Full transcript
Introduction
0:00In this course, you will learn the
0:01fundamentals of cyber security and
0:03ethical hacking using Kali Linux, and
0:06you'll learn how to protect systems from
0:07vulnerabilities. This beginner-friendly,
0:10practical, and hands-on course from
0:12Sunny covers essential techniques,
0:14tools, and ethical considerations. This
0:17course covers key topics like
0:18penetration testing, network security,
0:21and how to determine system
0:23vulnerabilities. Hello and welcome to
0:26this course where you are going to learn
0:28handson cyber security and ethical
0:31hacking from scratch. This course is
0:34suitable for beginners who have no prior
0:37knowledge of ethical hacking. Everything
0:40will be taught from level zero. By the
0:43end of this course, you will be very
0:46comfortable with Linux command line,
0:48various attacking tools, wireless
0:51security, defensive tools, end mapap,
0:53wire sharkark and many more tools. My
0:56name is Sanim Malu. I am a cyber
0:58security consultant and reverse
1:00engineer. I will be your instructor for
1:03this course. Now, let me quickly walk
1:06you through the course curriculum and
1:08what you will learn in this course. We
1:12will start with the fundamentals of Kali
1:14Linux such as copying, removing,
1:17renaming files, how to navigate your
1:20file system efficiently. Then we will
1:23move to Linux administration where you
1:26will learn the pseudo command, root
1:28user, how to create, remove, install and
1:31uninstall applications and more. Once
1:35fundamentals are done, we will move on
1:38to wireless security where you are going
1:40to learn how to perform Wi-Fi
1:44penetration testing and defend against
1:46Wi-Fi attacks. Then we will move to the
1:49Wireshark which is one of the most
1:52important tools in cyber security and
1:55learn how to use it. We will also cover
1:58N map and many more tools. Now let's
2:01dive into the practicals. We are going
What is Kali Linux
2:04to use Kali Linux operating system. If
2:07you don't have Kali Linux installed, I
2:10have a separate video on my channel for
2:12Kali Linux installation. So check that
2:15out first. Now let's dive into the
2:17practicals. Before we dive into the
2:20practicals, let me briefly explain what
2:23Kali Linux is. Kali Linux is an
2:26operating system that is specifically
2:29built for penetration testing and cyber
2:32security tasks. It is widely used for
2:36ethical hacking and cyber security tasks
2:38such as penetration testing, security
2:41research, computer forensic and reverse
2:44engineering. It has more than 300
2:46pre-installed hacking and forensic
2:49tools. Before we start using all the
2:52fancy tools, we need to learn the
2:55fundamentals of its command line. Now
2:58let's dive into the practicals. If you
3:01have not installed Kali Linux yet, I
3:04have covered the installation process in
3:06a separate video on my channel. Please
3:09watch that video first. If you want to
3:13learn beyond the basics, I have an
3:15advanced cyber security course on Udemy.
3:19Feel free to check it out. The link is
3:21in the description. Now, first thing
Basic Commands & Terminal Customization
3:24that we need to do is open the terminal.
3:27There are multiple ways to open the
3:30terminal. The easiest among all is press
3:34control + alt + t together and it should
3:38open up the terminal. This is the
3:41terminal. Or you can click on the
3:44applications icon or menu and in the
3:47search box type terminal. Click on
3:50terminal emulator. Or you can directly
3:54click on the terminals icon at the
3:57taskbar. Here it is. Click on it and it
4:00will definitely open up the terminal.
4:04Now before executing any commands I'm
4:06going to change the font size. As you
4:09can see the fonts are barely visible. So
4:13go to the file, click on preferences,
4:16click on appearance tab and click on on
4:19the change button and click on up arrow
4:24to increase the font size. I'm going to
4:26set it to 13. 13 works for me. Click on
4:30okay. Click on okay. As you can see now
4:33we have a much more readable font size.
4:37When we open the terminal we are
4:40presented with these two names separated
4:44by this symbol. Now this symbol can be
4:47anything. It is just a separator which
4:50separates these two names. Now name on
4:54your left side is the user name who is
4:57currently logged in. So type who am I
5:00command press enter. Who am I command
5:03displays the currently logged in user.
5:07So the current logged in user is Dimalu.
5:09It means Dimalu is using the system name
5:13on your right side is the host name or
5:16your system name. Type host name
5:18command. It displays the host name.
5:22Press enter. Now type clear. Clear
5:25command. As the name suggests, it clears
5:27the the terminal. Press enter. Now, next
5:31command that uh I'm going to type is
5:34date. D date prints the current date and
5:37time. Press enter. As you can see, this
5:40is the current date. I'm recording this
5:42video on this date. Now, type PWD. PWD
5:48stands for present working directory. It
5:52displays your present working directory
5:54where you are in your file system. Press
5:58enter. As you can see, my current
6:00working directory is Dimalu. Dimalu is
6:03the home directory for the user Dimalu.
6:06And we also have this dollar sign
6:10symbol, right? It also has a meaning.
6:13The dollar sign essentially represents
6:16the regular or normal users. In Linux,
6:20there are two types of users. Root user
6:24and regular users. The dollar sign
6:27represents the regular users. For now,
6:31you don't have to worry about users. We
6:34will get back to users in a dedicated
6:37section. The currently logged in user
6:40which is Dimalu is also a regular user.
6:44Now, before wrapping up this video, let
6:47me execute history command. The history
6:49command displays all the commands that
6:53you have executed previously. Press
6:55enter. As you can see, this is the list
6:58of commands that have been executed on
7:01this freshly installed Kali Linux
7:03machine. LS is an essential Linux
ls Command
7:06command. LS stands for list or listing.
7:10As the name suggests, it is used to list
7:14or display files and directories. You
7:17can view or check the contents of a
7:21specific directory or multiple
7:23directories with ls command. Now let's
7:26dive into the practicals. So type ls,
7:30press enter. By default, the ls command
7:33displays all the files and directories
7:36in your current working directory. So
7:38these are the files and directories in
7:40my current working directory which is
7:43home. And here we have two colors,
7:45right? the blue color and white color.
7:49The blue color represents directories
7:52and the white color represents files.
7:55The white color essentially represents
7:57all file types whether it is sh file or
8:02txt file, mp4 files, PDF files. All file
8:06types are represented by the white color
8:09in Kali Linux. Now the default ls
8:12command does not display the hidden
8:15files and directories. So if you want to
8:17list hidden content then type ls space-
8:22a parameter allows us to display or list
8:26all the files and directories including
8:29the hidden files and directories. Press
8:32enter. As you can see guys, we have
8:34files and directories that have dot at
8:38the beginning. The files and directories
8:41that have dot at the beginning, they are
8:43the hidden ones. Now let me execute ls
8:46again. As you can see, the default ls
8:49command displays contents of current
8:52working directory. Now I only want to
8:55list contents of a specific directory.
8:59Let's say I only want to see what is
9:02inside the desktop directory. Then type
9:06ls. Now specify name of the directory
9:09whose content you want to check desktop.
9:14So this time I am telling ls command
9:17that only list contents of this
9:21specified directory. It will display
9:23what is inside this specified directory
9:26uh desktop. Press enter. As you can see
9:29this time it is only uh listing contents
9:32of the desktop. Similarly, we can list
9:36contents of multiple directories as
9:39well. Just separate the directories with
9:42a space. Let's say etc. And this time ls
9:46command is going to list contents of
9:49desktop and the etc directory. Press
9:53enter. As you can see this is this is
9:55the contents of desktop and this is the
9:59contents of etc directory. In this way
10:02you can basically uh list contents of as
10:05many directories as you like. Just
10:08separate those directories with a space
10:11like this. This time it is going to list
10:13contents of these three specified
10:16directories. Press enter. As you can see
10:19guys, now the default ls command as you
10:22can see only displays the file and
10:25directory names. Right? However,
10:27sometimes we want more details such as
10:31file size, last modified date, etc. So,
10:35type ls space-l
10:38stands for long listing. It gives us a
10:42detailed information about the files and
10:45directories. Press enter. And first
10:48field from the right displays the
10:51directory or file name. Then we have
10:54this date and time. Right now this date
10:57and time automatically get updated when
11:01you modify a file or directory. In the
11:05context of a file when you modify or
11:08edit a file then this date and time get
11:12updated automatically. And in the
11:14context of a directory when you add a
11:18new directory or file to a directory
11:21then this date and time get updated. Or
11:25if you modify a file within a directory
11:29then the date and time of that
11:32particular directory also get updated.
11:35Now next field that we have is this. It
11:39displays the file size in bytes which is
11:43not very readable to us. So if you want
11:47a more readable format for displaying
11:50file and directory size then ls - l and
11:55hyphen hyphen h stands for human
11:59readable. Press enter. As you can see
12:02now we have file size in kilobytes,
12:06megabytes and gigabytes. iPhone h
12:08essentially displays file size in
12:11kilobytes, gigabytes and megabytes.
12:14And you don't have to you know write the
12:17hyphen H parameter separately. You can
12:21simply combine it with hyphen L or other
12:25parameters. Press enter. As you can see
12:27it is producing the same result. CD
cd Command
12:31stands for change directory. It is a
12:35simple command. As the name tells you cd
12:38allows us to navigate in our file
12:42system. So if you want to change
12:45directory or location then we have to
12:48use the cd command. So open your
12:51terminal. Let me type ls and execute pwd
12:56as well. Now my current working
12:58directory is home. I'm in my home
13:01directory. Right now let's say I want to
13:04switch or change my directory from
13:07current working directory to desktop.
13:10Then type cd space. Now specify the
13:15exact directory name where you want to
13:18switch desktop. Press enter. pwd. As you
13:22can see guys, my current working
13:24directory has been changed to the
13:27desktop.
13:29Now if you want to go one directory
13:33back, then type cd space two dots. It
13:38takes us one directory back in our file
13:42system. Press enter. pwd as you can see.
13:46Similarly, you can go multiple
13:48directories back with cd command. Type
13:51cd space two dots forward slash two dots
13:54again. It will take us two directories
13:58back. Press enter. pwd as you can see.
14:01And you can go as many directories back
14:05as you like with cd command. Just
14:08separate two dots with forward slash.
14:11Then it takes us that many directories
14:14back. Now what happens if you don't
14:18specify any directory name to the to the
14:22cd command right? My current working
14:24directory is desktop. Now if I type only
14:28cd command and don't provide any
14:31directory name then the cd command by
14:34default redirects us to the home
14:37directory. So press enter pwd. As you
14:41can see the current working directory
14:43has been changed from desktop to home.
14:47Sometimes we unintentionally or
14:49mistakenly execute the cd command which
14:52eventually redirects us to the home
14:55directory. So if you want to go to your
14:59previous working directory then type cd
15:02space and hyphen. It will take me to my
15:06previous working directory which was
15:08desktop. So press enter. As you can see
15:11guys, my directory has been changed to
15:14my previous working directory uh which
15:17is desktop. In this video, we will learn
Nano Editor
15:20how to create and modify text files
15:24using the nano text editor. Nano is a
15:27terminal based text editor that allows
15:30us to create, open and modify text files
15:34directly within the terminal. It is an
15:38easy to use and lightweight tool that
15:41offers features such as syntax
15:44highlighting, line numbering, search and
15:47replace, copy, cut and paste among
15:50others. In this video, we will cover the
15:53fundamentals of Nano. Now, Nano is one
15:57tool that you will be using on a daily
16:00basis. Now, let's jump into the
16:03practicals. type nano
16:07and press enter. We are inside the nano
16:11text editor. Now nano is absolutely
16:14ready to take the inputs. So let me type
16:17a few random text lines. Let's say this
16:20is a line number one. Now press enter
16:25for a new line. This is a new line.
16:28Press enter again.
16:31third line
16:34and at the bottom these are the options
16:37that we can use with the nano. First
16:41option that we have is controll G.
16:44Control + G is for help. It displays the
16:48documentation for nano in detail. So
16:52press control + G together. And uh here
16:56we have the the detailed information
16:59about the nano. Here we have the
17:02description for Nano, what it is and
17:04what it does. Now press the down arrow
17:07key to scroll through the entire
17:10documentation
17:12here. These are the options that we can
17:15use with Nano. So guys feel free to go
17:18through this uh this uh lengthy
17:21documentation. Now to exit out of this
17:24documentation, press Q. Then we have
17:28control O. Control O is for write out.
17:32Write out simply means saving the
17:34content to a file. I have not saved
17:38these lines into a file yet. So to save
17:41press control + O. Now here as you can
17:45see file name to write. Specify the file
17:48name where you want to save this
17:51content. Let me give let's say file name
17:54dummy. txt. Remember guys, by default
17:58the nano saves the file in your current
18:02working directory. My current working
18:04directory is desktop. So this dummy.txt
18:08file will be saved in in my desktop. Now
18:11press enter. As you can see root four
18:14lines at the top. Here we have the
18:17dummy.txt file where the content has
18:20been saved. Now to exit out of nano
18:25press control + x. Let me ls to check
18:30whether the file has been created or
18:33not. As you can see guys dummy.xt file
18:36has been created. Now I want to edit or
18:40modify this dummy.xt file using nano.
18:44Type nano dummy.xt.
18:48Provide the file name. Press enter. Now
18:51we have opened the dummy. TXT file
18:55successfully. Now we can you know modify
18:58this file however we like. So guys
19:01that's how you can create, save and
19:04modify contents of text files using nano
19:08text editor. Now before wrapping up this
19:12video, let me show you one uh trick that
19:15you can use for saving time. We can
19:19create the file at the beginning when we
19:23start nano. All you need to do is type
19:26nano and specify the file name new
19:29file.txt.
19:31Remember the way nano works if the file
19:34name that you specify if it already
19:38exists then it will open uh the existing
19:41file and if the file does not exist then
19:45nano will create the file. Press enter.
19:49As you can see, new file.ext has been
19:52created. Now we can write
19:56content to it. Press enter. For new
19:58line, press Ctrl O for saving the
20:02contents to the file. Press Ctrl + X to
20:07exit out of nano ls. As you can see, new
20:11file uh txt has been created. In this
cat Command
20:15video, we will take a look at the cat
20:17command. I can assure you that you will
20:20be using it on a daily basis. It is
20:24among the core commands of Linux. So,
20:27what does the cat command do? The cat
20:30command is a versatile multi-purpose
20:32command that can be used for a variety
20:35of tasks such as creating text files,
20:39viewing the content of files, appending
20:42text to existing files, etc. The CAT
20:45stands for concatenation. This is the
20:48first video on the CAT command. In this
20:50video, we will learn how to view the
20:53contents of a file and print line
20:56numbers as well. Now let's jump into the
20:59practicals. Let me ls I have these two
21:02files in my desktop and I want to view
21:06contents of uh let's say this dummy.txt
21:09file. So type cat and space. Now specify
21:14the file name whose content you want to
21:18view or print. I'm going to go with
21:21dummy.txt.
21:22So I'm telling cat that display or print
21:26the contents of this specified file. Let
21:30me press enter. As you can see guys,
21:32this is the contents of this dummy. TXT
21:36file. Now one thing that is missing is
21:39is the line numbers. CAD command does
21:42allow us to print line numbers as well
21:45which is a very convenient feature. So
21:48type cat, let's say dummy.xt txt and
21:53space hyphen n. It prints the line
21:57numbers. As you can see guys, now we
21:59have a very well formatted output and we
22:02have six line numbers, right? This is
22:04because these two are the blank lines.
22:08Blank lines also get counted. The get
22:11command also allows us to view contents
22:15of multiple files. All you have to do is
22:18tell the cat command those file names.
22:22Let's say cat space dummy.xt.
22:26Now space d1.txt.
