to

3:29:02then paste the IP address. Now this

3:29:05filter is going to only uh uh display

3:29:08the packets that this particular IP

3:29:11address has sent or received. So if I

3:29:14hit enter now as you can see under the

3:29:16source and destination column right you

3:29:19can use or operator to combine multiple

3:29:23IP addresses. So let's say you want to

3:29:25check packets that you know multiple IP

3:29:29addresses have sent or received then use

3:29:33or operator IP dot adder uh let's say

3:29:37here 79. Now this filter is going to

3:29:41display all the packets that these two

3:29:45IP addresses have sent or received. In

3:29:48this way you can combine as many filters

3:29:51as you IP addresses as you like. Now

3:29:54here also we can use not operator. So if

3:29:57I type not at the beginning then what

3:30:01I'm telling Wireshark at this time is do

3:30:04not show me packets that this particular

3:30:08IP address has sent or received. So if I

3:30:13hit enter, you are not going to see this

3:30:15IP address in the packet list as you can

3:30:19see because we have clearly told

3:30:22Wireshark don't show me packets that

3:30:25have been sent or received by this IP

3:30:29address. And another important filter

3:30:33that I'm going to teach you is contains.

3:30:36So type TCP. Let's say contains.

3:30:41Now within the double quotes write

3:30:44YouTube.

3:30:47Now what this filter is going to do it

3:30:50will check every single packet in the

3:30:52list and see whether the packets contain

3:30:57the word YouTube. If any packet contains

3:31:01YouTube then that packet will be listed

3:31:04here. If I hit enter and as you can see

3:31:07there are no such packets that contain

3:31:10YouTube. Now let's try some let's try

3:31:13the DNS.

3:31:15DNS Now as you can see we do have DNS

3:31:19packets that contain YouTube. So as you

3:31:23can see youtube.com

3:31:25so this IP address visited this website

3:31:30YouTube or it basically made DNS queries

3:31:33to youtube.com right

3:31:38now let's move to the capture filters

3:31:41now capture filters allow you to have

3:31:45control over your traffic what you want

3:31:48to capture capture filter as the name

3:31:51suggests

3:31:52You can basically tell Wireshark before

3:31:55starting a new session what you want to

3:31:58capture. Right? By default, Wireshark

3:32:01captures all types of traffic floating

3:32:04on your network now. Let's say you only

3:32:07want to capture HTTP traffic, right? You

3:32:09don't want to capture any other traffic,

3:32:12just FTP or HTTP. Then you can tell it

3:32:16to Wireshark before starting a new

3:32:18session. then wireshark will only

3:32:21capture whatever traffic you tell it uh

3:32:24to capture. So you have to go back to

3:32:27your uh welcome window. Now first thing

3:32:31that you have to do is select the

3:32:34interface where you want to capture the

3:32:37traffic. Then here as you can see we

3:32:39have uh the box where you can type the

3:32:42capture filter. capture filters are

3:32:44different in terms of uh syntax from

3:32:47display filter. So if I type let's say

3:32:50HTTP then as you can see it is not a

3:32:53valid filter right. So to write a filter

3:32:57to capture HTTP traffic then we have to

3:33:00write port then port number 80. So port

3:33:04for HTTP is 80. So this filter is going

3:33:08to capture the HTTP or traffic on uh

3:33:12port 80. Now to start capturing packets,

3:33:15double click on the interface.

3:33:17Now as you can see guys at the top

3:33:20capturing from Wi-Fi on port number 80.

3:33:23So it is only going to capture traffic

3:33:26on 80. So let me visit uh let's see this

3:33:29is an HTTP website. As you can see not

3:33:32secure.

3:33:33It is capturing HTTP traffic. Now let me

3:33:37visit a website which uses HTTPS let's

3:33:40say YouTube. As you can see it is not

3:33:43capturing anything right. So to confirm

3:33:46it further let me apply the TLS filter.

3:33:50As you can see TLS found nothing because

3:33:54this filter capture filter is only going

3:33:56to capture the HTTP traffic. Now back to

3:34:00the welcome window again.

3:34:03Another place where you can type the

3:34:06capture filter uh filters is go to the

3:34:09capture options. Now here select the

3:34:12interface first then write the filter

3:34:15here. As you can see at the bottom we

3:34:18have a box. So port number 80. Now let's

3:34:22say I want to capture FTP traffic. Then

3:34:25you have to write the port number for

3:34:27FTP which is 21. Here also you can use

3:34:30or operator. So type port now let's say

3:34:3422. Now this time Wireshark is going to

3:34:37capture both HTTP and sorry SSH and FTP

3:34:42traffic. You can combine as many you

3:34:44know uh filters as you like here. And if

3:34:49you click on start then it will start

3:34:52capturing traffic.

3:34:55Now if you want to capture let's say

3:34:57only TCP traffic then you can directly

3:35:00write TCP. TCP and UDP filters are

3:35:04common for both display and capture

3:35:07filters right let's say UDP.

3:35:10Now let's say you only want to capture

3:35:14traffic that a particular IP address

3:35:17sends or receives. Uh then write the

3:35:20host filter then paste the IP address.

3:35:23Now this filter is only going to capture

3:35:25the traffic that this specified IP

3:35:28address sends or receives. So guys that

3:35:31is it for filters. If you want to learn

3:35:35more about filters, then feel free to

3:35:38check my Udemy course where I have, you

3:35:41know, covered a plenty of advanced

3:35:44filters. That's a

This transcript was generated from the captions YouTube publishes for this video. Get the transcript of any YouTube video atfreeyoutubetranscribe.com: free, unlimited, no sign-up.