22:29So you have to separate the file names
22:32with a space. And this time cat command
22:36is going to print contents of dummy.xt
22:39file and d1.txt
22:42file. Let me press enter. As you can see
22:45guys, this is the contents of first file
22:49and this is the uh this is the contents
22:51of D1 txt file. In this way, you can
22:55view contents of as many files as you
22:59like. Just separate file names with a
23:02space then it will print contents of all
23:06the specified files. Now I'm going to
23:10print contents of a file which is uh
23:13located in another directory right the
23:16d1 and dummy.txt these files are in my
23:19current working directory. I want to
23:21print contents of a file which is inside
23:24etc directory. The file name is passd.
23:27Now the passd file stores user account
23:31details. All the user accounts details
23:34are stored inside this passd file. Press
23:38enter. As you can see guys, these are
23:40the user accounts in my Linux system. I
23:44will get back to this past WD file in a
23:48dedicated video. We will continue where
Create Files Using cat
23:51we left off in the previous video. In
23:54this video, we will learn how to create
23:57files and append contents to existing
24:01files using the catch command. We will
24:04also learn how to concatenate multiple
24:08files into one. Now let's jump into the
24:11practicals to create a file using cat.
24:15Type cat. Now type the greater than
24:18symbol and specify the file name that
24:22you want to create. Let me create
24:24dummy.txt.
24:25Press enter. As you can notice, we have
24:28this uh cursor. It is essentially
24:31waiting for us to input something. Let
24:34me input a few random text line. This is
24:36a
24:39text line. Press enter for a new line.
24:44Line number two.
24:50Now to exit out of the cat, press
24:52control + C. Let me ls. As you can see,
24:56the file has been created. Let's check
25:00its contents.
25:02And these are the exact lines that we
25:06wrote uh inside the the dummy. TXT file.
25:09The cat command works pretty much like
25:12the output redirection operator. It
25:15overrides the contents of existing file.
25:19The way the cat command works, if the
25:23file doesn't exist, then it creates that
25:27file first and writes content to it. And
25:30if the file already exists, then it
25:33removes contents of that existing file
25:36and only keep or save the new content
25:40that you write to it. For example, I
25:43already have this file called dummy.txt.
25:46So if I
25:49write contents to this dummy.txt file
25:52then cat will remove the contents of
25:56this existing file and only keep the new
25:59content that you write to it. So let me
26:03write let's say
26:06this is a dummy file dummy file. Press
26:10enter. Let me exit out of the cat ls and
26:15let's check its contents. As you can see
26:18the existing content has been overritten
26:22or removed. It only kept the new
26:25content. So if you want to keep the
26:28existing content and append new content
26:32at the end then we have to use two
26:34greater than signs like this. Now
26:37specify the file name dummy.xt txt press
26:41enter
26:42line number two press enter line three.
26:47Now what the catch command will do is it
26:50will keep the existing content and the
26:54new content will be appended at the end
26:58of the file because we are using two
27:01greater than signs. Let me exit out of
27:04the cat
27:06lsc dummy.xt txt. As you can see, the
27:09existing content is still there and new
27:12content has been appended at the end of
27:15the file. So guys, that's how you can
27:17avoid content overwriting.
27:20Now let's learn how to concatenate
27:23multiple files into one. Let me change
27:26my directory to to desktop where I
27:29already have the multiple uh files.
27:32I have these two files. Let me first
27:35check their contents.
27:37This is the contents of D1.txt
27:40and uh this is the contents of
27:43dummy.txt. I want to merge contents of
27:47both of these files into one which is
27:50very easy. Type get and specify the file
27:53name. So let's say dy d1 txt.
27:58Now write the greater than sign. Then
28:00specify the file name where you want to
28:04merge the contents. So what the get
28:07command is going to do? It will take the
28:10contents of the files that you specify
28:14before the greater than sign then merge
28:18contents of these two files into this
28:21specified file merged dot txt. Press
28:25enter. ls the file merged txt has been
28:30created as you can see. Let me get out
28:32its contents. And this is the contents
28:35of contents of merge. .txt file.
28:38Remember when you merge the contents
28:41with cat it doesn't remove or alter the
28:46contents of the files. It only takes the
28:49contents of those files then save that
28:53into the file where you merge it. In
Create Directories
28:56this video we will learn how to create
28:59directories or folders in Linux.
29:03Basically folders are called directories
29:05in Linux. Now let's jump into the
29:09practicals.
29:11Type make diir. Make dir is short for
29:15make directory. Now you have to specify
29:19the directory name that you want to
29:21create. Let me create let's say dummy.
29:24So I am basically telling the make
29:27directory command to create this dummy
29:31directory. That's as simple as that.
29:33Press enter. ls. As you can see, dummy
29:37directory has been created. Now, let's
29:41create multiple directories with a
29:44single make diir command. Type make diir
29:47d1 space d2. This time make diir command
29:53will create these two directories. Just
29:57separate the directory names with a
30:01space. Let me press enter. LS. As you
30:04can see, D2 and D1 directories have been
30:08created. And now what I want is is to
30:11create a directory within a directory. I
30:15want to create a tree of directories.
30:18For example, I want to create a
30:20directory called Sunny. And inside sunny
30:23I want to create subdirectory called dim
30:26timalu. So type uh make diir
30:31sun sunny / dimallu. Press enter. And we
30:35have an error. Can't create directory
30:38because if you want to create a
30:41directory within a directory then we
30:43have to specify hyphen p option. P
30:47stands for parent. It creates a
30:50directory within a directory. So if I
30:52press enter this time ls as you can see
30:55the sunny directory has been created.
30:58Let's check its contents.
31:02As you can see inside the sunny we have
31:04the dimallu directory. So guys that's it
31:07for this quick video. Thank you very
31:10much for watching. Welcome back
grep Command
31:12everyone. This is the first practical
31:14video on the grip command. In this
31:17video, we will learn what grip is and
31:20the fundamentals of grip. Grip stands
31:23for global regular expression print.
31:27Now, what does the grip do? The grip
31:29command is heavily used for searching
31:33text or text patterns in files. Let's
31:37say you have a large text file and you
31:40want to know if a particular word exists
31:45within the file or how many times it is
31:48there in the file then the grip command
31:51solves this problem very efficiently and
31:54easily. It makes searching through files
31:57very easy. Use cases of grip command are
32:01vast. It can be used for formatting
32:04output, searching patterns and analyzing
32:06logs efficiently. Now let's jump into
32:10the practicals. Let me switch my
32:12directory to the desktop. Now we are
32:16going to need a file to work with where
32:19we can perform the grip searches. So
32:22what I'm going to do is redirect the
32:25manual page of user add command uh to a
32:29file. This is the documentation for user
32:31ad. I'm going to redirect or save it
32:34into a file. Press Q to exit out of the
32:38documentation. Now type man user add.
32:40Type output redirection operator.
32:43Specify the file name where you want to
32:47save the manual page. Out. TXT. Press
32:51enter. ls. The file has been created.
32:54Let me quickly check its contents with
32:58hyphen n option press enter. As you can
33:01see in this file we have almost 500
33:05lines. These are enough lines to
33:08demonstrate the grip command
33:10efficiently. Now back to the grip. So
33:13type grip. First thing that I'm going to
33:16do is check the available options that
33:19we can use with grip. So help option is
33:22going to display all the available
33:24options that can be used with grip.
33:27Press enter. So these are the options
33:30that we can use with the grip command.
33:33So feel free to go through all these
33:35options. Grip is actually a very
33:38advanced command. So type uh grip space.
33:43Now grip needs minimum two options. the
33:47search term what you want to search for
33:50and the file name where you want to
33:53search. So provide the search term or
33:56pattern. I'm going to search for the
33:58word user.
34:00Write the search term within quotes
34:03space. Now specify the file name where
34:06you want to search out txt. So I am
34:11basically telling the grip command
34:14search for the word user in this
34:18specified file out dot txt. Press enter.
34:23As you can see guys, grip has printed
34:26all the lines that contain the searched
34:30term user. Right? The searched term or
34:34match is being highlighted with the red
34:38color. So by default it is going to
34:40print all the lines that contain the
34:43searched term. Now one thing which is
34:45missing here is the line numbers. I
34:49exactly don't know in which lines the
34:52grip has found the match. So to print
34:55the line numbers we have to use hyphen n
34:58option. So type grip n and search term
35:02is again going to be user file name
35:05out.txt. So this time grip is going to
35:09print the lines wherever it finds the
35:12word user. If I hit enter, as you can
35:15see on the on the left side, it is
35:18exactly telling us the line numbers
35:21wherever it found the match. Now the
35:25search that I conducted was in this file
35:29out.xt which is in my current working
35:32directory. Now we can also search in a
35:35file which is located in another
35:38directory.
35:40I'm going to search for the word dimallu
35:44in the file which is located inside etc
35:49directory
35:50pass wd. So what basically is going to
35:53happen this time grip command is going
35:55to search for the word dimallu in this
35:59specified location. location is ATC
36:03directory. Inside ATC directory, we have
36:06a file called pass WD. Now, pass WD file
36:09essentially stores information of all
36:12the user accounts on your system. So, it
36:15will check whether the user account
36:17demalu exists or not. I will get back to
36:20pass WD file in a dedicated video. So,
36:24press enter. As you can see, it did find
36:27the word dimalu or user account dimalu
36:31in this uh pass wd file. It means the
36:34user account dimalu does exist. Now what
36:37happens if uh the grip does not find the
36:41match or you provide a pattern that
36:44doesn't exist?
36:46In that case, grip doesn't provide any
36:49output. So that's pretty much it for
36:52this video, guys. Thank you very much
36:53for watching. In this video, we will
wc Command
36:55explore the WC command. It is a simple
36:59and useful tool. WC stands for word
37:03count. As the name suggests, WC counts
37:06the total number of words, lines, and
37:10characters in a given file. Now, let's
37:13jump into the practicals. I have this
37:16file called out.txt.
37:18I want to count or check how many words,
37:23characters and lines are in this
37:26particular file. So type wc space. Now
37:29specify the file name where you want to
37:33perform counting in out.txt.
37:38Now press enter. As you can see, we have
37:40some interesting details. First field
37:44from the right displays the file name.
37:47Then next field displays the total
37:50characters and this field displays the
37:54total words and first field from the
37:57left displays the total lines. Now I
38:00only want to print the total number of
38:03words. So type wc
38:08and hyphen w only prints the total
38:11words. As you can see the total words in
38:14the file out.xt txtr 200831.
38:20Similarly, you can print only lines WCL.
38:27And if you want to print the total
38:31letters or characters, then specify
38:34hyphen C. C counts how many characters
38:38are in the specified file. As you can
38:41see, now let me demonstrate the WC with
38:44a real world example. Let's say I want
38:46to check how many user accounts are on
38:49my system. Then WC - L etc pass WD.
38:57Now it will count how many lines are in
39:01the pass WD file. Press enter. As you
39:04can see there are total 59 lines which
39:07means there are total 59 user accounts
39:10in my system. So that's it for WC
39:13command guys. Thank you very much for
Output Redirection
39:15watching. In this video, we are going to
39:17learn about output redirection. Output
39:21redirection is a fundamental concept in
39:23the Linux command line that allows us to
39:27control the output of a command or
39:30program. In simple terms, it means
39:33taking the output of a command and
39:37redirecting or saving it to a file. When
39:40you execute a command in the terminal,
39:43by default, the output of that command
39:46is typically displayed in the terminal.
39:49However, with output redirection, you
39:52can save the output to a file. There are
39:56many situations where you might need to
39:59save the output of a command to a file
40:02instead of displaying it in the terminal
40:06such as analyzing the output later
40:08filtering or processing the output with
40:12other tools etc. So let me practically
40:15demonstrate what I just explained. Let
40:18me execute uh the ls command. This is
40:21the output of ls command right now.
40:24Output redirection allows us to redirect
40:28or save output that a command produces
40:32to a file. This is exactly what I'm
40:35going to do. I will take this output of
40:38ls command then redirect or save it to a
40:43file. The syntax is very simple. Type
40:46the command whose output you want to
40:49redirect. I'm going to go with the ls
40:52command. Now type the greater than sign.
40:54The greater than symbol is also known as
40:57the the output redirection operator. Now
41:01specify the file name where you want to
41:03save the output. out txt. Now the way
41:08output redirection works. If the file
41:11name that you specify does not exist,
41:14then it will create the file first then
41:18redirect output to it. And if the file
41:22already exists then it will redirect or
41:25save the output to the existing file.
41:29Let me hit enter. And this time we did
41:32not get any output. This is because by
41:35default Linux sends output of a command
41:39to the terminal. However, this time we
41:42used the output redirection operator. So
41:45the output was sent to this out. txt
41:50file not to the terminal. Now let me ls.
41:54As you can see the outtxt file has been
41:57created. Now let's check its contents.
42:01Get out.xt.
42:02As you can see guys inside out.xt file
42:07we have this content. This is the output
42:10of this ls command. This is exactly what
42:15we redirected to this out. txt file.
42:19This is as simple as that. Now let's do
42:22a few more examples. Let me execute a
42:25date command. This is the output of date
42:27command. Now let's uh redirect uh the
42:30output of date command to a file. Type
42:33date output redirection operator
42:36date.txt.
42:37This time output redirection operator is
42:40going to take output of date command
42:43then redirect it to this date. TXT file.
42:47Let me hit enter. ls the date dot txt
42:50file has been created. Let's get out its
42:53contents.
42:55As you can see guys inside uh date txt
42:58file. We have the output of date
43:01command. So similarly you can redirect
43:04output of any command uh to a file using
43:08the output redirection operator. Now you
43:11have to be a bit careful when
43:13redirecting output of a command to a
43:16file because the output redirection
43:20operator overrides or removes the
43:24contents of an existing file. For
43:27example, this date txt file already has
43:31uh some content. Right? Now if you
43:34redirect output of another command to
43:37this date txt file then it will remove
43:42or override the existing content and
43:45only keep the new content. Let me
43:48actually show you what I mean this time.
43:50What I'm going to do is redirect the
43:52output of uh ls command to the date txt
43:58file. Now the date txt file already
44:02exists right? It has already some
44:05contents inside it. Now this time the
44:08output redirection operator is going to
44:11redirect the output of this ls command
44:14to the date. TXT command and only keep
44:18the new content or output of this ls
44:22command. Let me press enter. Let's check
44:24the contents of date command. As you can
44:27see guys, the old or existing content
44:30has been removed. We only have the new
44:33content that we redirected it with the
44:37most recent command which is ls. Now if
44:40you want to maintain or keep the
44:43existing content of a file then we have
44:46to use the two output redirection
44:49operators. So let me redirect output of
44:52date command. This time use two output
44:55redirection operators like this date.
44:59TXT. Now when you use two output
45:03redirection operators, the output gets
45:07appended at the end of the file. So what
45:10it is going to do? It will take the
45:13output of date command then append or
45:16add it at the end of this specified
45:19file. Press enter. Let's get out
45:23contents of date dot txt file. As you
45:26can see guys, this is the existing
45:28content. It is still there. It has not
45:31been overritten. And the output of the
45:34previous command date has been appended
45:36at the end. That's how guys you can use
45:38the output redirection operator and
45:41avoid content overwriting.
Piping
45:44In this video we are going to cover
45:47pipes also known as piping. Piping is an
45:51essential part of the Linux command
45:54line. So what exactly is piping? In
45:58simpler terms, piping is the process of
46:01sending the output of one command to
46:04another. Piping combines two or more
46:08commands by sharing data between them.
46:12This is done using the pipe character
46:15between the two commands. Now why do we
46:19need to send output of one command to
46:22another or share data between them?
46:25Well, sometimes we have to use multiple
46:29commands or tools to complete complex
46:32tasks. So when you use different
46:36commands separately to get a single task
46:39done, it is a timeconsuming process,
46:43right? So why not combine multiple
46:46commands together instead of executing
46:49them separately? This is exactly what
46:52piping solves. Piping allows us to
46:56combine or connect multiple commands by
46:59sharing data or output between them. So
47:03instead of using multiple commands
47:06separately, we can combine them using
47:09piping. When one command sends its
47:12output to another command, the receiving
47:15command processes that output as its
47:18input. This essentially means that the
47:22output of one command becomes the input
47:25for the next command or the receiving
47:28command. Now let's jump into the
47:31practicals. Here I have this out txt
47:34file. Let me get out its contents. This
47:38is the output of this uh get command.
47:41Right now piping allows us to pipe or
47:45send output of one command to another.
47:49This is exactly what I'm going to do. I
47:51will send this output of get command to
47:54the grip command. Grip command will
47:56further process this output. Let me type
48:00the complete command. So type get
48:03out.txt.
48:05Now type the pipe character. This is the
48:08pipe character. This pipe character is
48:11typically above the enter key. Now, let
48:15me type the grip command. I'm going to
48:17search for the word user and let me open
48:21uh another terminal.
48:24I'm going to need it for a smooth
48:27explanation. Now, let me get out the
48:30contents of out txt file. Now, let me
48:33break down this this entire command. Now
48:36the way it is going to work since we are
48:39using piping the pipe character the
48:42Linux is going to send the output of
48:45this cat command to the grip command.
48:48This is the output of uh cat command.
48:51Right? Linux will send this output to
48:54the grip command. Now grip command will
48:57receive this output then search for the
49:02word user in this output or in these
49:06text lines. If it finds the word user in
49:10any of these lines then those lines will
49:13be uh printed or displayed. Now if you
49:16notice here I have not specified any
49:20file name. The grip command needs
49:23minimum two options. the search term
49:26what you want to search. I have
49:28specified the search term but I have not
49:31specified the file name where I want to
49:35search for this specified word user.
49:38This is because the grip is going to
49:41search for this word in this output that
49:46it receives from this command through
49:50piping. Let me press enter. As you can
49:53see guys, it has printed all the lines
49:55that that contain the searched term
49:59user. So that's how the piping works. So
50:02guys, the output of one command becomes
50:06input to another command or the command
50:09that is receiving it. Remember most
50:13Linux commands are designed to receive
50:16the output through piping. So the output
50:20of get command became input to the grip
50:23command and grip command searched for
50:26the word user in the output that it
50:30received. This is as simple as that. Now
50:33let's do a few more examples. Let me
50:36change my directory to home.
50:38Let me execute ls command. Now I want to
50:41check whether the directory desktop
50:44exists or not. Obviously it does exist.
50:48We all can see it. It is right there.
50:51However, if there are let's say hundreds
50:53of files and directories, then it
50:57becomes a bit hard to locate a specific
51:00file or directory. But with piping, we
51:04can easily solve such problems. All we
51:07have to do is send this output of ls
51:11command to the grip command, then search
51:13for the for the whatever file or
51:16directory you want. So let me type ls
51:20space type the pipe character. I'm going
51:23to search type grip. I'm going to search
51:25for the word desktop. So what basically
51:29is going to happen the Linux will send
51:32output of ls command. Let me close this
51:36terminal. This is not required. I'm
51:38going to open a new terminal.
51:42Now what basically is going to happen
51:44the Linux will send the output of this
51:47command which is this to grip command.
51:51Then grip command will search for the
51:54word desktop in this output and if it
51:59finds uh image then it will list that
52:03line. Press enter. As you can see guys
52:05it did find the word desktop. So the
52:09directory desktop does exist. So that's
52:12how guys the piping works. You can
52:15literally take output of any command
52:18then pipe that to another command.
Copy Files
52:21Copying files is a common task that you
52:24have to perform on a regular basis.
52:28Right? The command for copying files and
52:31directories is cp. CP stands for copy
52:34and it can copy both files and
52:37directories. Now let's jump into the
52:40practicals. I'm going to start with
52:42copying files and later we will copy
52:45directories as well. Let me execute ls.
52:48I'm going to use these files to
52:51demonstrate the cp command. So type cp.
52:54cp stands for copy. Now cp command needs
52:58minimum two options. the file name that
53:01you want to copy and the destination
53:05directory where you want to copy it. So
53:08I'm going to start with copying this
53:10dummy.txt file. So specify the name of
53:13the file that you want to copy dummy.txt
53:17space. Now specify the destination
53:20directory where you want to copy it. Uh
53:24I'm going to copy uh it in my current
53:26working directory. So specify a
53:29different name. Let's say dummy cp.txt.
53:34Now the copy command is going to take
53:37this dummy. TXT file and create its copy
53:41under this new name dummy cp.txt.
53:45Let me press enter. LS. As you can see
53:48guys, we have successfully copied dummy.
53:51TXT file. Here is the copy of dummy.txt
53:55txt file under this new name dummy
53:58cp.txt. Similarly, we can copy files to
54:02a specific location or different
54:05directory. What I'm going to do is uh I
54:08will copy this dummy.txt file to the
54:11downloads. Let me open a new tab. Change
54:14my directory to the downloads ls. As you
54:18can see, the downloads directory is
54:20currently empty. So, let's copy
54:22dummy.txt txt to the to the downloads.
54:26Type dummy.txt.
54:29Now provide the full path to downloads
54:32or wherever you want to copy it. Type
54:36homeward slash username
54:40which is demalu formeward slash
54:44downloads. Now this time the copy
54:47command will take uh the dummy.txt txt
54:50file and copy it to the specified
54:53location uh which is downloads. Let me
54:56press enter. Now let me ls here. As you
54:59can see the dummy txt file has been
55:02copied to the downloads.
55:05So that's how guys you can uh copy files
55:08uh with cp command. We can also give a
55:11different name while copying.
55:15type forward slash let's say dummy
55:19cp.txt.
55:20This time the the cp command is going to
55:24copy this file to the downloads
55:27directory under this new name dumcp.txt.
55:32Press enter.
55:35As you can see we have the file
55:37dumcp.txt.
55:40Now let's copy directories ls. I have
55:44this demo directory. I'm going to create
55:46a copy of this demo directory. Type uh
55:50cp space demo. Now specify the name of
55:54the directory
55:56demo 12. So copy command is going to
56:00take this demo directory and create its
56:03copy under this new name dem 2. Let me
56:07press enter. As you can see, we have an
56:10error. R not specified. If you want to
56:14copy directories, we need to specify
56:18hyphen r parameter. By default, copy
56:21command expects us to copy files. So if
56:24you want to copy directories, then we
56:27need to use the hyphen r parameter. So
56:31type hyphen r. This time the copy
56:34command is going to take this directory.
56:36then creates its copy under this new
56:40name dem12 in my current working
56:43directory. Let me hit enter. ls. As you
56:47can see guys, we have successfully
56:48created copy of demo directory under
56:51this new name. Now let's copy demo
56:55directory to another directory. I'm
56:58going to copy it to the downloads cpr
57:03demo. Now provide the path where you
57:05want to copy it. Home. Type the
57:08username.
57:10Downloads. This time copy command is
57:13going to take this demo directory and
57:16copy it to the specified destination
57:19which is downloads. Let me hit enter.
57:22Let me ls here. As you can see guys, the
57:25demo directory has been created. Right
57:29now let's copy multiple files or
57:33directories with a uh single cp command.
57:36What I'm going to do is I will copy dam
57:392 and app do c file uh to the downloads
57:44directory. So type cp ap c space. Now
57:50provide name of the file or directory
57:53that you want to copy. Let's say dam 2.
57:57Now provide the destination path home
58:00demalu sorry.
58:04Now since we are copying a directory
58:07along with file we need to provide
58:10hyphen r par parameter.
58:13Now the way this command is going to
58:14work copy command will copy these two
58:18specified file and directory to the
58:22downloads directory. You can copy any
58:24number of files or directories. Just
58:27separate them with a space like this.
58:30Now press enter. Let me go to the
58:34downloads
58:36ls. As you can see guys, here we have
58:38app dot C file and dem directory. That's
58:42how you can copy multiple files and
58:45directories with cp command. Just
58:48separate the files with a space. In this
Remove Files & Directories
58:52video, we will learn how to delete files
58:54and directories using the rm command.
58:58The rm command is short for remove. It
59:01is used to delete or remove files and
59:05directories. It is a straightforward
59:07command with a simple syntax. Now, let's
59:11jump into the practicals. I'm going to
59:13demonstrate the rm command using uh
59:16these dummy files and directories. So
59:20type rm. RM stands for remove space. Now
59:25we need to tell the rm command the file
59:29name that you want to remove. We are
59:32going to start with removing files.
59:34Later we will remove directories as
59:37well. So rm space. Now specify the file
59:40name that you want to remove. I'm going
59:43to remove this dummy.xt file which is in
59:46my current working directory. So type
59:48dummy txt. So rm command is going to
59:53remove this specified file dummy. TXT.
59:56Press enter. ls. As you can see guys,
59:59the file has been removed. Similarly, we
1:00:03can remove multiple files with a single
1:00:06rm command. Type rm space. Specify the
1:00:11file names. Let's say app dot c space.
1:00:14We need to separate uh files with a
1:00:18space appcp.txt
1:00:22and this time rm command is going to
1:00:25remove these two specified files. Press
1:00:29enter. ls. As you can see guys, both the
1:00:33specified files have been removed. And
1:00:37uh this way you can remove as many files
1:00:40as you like. just separate those files
1:00:43with a space. Now, let's remove files
1:00:47that are stored in a different
1:00:50directory. I'm going to remove uh files
1:00:54in my downloads directory.
1:00:57Let me change my directory to the
1:00:59downloads. Here I have all these uh
1:01:03dummy files. So, let me go back to my
1:01:06current working directory which is
1:01:08desktop. So type rm space. Now we need
1:01:12to provide the full path to the file or
1:01:16directory that you want to remove. So
1:01:20home type the username. Now downloads.
1:01:24Now inside downloads I have this file
1:01:27called dummy.txt.
1:01:29So after the destination directory
1:01:31forward slash then type the name of the
1:01:34file that you want to remove dummy.xt.
1:01:38So, rm command is going to remove this
1:01:41dummy.txt file which is stored in the
1:01:45downloads directory. Press enter. Let me
1:01:49go back to downloads.
1:01:51ls. As you can see guys, the file
1:01:54dummy.xt has been removed. Now let's
1:01:58remove directories. ls. I'm going to
1:02:01start with removing demo directory. So,
1:02:04rm demo. Press enter. As you can see, it
1:02:08is a directory. Just like the the cp
1:02:11command, we need to specify hyphen r
1:02:15parameter when removing directories. So,
1:02:19type rm - r. Provide the name of the
1:02:23directory that you want to remove. Press
1:02:26enter. ls. As you can ls, as you can see
1:02:29guys, the directory demo has been
1:02:33removed. Similarly, we can remove uh
1:02:36directories that are stored in a
1:02:39different location or directory. The
1:02:43syntax is same. Type rm - r. Provide the
1:02:48path to the directory that you want to
1:02:50remove. Downloads. In downloads, I have
1:02:54directory called demo. So, let me type
1:02:56the name of the directory. This time rm
1:02:59command is going to remove the demo
1:03:02directory which is inside the the
1:03:04downloads directory. Hit enter. Let me
1:03:08ls. As you can see guys, the demo
1:03:10directory has been removed. Now let's
1:03:13discuss some of the options that can be
1:03:16used with the rm command. Now one of the
1:03:20most commonly used options with rm
1:03:23command is hyphen f. F stands for force.
1:03:27It basically forcefully removes the
1:03:30files and directories. Now what happens
1:03:33is that there are certain files that you
1:03:37can't remove with the simple rm command.
1:03:41We need to provide hyphen f to remove
1:03:46specific files or directories. Now files
1:03:49that are right protected can't be
1:03:52removed with simple rm command. Now,
1:03:56right protected files are those that
1:03:59can't be modified or edited. Let me
1:04:03create one such file.
1:04:05I'm going to make this demo.txt file as
1:04:09write only. So, type ch mode. You don't
1:04:12have to worry about the ch mode command.
1:04:14We will get back to it in a dedicated
1:04:17section. For now, I just want to create
1:04:20a write protected file just to
1:04:22demonstrate rm command. ch mode user I'm
1:04:27going to take away right permission on
1:04:30demo txt file press enter now as you can
1:04:35see guys in the desktop we have this
1:04:38lock sign it means that this is a right
1:04:41protected file and it can't be modified
1:04:44or edited let me ls now let me try to
1:04:48remove it uh with default rm command
1:04:51demo txt press enter as you can see
1:04:54Guys, we have this prompt remove
1:04:58protected regular empty file demo.txt.
1:05:01Now here we have to uh specify n for no.
1:05:05If you don't want to remove then type n.
1:05:08And if you want to remove then type yes
1:05:12or y. Y stands for yes. Now I don't want
1:05:15to remove uh this demo.ext file yet. So
1:05:19I'm going to specify n. Press enter. Now
1:05:23if you want to bypass this prompt then
1:05:27we have to use hyphen f parameter. So
1:05:31type rm - f specify the file name and uh
1:05:38press enter. As you can see guys this
Types of Users
1:05:40time
1:05:42the rm command did not display this uh
1:05:47prompt remove protected regular file. it
1:05:51directly removed the file. So hyphen f
1:05:55parameter essentially bypasses uh this
1:05:59prompt and forcefully removes the files
1:06:02or directories. And if you have let's
1:06:05say a write protected directory then you
1:06:08have to specify hyphen r parameter like
1:06:12this hyphen rf then specify the right
1:06:16protected directory. Let's say we have a
1:06:19right protected directory demo. Then
1:06:21this command is going to remove this
1:06:24write protected directory and bypass the
1:06:28prompt that uh rm command typically
1:06:31displays when removing write protected
1:06:35files or directories. So that's it for
1:06:38rm command guys. Thank you very much for
1:06:39watching. Welcome back everyone. In this
1:06:41section, we will discuss two important
1:06:44aspects of Linux. User management and
1:06:47performing administrative tasks. This is
1:06:50one of the most important sections in
1:06:53this course. Before we dive into root
1:06:56user, sudo command and other advanced
1:06:58topics in upcoming videos. It is
1:07:01essential to understand user types.
1:07:04Linux users have different levels of
1:07:07access and permissions based on their
1:07:10type. Therefore, understanding users and
1:07:13their types is important. In this video,
1:07:17we will explore the different types of
1:07:19users in Linux. So, what is a computer
1:07:22user? First, a computer user is
1:07:24essentially someone who interacts with a
1:07:28computer system and uses its resources
1:07:31to perform tasks. These tasks include
1:07:35accessing files, running programs, and
1:07:38utilizing all the other features the
1:07:40system offers. In short, anyone who uses
1:07:43a computer for various activities is
1:07:46considered a computer user. Now, Linux
1:07:50is a multi-user operating system. Now,
1:07:53what does multi-user mean? A multi-user
1:07:56operating system allows multiple users
1:08:00to access and use a system
1:08:02simultaneously. This means several user
1:08:05accounts can be logged in at the same
1:08:09time. In a multi-user environment, we
1:08:12can create separate or multiple user
1:08:15accounts. Each user has their own
1:08:18account with a unique username and
1:08:21password. This allows users to log in
1:08:24with their login credentials and access
1:08:28their own files and resources without
1:08:31interfering with each other. Remember,
1:08:33each user in a multi-user operating
1:08:36system has their own files. By default,
1:08:39one user can't access files of other
1:08:42users on the system. Linux automatically
1:08:45manages the resources and security of
1:08:49each user account. Linux, Mac OS, and
1:08:52Windows are all multi-user operating
1:08:55systems. You can create multiple user
1:08:57accounts in each of these systems. In
1:09:00the upcoming videos, you will learn how
1:09:03to create and manage multiple user
1:09:05accounts on Linux practically. Now,
1:09:08there are three types of users in Linux.
1:09:11Not only in Linux, but in Windows as
1:09:14well. There are three main types of
1:09:16users. Regular users, root user and
1:09:20system users. Let's start with regular
1:09:23users. Regular users in Linux are also
1:09:27known as normal users, standard users or
1:09:30non-admin users. Regular users have
1:09:34limited system access. They can perform
1:09:37basic standard tasks such as browsing
1:09:40the internet, storing and accessing
1:09:42their data, playing media, and creating
1:09:46files etc. However, a regular user can't
1:09:49perform any administrative tasks such as
1:09:53installing, uninstalling applications,
1:09:55modifying system settings, accessing or
1:09:57deleting configuration files, and
1:10:00managing system directories and tools.
1:10:03In short, regular users don't have
1:10:06ability or permission to utilize and
1:10:09access files and tools that are
1:10:12specifically designed for performing
1:10:15administrative tasks. Now, let's address
1:10:18the real question. Why regular user
1:10:20accounts exist? What problems do they
1:10:23solve? As we discussed earlier, regular
1:10:26user accounts have limited privileges or
1:10:29access to a system. Uh this allows users
1:10:32to utilize and access the system without
1:10:35being able to modify system files or
1:10:39other protected administrative files and
1:10:43tools. This limited access helps
1:10:46maintain system security. Organizations,
1:10:49schools and universities commonly use
1:10:52regular user accounts for this very
1:10:55reason. Let's take an organization as an
1:10:58example. Organizations and corporations
1:11:01often have multiple employees who
1:11:04typically use the same computer system,
1:11:07right? To ensure security and privacy,
1:11:10each user is assigned a unique username
1:11:14and password. Users log in using their
1:11:17credentials. Each user's files are
1:11:20stored separately and one user can't
1:11:24access the files of another user without
1:11:27proper authorization.
1:11:29Regular user accounts as we have
1:11:31discussed have limited privileges. This
1:11:33means they can't damage or access system
1:11:36files nor can they perform
1:11:39administrative tasks. By using regular
1:11:42user accounts, users can benefit from
1:11:46all the essential functionality the
1:11:48system offers without risking accidental
1:11:51or intentional harm to the system
1:11:54through administrative access. They can
1:11:57create their own files, perform office
1:12:00work, but can't access administrative
1:12:02tools. This restriction on accessing
1:12:06only their own files inherently makes
1:12:09regular user accounts more secure.
1:12:12Windows is also a multi-user operating
1:12:14system. You may be familiar with guest
1:12:17accounts. The guest account in Windows
1:12:20is also a regular user account with
1:12:23limited system access. The second type
1:12:25of user is the root user also known as
1:12:29administrative user. Root will be
1:12:32covered in the next video because it
1:12:35deserves a dedicated video. Now let's
1:12:37discuss system users. System users in
1:12:41Linux as well as in Windows. A system
1:12:44user refers to a user account created
1:12:47for computer system or an application to
1:12:51execute specific tasks or functions.
1:12:54System users are created during the
1:12:57installation of operating system and
1:12:59applications. Some applications use a
1:13:02dedicated system user account to carry
1:13:06out their operations. System users
1:13:08typically run in the background. They
1:13:10are not directly relevant to your
1:13:13day-to-day tasks. We don't interact with
1:13:17them directly, but they are used by
1:13:20specific applications to carry out their
1:13:23operations in the background. These
1:13:25tasks include running demons or services
1:13:28in the background. Specific applications
1:13:31such as antivirus software also use
1:13:34dedicated system account to scan the
1:13:37system. System users don't have a login
1:13:40shell meaning they can't log into the
1:13:42system directly. In this video we will
Root User
1:13:46learn about the root user. Root is the
1:13:49most important user on a Linux system.
1:13:53In the previous video we discussed that
1:13:56regular users can't perform
1:13:58administrative tasks. However, someone
1:14:01eventually needs to perform
1:14:04administrative tasks. Right? And that is
1:14:07where the root user comes in. The root
1:14:10is a special user account on Linux. It
1:14:13is essentially the admin or
1:14:15administrative user account on the Linux
1:14:18system. All administrative tasks are
1:14:22performed by the root user account. The
1:14:25root user is also known as the super
1:14:29user. The root user has complete control
1:14:32over the system. It can perform any
1:14:35operation on a system such as installing
1:14:38or uninstalling applications, accessing,
1:14:41deleting and modifying any system and
1:14:44configuration files. In short, the root
1:14:47user controls and accesses everything.
1:14:50The root user account is created
1:14:53automatically during the installation of
1:14:56Linux. Each Linux system has the root
1:14:59user by default. In the upcoming video,
1:15:02we will be putting theory into practice.
sudo Command (Administrative Tasks)
1:15:08Finally, we will put everything we have
1:15:10learned in the last two videos into
1:15:13practice. In this video, we will learn
1:15:15about the pseudo command and how to use
1:15:19it to perform administrative tasks. We
1:15:22will also cover how sudo is related to
1:15:26the root user as well as who is allowed
1:15:29to use the sudo command. This video is
1:15:32going to be very important and probably
1:15:35one of the longest videos in the entire
1:15:37course. So make sure to watch the
1:15:40complete video and don't skip anything.
1:15:42Let's dive into the practicals. In the
1:15:45previous two videos, we learned that a
1:15:48regular user can't perform
1:15:51administrative tasks. Right? Now, let's
1:15:53actually verify if it is true or not.
1:15:58Now, how can you tell whether you are
1:16:00logged in as a regular user or the root
1:16:04user? Well, a regular user is denoted by
1:16:08the dollar sign. As you can see, it
1:16:10means that the currently logged in user
1:16:12Dimalu is a regular user and the root
1:16:16user is denoted or represented by the
1:16:19pound symbol. We will get back to it
1:16:22later. Now, what I'm going to do is I
1:16:24will try to install an application which
1:16:27is uh an administrative task. So, type
1:16:31app install WC.
1:16:34Don't worry about the apt command. We
1:16:36will get back to it in a dedicated
1:16:39section. Apt is basically used for
1:16:41installing or uninstalling applications.
1:16:44Now let me press enter and see what
1:16:46happens. As you can see guys, we have
1:16:49two errors. The first error says
1:16:52permission denied. It means that the
1:16:54currently logged in user Dimalu does not
1:16:58have permission to execute this command.
1:17:02And second error says that are you root.
1:17:06It means that you need to be the root
1:17:09user to execute this command. Only root
1:17:12user is allowed to execute this command.
1:17:16Now there are two primary ways to
1:17:19perform administrative tasks on a Linux
1:17:22system. Either you need to log in as the
1:17:26root user or you can use the pseudo
1:17:30command to perform administrative tasks.
1:17:34Now logging in as root user is not
1:17:36recommended especially for beginners
1:17:40because it can be very dangerous. The
1:17:42major problem with logging in as the
1:17:45root user is that the root user executes
1:17:49commands without alerting you or giving
1:17:53any warnings. No matter how dangerous
1:17:56the command is, you are not warned
1:17:59before making system changes or
1:18:02executing commands. This means that you
1:18:05will not have any opportunity to review
1:18:09the changes before they are implemented
1:18:12which can lead to serious problems. For
1:18:15example, you could accidentally delete
1:18:18essential system files rendering your
1:18:21system unusable or unstable. For these
1:18:25reasons, it is considered dangerous to
1:18:28log in as root or operate your system as
1:18:32root. Even experienced users avoid
1:18:35logging in as root unless it is
1:18:38absolutely necessary. So what is the
1:18:40safe way to perform administrative
1:18:43tasks? To safely perform administrative
1:18:46tasks, we can use the pseudo command.
1:18:51Pseudo command allows regular users to
1:18:54run commands with the same power or
1:18:58privileges as the root user. This means
1:19:02you don't need to log in as the root
1:19:05user to perform administrative tasks.
1:19:09You can simply use the sudo command. The
1:19:12term sudo stands for super user do where
1:19:16su stands for super user and do stands
1:19:20for perform or execute. Remember the
1:19:24root user is also known as the super
1:19:28user.
1:19:29Now let's see how we can use the pseudo
1:19:32command to perform administrative tasks.
1:19:36The syntax is simple. Just type the
1:19:39pseudo command before the command that
1:19:41you want to execute. Now I'm going to
1:19:44execute the same apt install WC command.
1:19:48App install
1:19:51WC. Press enter. Type your password.
1:19:55Press enter. As you can see guys, now
1:19:58the command is working. Apt is asking me
1:20:01whether I want to continue the
1:20:03installation or not. Type Y. Y is for
1:20:07yes, N is for no. I'm going to type Y to
1:20:10proceed with installation. Press enter.
1:20:13Now app is going to download the
1:20:16required files for WC then install it
1:20:19automatically.
1:20:22The installation is complete. And now
1:20:24let me verify the installation. Type WC.
1:20:28Press enter. As you can see guys, WC is
1:20:31up and running. So guys, that's how you
1:20:34can basically use the pseudo command to
1:20:37perform administrative tasks. Just type
1:20:40the pseudo command before the actual
1:20:42command that you want to execute. Now
1:20:45let me execute another command that
1:20:47needs pseudo privileges. There is a
1:20:50command called fd disk which is used for
1:20:53managing partitions.
1:20:55Press enter. As you can see, permission
1:20:58denied. Now I'm going to type sudo then
1:21:02f disk
1:21:05- l. Press enter. As you can see guys,
1:21:08now the command has been executed
1:21:11successfully. So guys, if you encounter
1:21:14errors like this permission denied, then
1:21:18just write the pseudo command before the
1:21:21actual command, then the command will be
1:21:24executed. This is as easy as that. And
1:21:27there is another tool called airmon ng.
1:21:30If I press enter, as you can see, run it
1:21:33as root. It means it also needs the
1:21:36pseudo privileges. If I type pseudo,
1:21:39press enter. Now as you can see this
1:21:41command has been executed successfully.
1:21:44So guys whenever you want to perform
1:21:47administrative tasks or encounter errors
1:21:50like run it as root or
1:21:54permission denied then just write the
1:21:57pseudo command before the actual command
1:22:00then everything will be fine.
1:22:04Now let's address a very important
1:22:06question. who can access or use the sudo
1:22:10command. Remember, not every regular
1:22:13user can use the sudo command. Only
1:22:16users who have been granted pseudo
1:22:19privileges or permission to use the sudo
1:22:22command can use or access it. By
1:22:26default, only one regular user account
1:22:29has permission to use the sudo command.
1:22:33The user account that you create or set
1:22:36up during installation is allowed to use
1:22:39the pseudo command. When you install
1:22:42Ubuntu, Kali Linux or any Linux based
1:22:45operating system, you have to set up a
1:22:47user account and password for that
1:22:50account during the installation. Right?
1:22:53The user account that you set up during
1:22:56installation is automatically given
1:22:58permission to use the pseudo command.
1:23:02Only that particular user can use the
1:23:05pseudo command. Any user accounts that
1:23:08you create after the installation can't
1:23:11access the pseudo command. They have
1:23:13limited access to the system and can't
1:23:16perform administrative tasks or use the
1:23:20pseudo command. Now, how do you know
1:23:23whether a user account can access or
1:23:26have permission to use the pseudo
1:23:29command? It is simple. We need to use
1:23:32the ID command to verify that. Now, type
1:23:36ID space. Now, specify the username that
1:23:39you want to check sudo permissions for.
1:23:43I'm going to check whether the dimallu
1:23:46user has permission to use sudo or not.
1:23:49Type username. Press enter. Here we have
1:23:52a lot of information. We will dissect
1:23:55this information in a dedicated section.
1:23:58For now, here you only need to see if
1:24:01the sudo is mentioned here or not. Here
1:24:05we have groups. So groups equal to and
1:24:08here it is sudo. As you can see guys,
1:24:11sudo is here. It means the user Dimalu
1:24:14is part of the pseudo group. So the
1:24:18demalu user has permission to access the
1:24:21sudo command. Now I have another user
1:24:24account on my system which is guest and
1:24:28let me press enter to see if it has
1:24:31access to the sudo command or not. Press
1:24:34enter. As you can see guys, this is a
1:24:37regular user account that I created
1:24:39after installing the Kali Linux. And
1:24:42here uh we don't have sudo mentioned
1:24:45anywhere. It means that the guest user
1:24:49does not have access to the pseudo. It
1:24:52can't use or access the pseudo command.
1:24:56Again guys, I'm wrapping up this video
1:24:58with the note that only the user account
1:25:01that you create or set up during the
1:25:04installation has the access to the sudo
1:25:07command. user accounts that you add
1:25:10after uh installation don't have
1:25:13permission to use the pseudo command. In
1:25:16this video, we are going to look at the
ip addr Command
1:25:19IP adder command. This is a very
1:25:22important command for administrators and
1:25:25you will be using it a lot. So, what is
1:25:28it? The IP adder command is used to
1:25:31display information about the network
1:25:34interfaces such as Ethernet or wireless
1:25:37network adapter on your computer. It
1:25:40provides network details like IP address
1:25:43assigned to each interface, network
1:25:45masks, MAC address and other network
1:25:48related details. By using this command,
1:25:51you can easily check and manage your
1:25:54network settings. Now let's jump into
1:25:57the practicals. Type IP
1:26:02sorry IP space adder space show. Now the
1:26:07IP adder command with show parameter
1:26:11displays all the installed network
1:26:14interfaces on your system. So press
1:26:16enter. As you can see guys, these are
1:26:19the installed network interfaces along
1:26:22with their configurations. The first
1:26:25interface that we have is the LO. LO
1:26:28stands for loop back. It is up and
1:26:31running. The loop back is also known as
1:26:34the local host. This is the address for
1:26:37the loop back. Now loop back is not a
1:26:40physical network interface, right? It is
1:26:43a virtual interface. You can't use the
1:26:47loop back for connecting to a network.
1:26:51The loop back points to your own system.
1:26:54It can't communicate with external
1:26:57networks. The loop back is not that
1:26:59important for now. I will get back to
1:27:02loop back when we will set up the Apache
1:27:05web server. Now the most important part
1:27:08for us is this ETH0.
1:27:11The Ethernet network interface is
1:27:15represented by the ETH0 in Kali Linux.
1:27:20I'm connected to my network using
1:27:22Ethernet. So under the Ethernet I have
1:27:26all the network configuration details.
1:27:29As you can see this is the IP V4
1:27:33address. Inet essentially means IP
1:27:35address. BRT is short for broadcast
1:27:38address. This is the broadcast address.
1:27:40And here we have the MAC address. The
1:27:44MAC address is known by different names
1:27:48such as ether
1:27:50link or hardware address. So this is the
1:27:54MAC address. And down here we have the
1:27:56IPv6 address as well. Now here we don't
1:28:00have the details for wireless card or
1:28:03wireless interface. Right? This is
1:28:05because a virtual machine can't access
1:28:09the built-in wireless card because it is
1:28:12already being used by your main
1:28:15operating system or your host operating
1:28:18system. But if you connect an external
1:28:22wireless card then that will be listed
1:28:26here. A wireless card is represented by
1:28:30WLAN zero. So if or when you connect an
1:28:34external card then IP adder command will
1:28:38display that card as well under the name
1:28:42WLAN0. You will see something like WLAN0
1:28:47in this list of interfaces. Now the show
1:28:51parameter is not
1:28:54mandatory if you only want to list the
1:28:58installed network interfaces. So just
1:29:01type IP adder IP space add header then
1:29:04it will uh print all the network
1:29:07interfaces along with their
1:29:09configuration details and instead of
1:29:12using adder we can use its shortand
1:29:16which is a. So IP space a press enter as
1:29:20you can see it is producing the same
1:29:23result as the last command which was
1:29:26this. So IP A is the shortand for adder.
Install Packages
1:29:32In this video we will finally learn how
1:29:35to install packages or applications from
1:29:38the terminal. It is actually easy. Type
1:29:41sudo. Now before actually installing a
1:29:45new application, we should always run
1:29:47the apt update command. It will update
1:29:51your local repositories which will help
1:29:53the package manager to download the
1:29:57latest possible version of the
1:29:59application that you are downloading as
1:30:02we discussed in the previous video. So
1:30:04let me quickly run the
1:30:07update command. So type apt update. It
1:30:09will uh update your local database.
1:30:12Press enter. Let the update command
1:30:15finish. Now the update command is
1:30:17complete. We are good to go. Now we can
1:30:20proceed with installation. So type sudo
1:30:24apt. The apt as we discussed in the
1:30:27previous video allows us to install,
1:30:30remove and update packages. So after apt
1:30:35type install install parameter allows us
1:30:38to specify name of the package or
1:30:41application that you want to install.
1:30:44I'm going to install let's say WC. So
1:30:46type the name of the package that you
1:30:49want to install. So this command is
1:30:52going to install the specified package
1:30:55WC. Remember guys, apt will only be able
1:30:58to install the specified package if it
1:31:02is available in the repositories. Now
1:31:05press enter. Provide your password. Let
1:31:08me scroll up a little. And here these
1:31:12are the dependencies that apt is going
1:31:15to install because WC needs all these
1:31:18dependencies to function properly. Now
1:31:21scroll to the bottom here we have this
1:31:23prompt continue. If you want to continue
1:31:26or proceed with installation then we
1:31:29need to type Y. Y is for yes N is for
1:31:33no. I'm going to proceed with
1:31:35installation. So type Y. Press enter and
1:31:38it will take a few seconds or probably a
1:31:42minute to complete the downloading and
1:31:45installation.
1:31:48All right, the installation is complete.
1:31:50Now let's verify whether the WC has has
1:31:54been installed or not. Type WC. Press
1:31:57enter. As you can see guys, WC is up and
1:32:01running. So installation was successful.
1:32:04Similarly, you can install any other
1:32:07package or application that you want.
1:32:10Let me install another application.
1:32:14Type sudo. The steps remain same.
1:32:18Type apt install. After install, specify
1:32:22name of the package that you want to
1:32:25install. I'm going to install htop. HTOP
1:32:27is basically a system monitoring tool.
1:32:30Press enter.
1:32:32And uh the installation is almost
1:32:36complete. As you can see installation is
1:32:38complete. Now type htop to verify its
1:32:42installation.
1:32:43Press enter. As you can see guys, this
1:32:46is the the htop. We are inside edtop and
1:32:50at the bottom it is displaying all the
1:32:53running processes on my system and in
1:32:56the top half it is displaying the system
1:33:00resources being consumed like RAM
1:33:04processor etc. Now press Q to exit out
1:33:07of the edtop. So guys that's how you can
1:33:11basically install the applications. The
1:33:14syntax for installing every application
1:33:17is same after install parameter specify
1:33:22name of the package or application that
1:33:24you want to install and if the specified
1:33:28package is available in the repositories
1:33:31then the package will be installed.
1:33:34Thank you very much guys. In this video
Remove Packages
1:33:36we are going to learn how to remove or
1:33:39uninstall packages uh from terminal. So
1:33:43type sudo
1:33:45space. The tool for removing packages is
1:33:50apt. The same tool that we used for
1:33:52installing applications. After apt, type
1:33:56remove. Now specify a name of the
1:33:59package or application that you want to
1:34:03remove. I'm going to remove WC. So apt
1:34:06is going to remove the specified package
1:34:10WC. Press enter. provide your password
1:34:14and here as you can see removing the
1:34:17package name we'll see type n if you
1:34:19don't want to continue uninstallation
1:34:22and if you want to proceed with
1:34:24uninstallation type y press enter and it
1:34:28will uninstall the package as you can
1:34:31see it has been uninstalled now guys
1:34:34after executing the remove command we
1:34:38need to execute the auto remove command
1:34:41command and uh let me type apt
1:34:44auto remove. Now what happens is that
1:34:48the remove command only removes the main
1:34:52executable file. It does not remove the
1:34:56dependencies that were installed with a
1:34:59package. It basically removes the
1:35:01dependencies that are no longer
1:35:04required. So press enter. And if I
1:35:07scroll up, as you can see guys, it is
1:35:09going to remove all these dependencies
1:35:12that were installed with WC. Now type Y
1:35:16to proceed with uninstallation.
1:35:22It will complete the uninstallation. Now
1:35:25as you can see command has been executed
1:35:27successfully. Now let's uh verify
1:35:30whether WC is still there or not. So
1:35:32type WC. As you can see guys, WC is no
1:35:36longer showing up. It has been removed
1:35:40successfully. Similarly, you can remove
1:35:42any application or installed package
1:35:46that you want. Just specify name of the
1:35:50installed package after the remove then
1:35:53it will remove that package. So thank
1:35:55you very much guys. That's it for this
Introduction to Nmap
1:35:57video. In this section we are going to
1:36:00learn how to use N mapap. N MAP is an
1:36:03extremely important tool in cyber
1:36:06security. Whether you are a network
1:36:08engineer, cyber security analyst or an
1:36:11ethical hacker, NAP is useful for
1:36:14everyone in general. It is a tool that
1:36:17should be part of your cyber security
1:36:20skill set. Now, what is N MAP? N MAPAP
1:36:22is an advanced information gathering
1:36:25tool that hackers and pentesters use to
1:36:29obtain information about the systems
1:36:32they intend to hack or test. Now what
1:36:35happens is that before actually hacking
1:36:38a system, attackers need to collect
1:36:41information about their target system.
1:36:44Hackers search for openings or possible
1:36:47access points for infiltration. N MAP
1:36:50provides this information quite easily
1:36:53and masterfully. N MAPAP is a port
1:36:56scanning tool. It scans for open ports,
1:36:59vulnerabilities and various services
1:37:01running on a system. This is the first
Scan Ports
1:37:04practical video on N MAP. In this video,
1:37:08we will learn the fundamentals of N
1:37:11MAPAP scanning and analyze all three
1:37:14states of a port. Now, let's jump into
1:37:17the practicals. So, open your terminal
1:37:20and type n map. The first thing that I
1:37:24always like to do when learning a new
1:37:27tool is check the options that it
1:37:30offers. So, type n mapap two hyphens
1:37:33help. The help parameter displays all
1:37:37the options that can be used with n map.
1:37:40So, press enter. As you can see, these
1:37:43are the options or available options
1:37:45that can be used with n map. Let me tell
1:37:48you guys, NAPAP is a very advanced tool.
1:37:52Therefore, it offers all these options.
1:37:54So, feel free to go through uh this this
1:37:57uh documentation.
1:37:59Now, type n map space. Now, before
1:38:03scanning the target network, you should
1:38:06always check whether it is up and
1:38:09running or not because if it is not
1:38:12running, then it is pointless to scan.
1:38:16So type hyphen S uppercase P. S stands
1:38:20for scan. P stands for ping. In the
1:38:23background, N MAPAP conducts the ping
1:38:26scan to check whether the specified host
1:38:29is up and running or not. Now specify
1:38:32the name of the host. You can either
1:38:34specify an IP address or a domain name.
1:38:39I'm going to specify the domain name
1:38:41scanme.nmap.org.
1:38:45Remember guys, you can't randomly scan
1:38:48any website on internet with N MAPAP. It
1:38:52is illegal. Fortunately, N MAPAP
1:38:54provides this specific server or
1:38:58subdomain that we can use for learning N
1:39:02MAPAP or practicing N map or if you have
1:39:06your own server or domain then you can
1:39:09specify that as well. Now the way this
1:39:12command is going to work, N map MAPAP
1:39:14will conduct the ping scan in the
1:39:16background to check whether the provided
1:39:19host is running or not. Press enter. As
1:39:22you can see one host up. It means the
1:39:25specified host is is up and running. Now
1:39:28we can proceed further with the
1:39:31scanning. Type n map. Type the name of
1:39:36your target network. scan me dot nm
1:39:39mapap.org.
1:39:42Now this is the default n mapap scan
1:39:45without any options. By default n mapap
1:39:49scans the most popular 1,00 ports. If
1:39:54you don't provide any options like this
1:39:56then n mapap will scan the most popular
1:40:001,00 ports. So press enter. It is going
1:40:03to take uh some time to complete the
1:40:05scan because NAPAP has to go through all
1:40:09the 1,00 popular port numbers and
1:40:12determine their state whether they are
1:40:15open or filtered. As you can see guys,
1:40:18the scan is complete. Now let's analyze
1:40:21the result. The first nice thing that
1:40:24the N map does is it prints the IP
1:40:28address. As you can see in the brackets,
1:40:30we have this IPv4 address. This is the
1:40:34IPv4 address of this specified host.
1:40:38Now, instead of using this domain name,
1:40:41we can directly use this IPv4 address.
1:40:45So, what I'm going to do is copy this
1:40:47IPv4 address. And here is the IPv6
1:40:51address for this domain name. Now let's
1:40:54analyze the actual result which is this.
1:40:58So here we have 987
1:41:01port numbers closed and remaining 13 are
1:41:05either open or filtered. We have three
1:41:07columns here. Port port column displays
1:41:10the port number. State column displays
1:41:14the state of a port. There are two
1:41:17possible states of a port. Either it can
1:41:20be open or filtered. We'll get back to
1:41:23it in a minute. Then we have service
1:41:26column. It displays the service running
1:41:28on a port. For example, the port number
1:41:3122. It is open and the service running
1:41:35on port number uh 22 is SSH. The default
1:41:39port for SSH is 22. Now what does the
1:41:43open port mean? It means that this port
1:41:47is accepting connections or ready to
1:41:50accept connections. The SSH essentially
1:41:54allows us to access servers or computers
1:41:58remotely from anywhere. So if the SSH
1:42:01port is open, it means you can access uh
1:42:04a server or computer remotely from
1:42:08anywhere. You just need to provide the
1:42:11correct login credentials. Now what does
1:42:14the open port mean from a hacker's
1:42:17perspective? Well, if the legitimate
1:42:20users can access or log in the SSH, so
1:42:24can hackers. Hackers can basically hack
1:42:27the SSH service by brute forcing its
1:42:31login credentials or if the SSH version
1:42:35is vulnerable, then they can exploit
1:42:38that particular vulnerability. So an
1:42:41open port can be vulnerable if it is not
1:42:44properly protected. Then we have port
1:42:47number 25 which is filtered. Now what
1:42:50does the filtered port number mean? It
1:42:52means it is probably protected by a
1:42:56firewall. Only the authorized person can
1:43:00access the port number 25 or you can say
1:43:04only the authorized users can connect to
1:43:07port number 25. We have a plenty of open
1:43:11ports such as FTP. FTP is similar to
1:43:15SSH. The only difference is that SSH is
1:43:18secure. Communication on SSH is
1:43:21encrypted whereas on FTP the
1:43:25communication is carried out in plain
1:43:27text. So that's it for this video guys.
1:43:31Thank you very much for watching and if
1:43:33you have any questions then let me know.
Wi-Fi Security: System Requirements & Wireless Card
1:43:40Hello and welcome to this course where
1:43:42you will learn wireless security from
1:43:45scratch. This course is suitable for
1:43:48absolute beginners who want to learn
1:43:51about Wi-Fi attacks and defense. How
1:43:55attackers hack a Wi-Fi network and how
1:43:58to detect and protect against Wi-Fi
1:44:02attacks. To learn defensive strategy,
1:44:04first we need to understand how a Wi-Fi
1:44:08network is compromised. Then we will be
1:44:11able to develop a good defensive
1:44:13strategy. By the end of this course, you
1:44:16will be able to secure your Wi-Fi
1:44:19network from all potential threats. This
1:44:23is a detailed course where everything
1:44:26will be covered from scratch. You will
1:44:29be taught how things work behind the
1:44:32scenes or attacks, not just commands.
1:44:35Now, you need an external wireless card
1:44:38for Wi-Fi penetration testing. These are
1:44:41the recommended cards suitable for Wi-Fi
1:44:45pentesting that you can consider
1:44:47purchasing. They are all compatible and
1:44:50supported by Kali Linux. We are going to
1:44:54use Kali Linux for Wi-Fi penetration
1:44:57testing. Kali Linux has all the tools
1:45:00pre-installed that we need for Wi-Fi
1:45:03penetration testing and security. In
1:45:06this video, we will learn how to connect
1:45:09your wireless network card to Kali Linux
1:45:12and address the common errors that may
1:45:16arise initially. Now, let's dive into
1:45:19the practicals. Before you plug in or
1:45:23connect your wireless card, we need to
1:45:26upgrade the system. So type sudo app.
1:45:29First we need to update the
1:45:31repositories. Now provide your password.
1:45:34Let the update command. Finish.
1:45:40Now once the update command completes
1:45:42then we need to execute upgrade command.
1:45:46So type sudo
1:45:48upgrade. Press enter. Now type Y. Press
1:45:53enter. Let the upgrade command. Finish.
1:45:57It is very important. Now once the
1:45:59upgrade command finishes, now we are
1:46:02good to go. Now plug in or connect your
1:46:05wireless network adapter to your USB
1:46:09port. To use your wireless card in your
1:46:13Kali Linux virtual machine, go to the
1:46:15devices, click on USB, and your wireless
1:46:20network cards name should appear in this
1:46:23list. I have an alpha network card that
1:46:26uses an Athereious chipset. As you can
1:46:29see, it is listed here. So, click on
1:46:32your network card or appropriate network
1:46:36card. I'm going to click on Athere.
1:46:38Now once selected Kali Linux is going to
1:46:41take around 15 to 20 seconds to set up
1:46:46everything when you use your wireless
1:46:49network card for the first time in Kali
1:46:52Linux. Now wait for uh 15 to 20 seconds.
1:46:55Now to verify whether your card is
1:46:58detected by Kali Linux or not, type IP
1:47:03space a press enter. As you can see
1:47:06guys, WLAN zero, my wireless card has
1:47:09been detected. W stands for wireless,
1:47:12LAN stands for local area network and
1:47:15the number zero represents the card
1:47:19number. Each wireless card has a unique
1:47:21number assigned to it. The first
1:47:23wireless card that you connect is
1:47:25assigned number zero. If you connect
1:47:27another card, that card will be assigned
1:47:30number one. In case if your card is not
1:47:34appearing or Kali Linux has not detected
1:47:37it then disconnect your card then
1:47:39reconnect again and repeat the same
1:47:43steps. Go to the devices USB click on
1:47:47Ethereos or whatever chipset your card
1:47:50is using. Now let me verify again. As
1:47:53you can see WLAN zero it has been
1:47:55detected. Once detected, now you can use
1:47:58your wireless card to connect to a Wi-Fi
1:48:02network. Click on the networks icon.
1:48:05Click on available networks. Now select
1:48:08the Wi-Fi network that you want to
1:48:11connect to. As you can see now,
1:48:13sometimes you might encounter errors
1:48:15like this.
1:48:18Can't attach USB device. Failed to
1:48:22attach the USB device. In case if you do
1:48:25encounter such an error then solution is
1:48:28simple. Disconnect your wireless card
1:48:32then reconnect again. Now go to the
1:48:35devices USB. As you can see my network
1:48:38card is already selected. If it is
1:48:41already selected then you don't need to
1:48:44do anything. Just wait for a few seconds
1:48:47and type IP
1:48:50IPA to verify it as you can see. And if
1:48:53it is not uh selected then select your
1:48:57chipset then it should automatically
1:49:00solve the problem. In case you have a
1:49:03different network card and Kali Linux is
1:49:06not detecting it, post your questions in
1:49:09the Q&A section. I will definitely
1:49:11answer your queries there. If you have a
1:49:14network card that I recommended Kali
1:49:17Linux will detect them automatically.
1:49:20you don't need to install drivers for
1:49:23them if you use Alpha series cards. Now
1:49:26once uh the wireless card is detected
Introduction to Aircrack-ng
1:49:30now we are good to go. Now let's talk
1:49:32about the tools that we are going to use
1:49:34for wireless penetration testing. The
1:49:37tool that we are going to use is air
1:49:40crackng. Now air crackng is not a single
1:49:43tool rather it is a complete suite. It
1:49:47is collection of many tools. Airng is
1:49:51the best tool out there for testing
1:49:54wireless security. Each tool within air
1:49:57crackng is designed for specific tasks.
1:50:01For example, air crack suite has a tool
1:50:04called aerodyump. Aerodyump is used for
1:50:08capturing packets. And uh then we have
1:50:12uh airmon nng which is used for
1:50:16controlling the monitor mode. The air
1:50:18crackng itself is used for cracking
1:50:22passwords. There are many more tools uh
1:50:25in the air crack suite that we will
1:50:27explore as we progress through the
1:50:30course. Now we need to verify whether
1:50:33air crackng is detecting the wireless
1:50:36card or not. So type sudo
1:50:41airmong press enter. Provide your
1:50:44password. As you can see, Airmon NG has
1:50:46also detected the wireless card. It
1:50:50means this card is compatible with
1:50:52Airmon NG. Now, we are good to go.
1:50:56Remember guys, you will need to repeat
1:50:59the same steps each time you want to use
1:51:03your wireless adapter in your Kali Linux
1:51:06virtual machine. Right. After plugging
1:51:09in the card, you need to go to the
1:51:11devices USB, then select uh your
1:51:14wireless card. In this video, we will
Monitor Mode vs Managed Mode
1:51:17discuss managed and monitor modes. A
1:51:20wireless network card can operate in two
1:51:24modes, managed and monitor mode. In
1:51:27managed mode, also known as normal mode,
1:51:30the wireless network adapter is used for
1:51:33standard tasks such as connecting to
1:51:37Wi-Fi networks, accessing the internet,
1:51:39and utilizing other network resources.
1:51:43Monitor mode, on the other hand, is
1:51:45entirely different. It allows us to
1:51:48intercept or capture all network traffic
1:51:51being transmitted over a specific Wi-Fi
1:51:55network or all surrounding wireless
1:51:58networks within its range. Wireless
1:52:01cards operate in managed mode by
1:52:03default, allowing you to connect to
1:52:06Wi-Fi networks. However, to capture or
1:52:09monitor network traffic, we need to
1:52:12switch or change the network card to
1:52:16monitor mode. In monitor mode, a
1:52:18wireless network adapter can capture
1:52:21wireless network traffic within its
1:52:23range. Now, let's discuss the real
1:52:26question. Why do we need to capture
1:52:29wireless network traffic? Well, to hack
1:52:33a Wi-Fi network, certain information is
1:52:36required. This information can be
1:52:39obtained by capturing packets and
1:52:42monitor mode allows you to capture those
1:52:45required packets. Specifically, we need
1:52:48the four-way handshake which can be
1:52:50intercepted using monitor mode. However,
1:52:54it is important to note that this mode
1:52:57is often used for legitimate purposes by
1:53:01network administrators, security
1:53:03professionals, and researchers. They use
1:53:06it to monitor and analyze wireless
1:53:08network traffic for troubleshooting,
1:53:11security testing and research purposes.
1:53:14In the next video, we will enable the
1:53:16monitor mode. In this video, we will
Enable Monitor Mode
1:53:19finally learn how to enable and disable
1:53:23monitor mode as well as how to restart
1:53:25the network manager. Now, let's jump
1:53:28into the practicals. First connect or
1:53:32plug in your wireless network card. I
1:53:35have already plugged in mine. Uh let me
1:53:38verify that. Type ip space a. Press
1:53:41enter. As you can see here it is wln
1:53:44zero. I'm going to put a wl zero into
1:53:47the monitor mode. So type sudo
1:53:51airmon nng. Airmon nng is part of the
1:53:54air crack suite. It is used for
1:53:58controlling the monitor mode including
1:54:01enabling and disabling it. Now before
1:54:04enabling the monitor mode, we need to
1:54:07check for processes that might cause
1:54:10problems later. There are certain
1:54:13processes that might put your card back
1:54:16to the managed mode from monitor mode.
1:54:20So let's check those processes. Pass
1:54:22check parameter. It will list those
1:54:24processes. Press enter. As you can see,
1:54:28found two processes that could cause
1:54:30problems. Now we need to terminate these
1:54:33processes. It is easy. After check type
1:54:36kill, kill parameter is going to kill or
1:54:39terminate those processes. Press enter.
1:54:42As you can see this process has been
1:54:45terminated. Now we are good to go. Type
1:54:48sudo demon space type start space. Now
1:54:54specify the name of your wireless card
1:54:57that you want to put into the monitor
1:55:00mode. For me, it is WLAN0. Now, Airmon
1:55:03NG is going to start the monitor mode on
1:55:07this specified wireless card. WLAN 0.
1:55:12Press enter. As you can see, monitor
1:55:15mode enabled for WLAN 0 on WLAN0
1:55:20mon. It means that the specified
1:55:23wireless card WLAN0 has been put into
1:55:26the monitor mode under uh the new name
1:55:30WLAN0
1:55:32mon. And if you want to use or access
1:55:36the monitor mode, then we have to use
1:55:39this name WLAN 0 M O N or whatever name
1:55:43it is after this particular part. Now
1:55:47let's actually verify whether the card
1:55:49is in monitor mode or not. Type ip space
1:55:53a at the bottom. As you can see wlan
1:55:56zero mon the card is indeed in the
1:55:59monitor mode. We can also use iw config
1:56:03command to verify the monitor mode.
1:56:06Press enter. As you can see mode
1:56:09monitor. Now once your card is in
1:56:12monitor mode, you can't use it for
1:56:15general purpose like connecting to the
1:56:18Wi-Fi networks. In monitor mode, we can
1:56:20capture traffic and monitor all the
1:56:23Wi-Fi networks within your network cards
1:56:27range. We will do that in the next
1:56:30video. Now, let's learn how to put your
1:56:33card back to the managed mode. At some
1:56:36point you will need to put your card
1:56:39back to the managed mode right once you
1:56:42are done with uh Wi-Fi pen testing. So
1:56:45type sudo
1:56:48airmon ng stop. Now type name of your
1:56:53monitor mode which is w lan 0 m o n for
1:56:58me. Now airmon ng is going to stop the
1:57:01monitor mode w0
1:57:04mon. Press enter. As you can see guys,
1:57:07monitor mode disabled for WLAN0.
1:57:11And now let me list interfaces IP space
1:57:15A. As you can see guys, the card is back
1:57:19to the managed mode. Uh let me actually
1:57:23type Iw config. Press enter. As you can
1:57:27see mode managed. Now after putting your
1:57:31card back to the managed mode, you
1:57:34should always restart your network
1:57:36manager. So type sudo system sorry
1:57:41systemctl
1:57:42space restart type network
1:57:48manager. Make sure that n is in
1:57:51uppercase and m also must be in
1:57:54uppercase. Now what this command is
1:57:56going to do, it will reset your network
1:57:59configurations, fix common problems and
1:58:02your card will become ready to be used
1:58:05in managed mode. Press enter. Now
1:58:10command has been executed successfully.
1:58:13Now click on your uh network icon. As
1:58:16you can see guys, now my wireless card
1:58:19is up and running. That's it for this
1:58:22video guys. Thank you very much for
Scan Wi-Fi Networks & Capture Traffic
1:58:23watching. In this video, we will learn
1:58:25how to detect or discover Wi-Fi networks
1:58:29within your network adapters range,
1:58:33explore the fundamentals of Aerodyump NG
1:58:35scan, and save the network traffic to a
1:58:39file. This is definitely going to be an
1:58:42exciting and informative video. So,
1:58:45let's dive into the practicals. The
1:58:48first thing that you are going to do is
1:58:50put your wireless network adapter into
1:58:54the monitor mode. I have already enabled
1:58:57monitor mode. Let me verify that. Type
1:59:00IP space A. Press enter. As you can see,
1:59:03WLAN0. My card is already in the monitor
1:59:07mode. We need the monitor mode for
1:59:10capturing wireless network traffic and
1:59:13discovering Wi-Fi networks. Once your
1:59:16card is in monitor mode, we are good to
1:59:19go. Now type sudo
1:59:22aerodyump nng. Aerodyump nng is also
1:59:26part of the air crack suite. Aerodyump
1:59:30is a powerful tool used for capturing
1:59:33wireless network traffic. It also
1:59:36discovers and displays information about
1:59:39the nearby Wi-Fi networks. Now after
1:59:43aerodyump specify name of your monitor
1:59:46mode which is WL0 mon for me. Now this
1:59:50particular aerodyump command is going to
1:59:53discover and display information about
1:59:57all the available Wi-Fi networks within
2:00:00the range of your wireless card. Let me
2:00:03press enter. As you can see guys, the
2:00:06aerodyump is scanning for the nearby
2:00:09Wi-Fi networks. It scans and lists all
2:00:14the nearby Wi-Fi networks within the
2:00:17range of your wireless card. Now, we
2:00:20have a lot of information here, right? I
2:00:23will break down everything. We have two
2:00:25sections here. In the first half, it
2:00:28displays all the Wi-Fi networks that it
2:00:31has detected along with their
2:00:34information. In the bottom half, it
2:00:36displays the devices that are connected
2:00:39to these Wi-Fi networks. Now, first
2:00:42thing that we have to understand is what
2:00:46all these columns mean, what information
2:00:50they represent. Now, the first field is
2:00:53BSS ID. BSS ID refers to the MAC
2:00:57address. Each wireless access point or
2:01:00wireless router has a MAC address. For
2:01:03example, the MAC address for uh the
2:01:05network cyborg is this. Then we have
2:01:08PVR. PVR indicates the signal strength.
2:01:12It basically tells us how close uh we
2:01:15are to a Wi-Fi network. If the PVR value
2:01:20is around 70 or above 70, then it means
2:01:24the signal strength is weak. If it is
2:01:28below 60, then uh the signal strength is
2:01:31considered average. And if this value is
2:01:34below 40 then it means the signal
2:01:37strength is strong. You are close to a
2:01:40Wi-Fi network or you have a very
2:01:43powerful wireless card. Then we have
2:01:46beacons column. It displays the total
2:01:50beacon packets that a Wi-Fi network has
2:01:53transmitted. A Wi-Fi network uses beacon
2:01:57packets to announce its presence. On
2:02:01average, a Wi-Fi network sends around 10
2:02:04beacon packets per second. In simple
2:02:06terms, through beacon packets, a Wi-Fi
2:02:09network basically tells the nearby
2:02:11wireless devices, I am available. You
2:02:14can connect to me if you have the proper
2:02:17authority. Then we have data column. It
2:02:21displays the number of packets captured
2:02:24by the network card on each listed
2:02:28network. Here remember guys, aerodyump
2:02:30is capturing or listening to the network
2:02:34traffic of each network that it has
2:02:37detected or listed. Here later in the
2:02:40video I will demonstrate how to save the
2:02:43captured packets. Data field helps us to
2:02:47understand the amount of data traffic on
2:02:50the network. And next is forward slash
2:02:54s. It stands for seconds. It shows the
2:02:57average number of data packets a network
2:03:00has transmitted each second calculated
2:03:04over the last 10 seconds. And then we
2:03:07have CH. CH stands for channel number.
2:03:11It displays the channel number on which
2:03:14the wireless access point or wireless
2:03:17network is operating. Then we have MB.
2:03:21MB displays the maximum speed supported
2:03:25by a Wi-Fi network. And next is ENC. ENC
2:03:30is short for encryption. It indicates
2:03:33the type of encryption protocol the
2:03:36network uses for encrypting packets. 95%
2:03:41of networks still use WPA2. Although
2:03:44WPA3 is available which is updated
2:03:47version of WPA2, it is considered more
2:03:51secure. However, WPA2 remains the most
2:03:54widely used encryption protocol with
2:03:57over 95% of networks still using it.
2:04:02WPA2 makes sure that data sent or
2:04:05received over a wireless network is
2:04:08encrypted. And next is cipher. Cipher
2:04:12refers to the specific algorithm used
2:04:14for encrypting and decrypting data
2:04:18within the encryption process. CCMP is
2:04:21specifically used with WPA2. It offers
2:04:25significantly more security compared to
2:04:29older protocols like WP and TKIP used in
2:04:34WPA. And next is O A U T. O refers to
2:04:39the authentication method used to
2:04:42protect against unauthorized access to
2:04:45the network. It specifies how devices
2:04:48are authenticated before being allowed
2:04:51to connect to the network. PSK stands
2:04:54for pre-shared key indicating that the
2:04:58Wi-Fi network utilizes a shared
2:05:00password. All users are required to use
2:05:04the common network password to connect
2:05:07to the network. To access the PSK Wi-Fi
2:05:11network, you will need to enter the
2:05:14correct Wi-Fi password. And the last
2:05:16column is ESS ID. It basically displays
2:05:20the name of Wi-Fi networks. Here we have
2:05:23two Wi-Fi networks, Cyborg and Sunny.
2:05:27And in the bottom half a dump displays
2:05:30devices that are connected to these
2:05:33Wi-Fi networks. First column BSS ID it
2:05:36displays MAC address of the wireless
2:05:39access point or wireless router. And
2:05:41station column displays MAC address of
2:05:44the device which is connected to a
2:05:47network. For example, this MAC address
2:05:51or wireless device is connected to this
2:05:55Wi-Fi network. And if a device is not
2:05:59connected to any Wi-Fi network, then you
2:06:02will see something like not associated.
2:06:05Not associated means the wireless device
2:06:08has not connected to any Wi-Fi network.
2:06:11It is still searching for Wi-Fi networks
2:06:14to connect. Now like I discussed earlier
2:06:17we can save the packets that aerodyump
2:06:21is listening or capturing. Now here the
2:06:24aerodyump is basically listening to the
2:06:27traffic of all these detected devices.
2:06:30We can save the traffic that it is
2:06:32capturing to a file. So press control +
2:06:35c to exit out of aerodyump. Okay. So
2:06:38type aerodyump ng wl0mon
2:06:42then type write. Write parameter allows
2:06:45us to specify the file name where you
2:06:49want to save the captured packets. Now
2:06:53you can specify a specific directory
2:06:55where you want to save. If you don't
2:06:58specify any specific directory then it
2:07:01will save the files in your current
2:07:04working directory. Now provide a file
2:07:07name. Let's say captured
2:07:10packets.
2:07:12Now Airdump is going to monitor the
2:07:14network traffic of all the Wi-Fi
2:07:18networks within its range and then save
2:07:21the traffic into this specified file
2:07:23captured packets. The files will be
2:07:26saved in your current working directory.
2:07:29Let me press enter.
2:07:32Now let me exit out of uh a dump by
2:07:36pressing control + C. Now type ls. As
2:07:39you can see, Aerodyump has created these
2:07:41different files. Aerodyump basically
2:07:44saves uh captured packets in different
2:07:47files. We have files with CAP extension
2:07:51CSV
2:07:52net XML ATC. However, only relevant file
2:07:56for us is this cap. We can open the cap
2:08:01files in Wireshark. Let's actually do
2:08:03that. type wireshark space and then
2:08:07specify the file name that you want to
2:08:09open. Now what Wireshark is going to do,
2:08:11it will open uh this specified file. Let
2:08:15me press enter.
2:08:18As you can see guys, inside uh this file
2:08:21we have the packets that the AOD dump
2:08:25captured. So guys, that's how you can
2:08:28save the captured packets uh to a file.
2:08:33So that's it for this video guys. Thank
2:08:35you very much for watching. In this
Scan 5GHz Wi-Fi Networks (Theory)
2:08:37video we will learn how to scan Wi-Fi
2:08:40networks operating on the 5 GHz
2:08:43frequency band. This is a theoretical
2:08:45video. Practical aspects will be
2:08:48demonstrated in the next video. There
2:08:51are certain things about 5 GHz networks
2:08:54that we need to understand before diving
2:08:57into the practical aspects. By default,
2:09:00a dump only scans and list networks in
2:09:04the 2.4 GHz band as we saw in the
2:09:08previous video. Now, what if a network
2:09:11is using only the 5 GHz band? Most
2:09:16networks use dual bands, but some
2:09:19specifically use only 5 GHz frequency
2:09:23band. To scan the 5 GHz networks, we
2:09:26have to use the band option in Aerodyump
2:09:29NG. Remember, this is important to scan
2:09:32or discover 5 GHz networks. Your network
2:09:36card must also support the 5 GHz band.
2:09:40That's the prerequisite. Now, we need to
2:09:43use the band parameter with a dump to
2:09:46scan for 5 GHz networks. The band option
2:09:50allows you to specify different bands or
2:09:54a combination of bands that you want to
2:09:57scan. Aerodyump supports two bands 2.4
2:10:00GHz and 5 GHz. We can also combine both
2:10:05which enables us to scan for both 2.4
2:10:08and 5 GHz networks. Now to scan and list
2:10:125 GHz networks, we need to use band a
2:10:16parameter with aerodyump. The letter A
2:10:20represents the 5 GHz band. We will
2:10:23demonstrate this practically in the next
2:10:25video. There are other options for the
2:10:28band parameter as well. B represents 2.4
2:10:31GHz band using the old 802.11b
2:10:36standard and G represents the 2.4 GHz
2:10:41band using the 802.11g
2:10:44standard which is more common. G is also
2:10:47the default mode. If you don't specify
2:10:49any bands, by default, a dump runs with
2:10:53the G option. And if you want to scan
2:10:56for both bands, you can use band AG
2:11:00option. Remember, specifying multiple
2:11:02bands can increase workload on your
2:11:05system and potentially slow down
2:11:07scanning. We will continue where we left
Scan 5GHz Wi-Fi Networks (Practical)
2:11:10off in the previous video. So in this
2:11:13video I will demonstrate how to scan for
2:11:165 GHz networks practically also how to
2:11:20scan for both 2.4 and 5 GHz networks
2:11:25simultaneously. Now let's dive into the
2:11:27practicals. So type sudo
2:11:31aerodyump ng space two hyphens type
2:11:35band. The band parameter allows us to
2:11:39specify the frequency band that you want
2:11:43to scan for. I want to scan the 5 GHz
2:11:47frequency band or Wi-Fi networks. Uh so
2:11:50type A. As we discussed in the previous
2:11:53video, A represents the 5 GHz frequency
2:11:58band. Now specify name of the monitor
2:12:01mode which is WLAN 0 mon. Now this
2:12:05particular aerodyump command is only
2:12:08going to discover and display the 5 GHz
2:12:13Wi-Fi networks or Wi-Fi networks using
2:12:16the 5 GHz frequency band. Remember guys,
2:12:20your wireless network adapter must
2:12:23support the 5 GHz band. Then only the
2:12:28Aerodyump will be able to scan and list
2:12:31the 5 GHz networks. Press enter. As you
2:12:35can see, Aerodyump has uh detected the 5
2:12:38GHz network. Uh it is still scanning. If
2:12:41it finds other 5 GHz Wi-Fi networks,
2:12:45then those will be listed as well. Now,
2:12:48how do you exactly know whether
2:12:51Aerodyump is scanning the 5 GHz networks
2:12:55or frequency band? Well, check out this
2:12:58particular section CH. It is showing the
2:13:02range of uh channels that it is
2:13:05scanning. The range of 5 GHz channels is
2:13:10from 36 to 165. On the other hand, range
2:13:14of 2.4 GHz channels is from 1 to 14. As
2:13:20you can tell, it is scanning between 36
2:13:24to 165. So guys, that's how you can scan
2:13:28and detect only 5 GHz networks. Now, I
2:13:33live in a very remote area, that's why I
2:13:36only have uh very few 5 GHz Wi-Fi
2:13:40networks. If you live in a densely
2:13:43populated area, then you might see a lot
2:13:46of 5 GHz networks. Now, let's scan the
2:13:522.4 GHz networks. I'm going to exit out
2:13:55of a dump by pressing Ctrl + C. Now, by
2:13:59default, the Aerodyump scans for the 2.4
2:14:03GHz networks. If you don't specify the
2:14:06band parameter, then by default, it is
2:14:09going to scan for 2.4 GHz networks.
2:14:12However, you can explicitly specify if
2:14:16you want to scan the 2.4 GHz band. So
2:14:21type band and specify G. G represents
2:14:24the 2.4 GHz band. Press enter. As you
2:14:28can see, this time it is only scanning
2:14:31the networks that use 2.4 GHz frequency
2:14:35band. As you can see the channel
2:14:37section. Now let's scan both 2.4 and 5
2:14:41GHz bands. To scan both, we need to
2:14:45provide A and G values to the band
2:14:48parameter. As you can see, I have
2:14:49specified A which represents 5 GHz and G
2:14:54which represents the 2.4 GHz frequency
2:14:58band. Now, this particular command is
2:15:00going to scan for both 2.4 and 5 GHz
2:15:05Wi-Fi networks. Remember guys, when you
2:15:08scan the multiple bands, it also
2:15:11increases the load on your system
2:15:14resources like RAM and processor. Press
2:15:17enter. Now check out the channels
2:15:20section. It is scanning the both bands
2:15:24from 1 to 14 and 36 to 165. That's how
2:15:28guys you can scan a particular band or
2:15:31multiple bands. That's it for this video
2:15:34guys. Thank you very much for watching.
2:15:35In this video we are going to discuss
What is a 4-Way Handshake
2:15:38the four-way handshake. In a wireless
2:15:41network, data is transmitted through the
2:15:45air using radio waves. Right? Since the
2:15:48data travels through the air, it is
2:15:51always vulnerable to interception. If
2:15:55the network is not properly protected,
2:15:59hackers can easily intercept and steal
2:16:02your information by capturing the
2:16:05unencrypted or unprotected data. This
2:16:09can lead to compromised devices and
2:16:13stolen personal information across the
2:16:16network. Therefore, we need a mechanism
2:16:19to protect the data. As we have seen in
2:16:22the previous video, data can easily be
2:16:25intercepted. This is where the four-way
2:16:28handshake comes in. It refers to the
2:16:32initial exchange of four packets between
2:16:36a client device like your laptop or
2:16:39phone and a wireless access point you
2:16:42are trying to connect to. As we
2:16:45discussed in the cryptography section,
2:16:48keys or encryption keys are used to
2:16:52encrypt data, right? So to encrypt
2:16:55wireless data, we need encryption keys.
2:16:59The four-way handshake is the process of
2:17:02generating encryption keys. Encryption
2:17:05keys generated by a successful four-way
2:17:09handshake are also known as session
2:17:12keys. The keys generated during the
2:17:16four-way handshake are used to encrypt
2:17:19data between the client device and
2:17:22wireless access point. The four-way
2:17:25handshake establishes a secure
2:17:27connection between client device and a
2:17:30wireless network so they can communicate
2:17:34securely over an encrypted channel.
2:17:37After a successful four-way handshake,
2:17:39the client device and the wireless
2:17:42access point can communicate securely.
2:17:45This allows the client to access the
2:17:48internet securely. data gets encrypted
2:17:51and even if attackers intercept this
2:17:54encrypted data they will only see
2:17:58scrambled or encrypted information not
2:18:01the original data itself. Now to hack a
2:18:05Wi-Fi network we need to capture
2:18:08four-way handshake. Capturing four-way
2:18:10handshake is essential. Four-way
2:18:13handshake contains all the necessary
2:18:16details to initiate the password
2:18:19cracking process. By capturing we main
2:18:22intercepting a successful four-way
2:18:25handshake. The four-way handshake is
2:18:28essentially the exchange of four packets
2:18:31between a client device and a wireless
2:18:35router or wireless access point. We need
2:18:38to intercept four packets of four-way
2:18:42handshake to initiate the password
2:18:45cracking. The encryption keys used to
2:18:49encrypt traffic are derived from a
2:18:52combination of Wi-Fi password, SSD, MAC
2:18:57address of the access point, MAC address
2:19:00of the client and nons values among
2:19:03other elements. All this information is
2:19:06used to generate the encryption keys or
2:19:10session keys. These elements undergo a
2:19:13cryptographic function to generate
2:19:15session keys which encrypt data during
2:19:19the Wi-Fi session. It is important to
2:19:22note that these elements are not
2:19:25directly combined to generate session or
2:19:28encryption keys. Instead, they go
2:19:31through four distinct steps within
2:19:34four-way handshake processor. I'm not
2:19:37going to cover the entire four-way
2:19:39handshake in detail because it requires
2:19:42a separate crash course to fully
2:19:44understand it. To crack Wi-Fi password
2:19:47and learn the process, you don't need to
2:19:51understand the exact steps. They are not
2:19:55essential at all. understanding the
2:19:58concept and its function is sufficient.
Capture a 4-Way Handshake
2:20:02This video is going to be very
2:20:04important. In this video, we will
2:20:06capture a four-way handshake. Capturing
2:20:10a valid four-way handshake is essential
2:20:13for cracking the password. Without a
2:20:16valid four-way handshake, we can't
2:20:18initiate the password cracking process.
2:20:21First we need to capture the four-way
2:20:24handshake and save it to a file. Once
2:20:27captured then this file can be used to
2:20:31launch the password cracking attack.
2:20:34First thing that we need to do is
2:20:38collect some essential information about
2:20:41the target network. We need certain
2:20:44information to hack or test a Wi-Fi
2:20:48network such as its MAC address and
2:20:51channel number. So type sudo
2:20:56aerot dump ng. Now specify name of your
2:21:00monitor mode which is w0 m o n for me.
2:21:04Now, a dump command is going to discover
2:21:07and display all the available Wi-Fi
2:21:10networks within the range of my wireless
2:21:14network adapter. Press enter. Now, keep
2:21:18scanning until your target network
2:21:21appears in this list. As you can see, my
2:21:25target network has already been
2:21:27detected, which is this Sunny. I'm going
2:21:30to test or hack my own Wi-Fi network.
2:21:34Once your target network gets detected,
2:21:37then you can exit the AO dump. Now I'm
2:21:40going to note down the MAC address and
2:21:43channel number of my target network in a
2:21:47file. So let me open a new terminal tab
2:21:50and I'm going to open nano to note down
2:21:53the details. MAC address
2:21:56and channel number.
2:21:59Let me copy the MAC address. This is the
2:22:04MAC address of my target network which
2:22:07is Sunny. Let me paste it here.
2:22:12And the channel number is 9. Now we need
2:22:16to monitor the network traffic of our
2:22:20target network. So type sudo space
2:22:28aotump nng space two hyphens bs ID bss
2:22:34ID refers to the MAC address. Now here
2:22:37we need to specify the MAC address of
2:22:41your target network. So what I'm going
2:22:45to do is uh copy the MAC address of my
2:22:49target network and paste it here. Now
2:22:53type- C hyphen C stands for channel. Now
2:22:57provide the channel number where your
2:22:59Wi-Fi network is broadcasting on. Mine
2:23:02is uh on 9
2:23:05space. Now specify the right parameter.
2:23:08Write parameter allows us to save the
2:23:11captured packets into a file. Now
2:23:14specify name of the file. I'm going to
2:23:17specify handshake.
2:23:20The aerodyump is going to save the
2:23:23packets that it captures in this uh
2:23:26specified file handshake. The file will
2:23:29be saved in your current working
2:23:32directory. Now what basically is going
2:23:34to happen the aerodyump is going to
2:23:38monitor or capture the network traffic
2:23:42of this particular Wi-Fi network. Then
2:23:46the packets that it captures will be
2:23:49saved to this file called handshake. And
2:23:53of course at the end you have to specify
2:23:55the monitor mode name which is wl0 m o n
2:23:59for me. Now press enter. As you can see
2:24:03guys, check out the channel. It is fixed
2:24:06at 9. So it is only capturing all the
2:24:09traffic going through this specified
2:24:12Wi-Fi network then saving that to the
2:24:16specified file which is handshake. Now
2:24:18the primary target of this video is to
2:24:21capture handshake. Right? So how to
2:24:23capture the four-way handshake? either a
2:24:27new device has to connect to the target
2:24:31network or an existing device has to
2:24:34disconnect then reconnect to the
2:24:37network. So as soon as a new device
2:24:40connects or reconnects to the network
2:24:43then the four-way handshake will be
2:24:47captured. Let me demonstrate this. What
2:24:49I'm going to do is I am already
2:24:52connected to my network, right? Let me
2:24:55disconnect from the network. Now, as
2:24:59soon as I reconnect, the four-way
2:25:01handshake will be captured. Let me
2:25:04reconnect.
2:25:07Uh, click on connect. As you can see,
2:25:10guys, WPA handshake, the four-way
2:25:12handshake for this Wi-Fi network has
2:25:17been captured. Now, we don't need to
2:25:20monitor the network traffic anymore.
2:25:24Once you capture the four-way handshake,
2:25:26you can exit. Press Ctrl + C to exit out
2:25:29of the AO dump. Now, let me ls. As you
2:25:32can see guys, we have handshake files
2:25:35with different formats like CSV, net XML
2:25:40and cap. Now, the file that we need is
2:25:44this handshake dot cap. We need this
2:25:47file to initiate the password cracking
2:25:51process. Before that we have to actually
2:25:53verify whether the four-way handshake is
2:25:57valid or not. It can be done using
2:26:00wireshark.
2:26:02Let me copy the handshake01.cap
2:26:06file. I'm going to open it in wireshark.
2:26:11So type wire chart. Paste the file name
2:26:13or type the file name. Press enter.
2:26:17Now in the filter bar type E A P O L
2:26:22press enter. Now E A P stands for
2:26:26extensible authentication protocol over
2:26:29LAN. It is a network communication
2:26:32protocol used for authenticating network
2:26:35devices. Now here as you can see we have
2:26:38four packets being exchanged between a
2:26:43wireless device and the Wi-Fi network.
2:26:46We have exact four packets. It means the
2:26:48four-way handshake was successful
2:26:51because a successful four-way handshake
2:26:53exchanges four packets between a
2:26:56wireless device and the Wi-Fi network or
2:26:59wireless access point. Now guys, this
2:27:03four-way handshake is extremely
2:27:06important. Four-way handshake is
2:27:08required to initiate the password
2:27:11cracking process. Okay. So, keep this
2:27:14handshake.
2:27:16file safe. We are going to need it later
2:27:19when we will crack the Wi-Fi password.
2:27:23Now guys, as you can tell, this method
2:27:26of capturing four-way handshake is not
2:27:29very efficient, right? We have to wait
2:27:32someone to connect to the network or uh
2:27:35someone to disconnect uh from the
2:27:38network then reconnect. It can be
2:27:40timeconsuming.
2:27:42We will address this problem in the next
2:27:44video. In this video, we will discuss
2:27:47the deauthentication attack which is
2:27:50essential for capturing four-way
2:27:53handshake and launching advanced attacks
2:27:56like evil twin attacks. Therefore, it is
What is a De-authentication Attack
2:27:59important to understand how it works. In
2:28:02the previous video, we captured a
2:28:05four-way handshake. Right? To capture
2:28:07four-way handshake, either a new device
2:28:11needs to connect to the network or an
2:28:15existing device needs to disconnect and
2:28:19then reconnect to the network. Right?
2:28:22Here we have an obvious problem. Right?
2:28:24In most cases, people are already
2:28:28connected to the network and new client
2:28:31devices may take a lot of time to
2:28:35connect. There you have to wait
2:28:38patiently. Now to address this problem,
2:28:41we have something called a
2:28:43deauthentication attack. A
2:28:45deauthentication attack works by
2:28:48disconnecting devices that are already
2:28:51connected to the network. In simpler
2:28:55terms, the deauthentication attack kicks
2:28:58off or disconnects devices from the
2:29:02network by sending deauthentication
2:29:05frames to all devices on the network.
2:29:08Once you disconnect devices, most
2:29:11devices reconnect automatically, right?
2:29:14So as soon as client reconnects whether
2:29:17manually or automatically the aerodyump
2:29:21captures four-way handshake
2:29:23deauthentication frames as we discussed
2:29:26in the fundamentals section are used to
2:29:30disconnect devices from the network. How
2:29:33a deauthentication attack basically
2:29:35works? The attackers pretend to be the
2:29:39router or access point by spoofing the
2:29:43router's MAC address and SSID or its
2:29:47name. They then send the authentication
2:29:50frames to the devices connected to the
2:29:54network on behalf of the router. The
2:29:57attacker uses router's MAC address and
2:30:00sends the authentication frames to the
2:30:03connected devices. When client devices
2:30:07receive deauthentication frames, they
2:30:10assume the frames are sent by the router
2:30:14or network. They immediately disconnect
2:30:18as soon as they receive the
2:30:20deauthentication frames. And when the
2:30:23user or client device reconnects, the
2:30:27four-way handshake gets captured. There
2:30:30is no default mechanism to verify
2:30:34whether the frames are coming from a
2:30:37legitimate router or attackers. Only
2:30:40latest 802.11x
2:30:43standard has automatic protection
2:30:45against deauthentication frames by
2:30:48default. That's how deauthentication
2:30:51attack works and is used by hackers.
Capture 4-Way Handshake Using De-authentication Attack
2:30:55We will continue where we left off in
2:30:58the previous video. In this video, we
2:31:00will learn how to capture the four-way
2:31:03handshake using the deauthentication
2:31:05attack and also fix the common errors
2:31:09you may encounter during the
2:31:11deauthentication attack. A
2:31:13deauthentication attack serves two
2:31:16purposes. One, capturing the four-way
2:31:18handshake and two, disrupting the
2:31:21network services. Now, let's dive into
2:31:24the practicals. Make sure that your
2:31:27wireless card is in monitor mode. I have
2:31:30already enabled monitor mode. Let me
2:31:33verify that. Type IP space A. Press
2:31:36enter. As you can see, WL0,
2:31:39my card is already in monitor mode. Once
2:31:42your card is in monitor mode, we should
2:31:44be good to go. First thing that I'm
2:31:46going to do is collect the MAC address
2:31:48and channel number of my target network.
2:31:52We are going to need both for launching
2:31:55a deauthentication attack as well as
2:31:57monitoring the traffic of my target
2:32:00network which will help us to capture
2:32:02the four-way handshake. So type sudo
2:32:06aerodyump sorry a dump ng space. Now
2:32:11specify name of uh your monitor mode
2:32:14which is wl0mon for me. Press enter. Now
2:32:18keep scanning until your target network
2:32:21appears in this list. And mine has
2:32:25already been detected. As you can see,
2:32:27my target network is Sunny. Press
2:32:30control + C to exit out of a dump. I'm
2:32:33going to note down the MAC address and
2:32:36channel number of my target network. So
2:32:40let me copy the MAC address
2:32:43and I'm going to open a new terminal
2:32:46tab. type nano and uh I'm going to note
2:32:51down the details in this uh file. Press
2:32:55control shift + v to paste
2:32:59and the channel number is uh five.
2:33:06Now I'm going to monitor the traffic of
2:33:09my target network. So type sudo
2:33:12aerodyump space
2:33:16type ps ID. Now
2:33:19copy and paste the MAC address of of
2:33:23your target network. After BSS ID paste
2:33:27the MAC address.
2:33:29Now type C. C is for channel number. Now
2:33:34type the channel number of your target
2:33:36network which is five for me. Space. Now
2:33:40type write. The write parameter as we
2:33:42already discussed in the previous
2:33:44practical video. It allows us to save
2:33:47the packets that Aerodyump captures to a
2:33:50file. So specify a file name where you
2:33:53want to save the packets. Four-way
2:33:58handshake. By default this file will be
2:34:01saved in my current working directory.
2:34:04And the last thing that uh a dump needs
2:34:07is the name of your monitor mode which
2:34:09is WLAN0 mon for me. So this particular
2:34:13aerodyump command is going to monitor
2:34:15the traffic of this specified Wi-Fi
2:34:18network and the packets that it captures
2:34:22will be saved to this specified file
2:34:254-way handshake. Now press enter. As you
2:34:29can see, it is capturing the packets and
2:34:32saving them into the specified file.
2:34:35Now, we need to launch the
2:34:37deauthentication attack. So, keep this
2:34:40aodm command running. I'm going to open
2:34:43a new terminal tab. Now, to execute the
2:34:46deauthentication attack effectively, we
2:34:48need to configure the network card to
2:34:51the channel number where the target
2:34:54network is operating. Sometimes you will
2:34:56encounter errors like WLAN zero mon is
2:34:59on channel N and AP uses another
2:35:03channel. To fix this problem, we need to
2:35:06set the wireless card to the channel
2:35:09number of your target network. So type
2:35:13uh sudo IW config space. Now specify
2:35:19name of your uh monitor mode. Then
2:35:22channel. Now type the channel number
2:35:24where your target network is operating.
2:35:27For me it is five.
2:35:30This command is going to configure the
2:35:33wireless card to listen on channel
2:35:36number five or whatever channel number
2:35:38you specify. It will stick to this
2:35:41specific channel number and won't hope
2:35:44to others. Now press enter. Provide your
2:35:47password and the command has been
2:35:50executed successfully. Now we are ready
2:35:52to launch the deauthentication attack.
2:35:55So type sudo airplayng. Now airplane is
2:35:59also part of the air crack suite. It is
2:36:02used for uh generating deauthentication
2:36:06packets or frames. Now space two hyphens
2:36:10type de
2:36:12parameter allows us to generate
2:36:15deauthentication packets. Now you have
2:36:18to uh tell the o parameter how many deau
2:36:21authentication packets you want to
2:36:24generate. Let's say 100. So the o will
2:36:27generate 100 de authentication packets
2:36:29or whatever number you specify here. Now
2:36:32type a. A is for access point. Now we
2:36:36need to specify the MAC address of the
2:36:39access point or target network. And let
2:36:44me copy the MAC address of my target
2:36:47network and paste it here. Now type WLAN
2:36:52zero. Type the name of your monitor
2:36:55mode. So that's all the AirPlay NG
2:36:58command needs. Now let me break down
2:37:00this entire command. The AirPlay NG is
2:37:03going to generate 100 deauthentication
2:37:07packets. Then send those packets to the
2:37:11devices that are connected to this Wi-Fi
2:37:15network or access point. And when the
2:37:18devices receive the deauthentication
2:37:22packets, they will automatically
2:37:24disconnect. And when they reconnect then
2:37:28the aerodyump is going to capture the
2:37:30four-way handshake because we are
2:37:33monitoring the traffic of that network.
2:37:36Right? Make sure that uh the aerodyump
2:37:39command is running now. Let me press
2:37:42enter. As you can see guys, it is
2:37:44sending the de authentication packets to
2:37:47this uh Wi-Fi network.
2:37:50Now as you can see guys, my device has
2:37:52been disconnected. Now what happens if I
2:37:56reconnect to my network? Let me switch
2:37:58to Aerodyump. Let me reconnect to my
2:38:01network.
2:38:03Click on connect. Now it is not able to
2:38:06reconnect because the deauthentication
2:38:10attack is still going on. As you can
2:38:12see, as long as this deauthentication
2:38:14attack is uh ongoing, devices will not
2:38:18be able to connect or reconnect to the
2:38:21network. Let me attempt to reconnect
2:38:24again.
2:38:27Now the authentication attack will stop
2:38:30uh after sending the 100 packets. As you
2:38:34can see it has sent the 100 packets. Now
2:38:37let me attempt to reconnect. Now it
2:38:40should work.
2:38:42Click on connect. As you can see guys,
2:38:44it has successfully captured the
2:38:48four-way handshake. So guys, that's how
2:38:50the deauthentication attack works. It
2:38:54sends the deauthentication packets to
2:38:57the devices connected to your target
2:39:00network and forces them to disconnect.
2:39:04And when they reconnect, the aerodyump
2:39:07captures the four-way handshake. Now
2:39:10that we have captured four-way
2:39:11handshake, we don't need to a dump keep
2:39:14running. So I'm going to exit it by
2:39:16pressing Ctrl + C again. Back to the
2:39:20back to the deauthentication attack. The
2:39:23number that you specify after de
2:39:26parameter, it will generate and send
2:39:29those many packets. If I specify let's
2:39:31say uh 10,000, then it will generate
2:39:3410,000 deauthentication packets. Now
2:39:38there is another way to execute the same
Wordlists & Dictionary Attacks
2:39:40deauthentication attack. What you can do
2:39:43is specify zero -0 then zero. Now what
2:39:48airplane is going to do the -0 is short
2:39:53for the o parameter and when you provide
2:39:56the value zero then air play nng is
2:40:00going to send unlimited or infinite
2:40:04deauthentication packets. Let me press
2:40:06enter. Now it is going to keep sending
2:40:10the deauthentication packets unless you
2:40:14stop it manually. Right? So to stop uh
2:40:16this uh deauthentication attack you have
2:40:18to exit manually. So press Ctrl C to
2:40:22exit out of the airplane ng as I
2:40:24mentioned the -0
2:40:28is short for the o parameter. You can
2:40:31also specify a specific number to it.
2:40:35Let's say five six. It will generate six
2:40:38deauthentication packets this time and
2:40:42it should stop after generating six
2:40:44deauthentication packets as you can see.
2:40:46So guys that's how you can execute a
2:40:48deau authentication attack. Now let me
2:40:51type ls. As you can see guys the aot
2:40:54dump has generated all these files. The
2:40:58only file that we are going to need is
2:41:01this file with cap extension. We will
2:41:05need this for cracking the Wi-Fi
2:41:08password or initiating the password
2:41:11cracking process. This is very very
2:41:12important. So what I'm going to do is
2:41:15copy this file to my desktop. Let me
2:41:18copy it. Type cp.
2:41:21And uh now specify the name of the
2:41:23destination directory. Desktop D is in
2:41:27uppercase. Press enter. Let me change my
2:41:30directory to desktop
2:41:33ls. As you can see here is the file. We
2:41:36are going to need this file for
2:41:38initiating the password cracking
2:41:40process. So make sure that you keep the
2:41:43four-way handshake file that you
2:41:46captured. In this video we will discuss
2:41:48several topics including what a word
2:41:51list is a dictionary and brute force
2:41:53attacks and how Wi-Fi password cracking
2:41:57works. Understanding these attacks is
2:42:00essential for both. protecting your
2:42:03network from such threats and
2:42:05effectively following the practical
2:42:08demonstrations in the next video. In a
2:42:10dictionary attack, a hacker attempts to
2:42:13crack the password by using a word list.
2:42:17Now, a word list is essentially a text
2:42:20file that contains thousands or even
2:42:23millions of potential passwords. There
2:42:26is a very popular word list called
2:42:29royu.txt.
2:42:30Rocky.txt word list contains millions of
2:42:34real world passwords. The passwords
2:42:37stored in the royu.txt
2:42:39come from multiple sources such as most
2:42:43commonly used passwords, weak passwords
2:42:46chosen by users, and passwords that were
2:42:50leaked online after a security breach.
2:42:53These passwords are still in use today.
2:42:57Most importantly, rocket.txt txt is not
2:42:59a list of random guesses but the actual
2:43:03passwords used in the real world.
2:43:06Similarly, all other word lists also use
2:43:09common passwords or those leaked after a
2:43:13breach. Let's briefly discuss how word
2:43:16lists are used to crack Wi-Fi passwords.
2:43:20The tool used for cracking Wi-Fi
2:43:22passwords is air crackng. Air crack uses
2:43:26a word list to crack the wireless
2:43:29network key or password. First, we need
2:43:33to capture a valid four-way handshake.
2:43:36Once the handshake is captured, a crack
2:43:39ng uses a word list to perform a
2:43:43dictionary attack. When a tool uses a
2:43:46word list to crack a password, it is
2:43:49called a dictionary attack. The way ear
2:43:52crackng works is it reads passwords from
2:43:56a word list then hashes each password
2:43:59using the same algorithm as the WPA2
2:44:03protocol. These hashed passwords are
2:44:06compared to the captured four-way
2:44:08handshake. If a match is found, the
2:44:12password is cracked. Remember in a
2:44:15dictionary attack the password can only
2:44:18be cracked if it is present in the word
2:44:21list. If the correct password is not
2:44:24there, the attack will fail. This is a
2:44:27very basic overview of how it all
2:44:30actually works. But it is enough for you
2:44:33to understand how the cracking works.
2:44:37Explaining everything in detail would
2:44:39require a crash course in cryptography
2:44:42which is beyond the scope of this
2:44:44course. Now let's discuss a brute force
2:44:46attack. A brute force attack involves
2:44:49trying every possible combination of
2:44:52characters or numbers for a password.
2:44:55For example, if a password is eight
2:44:58characters or digits long, a brute force
2:45:01attack would test all possible eight
2:45:04character or digit combinations until
2:45:06the correct password is found.
2:45:09Eventually, there will be one correct
2:45:11password among all possible
2:45:14combinations. Airng can perform both
2:45:17brute force and dictionary attacks.
2:45:19Dictionary and brute force attacks are
2:45:22different. A dictionary attack uses a
2:45:24pre-made list of common or leaked
2:45:28passwords to guess the correct password.
2:45:31On the other hand, a brute force attack
2:45:34tries every possible combination of
2:45:36characters until the correct password is
2:45:39found.
Crack / Recover Wi-Fi Password
2:45:40In this video, we are finally going to
2:45:43learn how to crack the Wi-Fi password or
2:45:46initiate the password cracking process.
2:45:50Before we do that, remember that you
2:45:52need a valid four-way handshake file to
2:45:56begin or start the password cracking
2:45:59process. I already have captured a valid
2:46:02four-way handshake. If you already have
2:46:04a valid four-way handshake file, then we
2:46:07are good to go. If you don't, you need
2:46:10to capture the four-way handshake first.
2:46:13It is an essential component required
2:46:16for password cracking. Now let's dive
2:46:19into the practicals. I have saved my
2:46:22four-way handshake file in my desktop.
2:46:25So I'm going to change my directory to
2:46:27desktop. I recommend you do the same.
2:46:30Switch your directory to where you have
2:46:33the four-way handshake file saved.
2:46:37LS as you can see here is my four-way
2:46:39handshake file. Now we are good to go.
2:46:41Type sudo air crackng. Air crack ng as
2:46:46the name suggests it is used for
2:46:49cracking passwords or Wi-Fi passwords to
2:46:52be specific. Now air crack needs minimum
2:46:56two options a valid four-way handshake
2:46:59and a word list. So first parameter that
2:47:02it needs is the four-way handshake. So
2:47:04specify name of the four-way handshake
2:47:07file. I'm going to copy it and paste it
2:47:11here. And if you have four-way handshake
2:47:15file stored in another directory, then
2:47:17specify path to that directory. Since I
2:47:21have four-way handshake file in my
2:47:23current working directory, I only need
2:47:25to specify the file name. Now, second
2:47:28parameter that it needs is the word list
2:47:31that you want to use for cracking the
2:47:34password. Kali Linux has many built-in
2:47:38word lists and one of them is royu.txt.
2:47:42Rockyu.txt is probably the most popular
2:47:45word list in world. So we have to
2:47:48specify the path to royu.txt. Before we
2:47:52do that, there are a few things that we
2:47:54need to do. Open a new terminal tab. We
2:47:59need to change directory to word lists.
2:48:02So type cd user share. The word lists
2:48:06are stored uh in this directory called
2:48:10word lists. This is the complete path.
2:48:13Press enter. ls here. As you can see
2:48:15guys, we have royu.txt.g
2:48:19file. For now, the royu.txt is zipped.
2:48:23In order to use royu.txt file, first we
2:48:27need to unzip it. Then we will be able
2:48:30to use it with airg or any other Kali
2:48:34Linux tool. To unzip type sudo
2:48:38gunzip space. Now specify name of the
2:48:42rocky.txt.gz
2:48:45file.
2:48:48Now gunip is going to unzip this
2:48:51rocky.ext.gz
2:48:53file. Press enter. It will take a few
2:48:57seconds to unzip.
2:49:00ls. As you can see guys, rocky.ext file
2:49:03has been unzipped. Now, Roku.ext has
2:49:07probably more than a million passwords.
2:49:10What I'm going to do is check how many
2:49:13passwords are stored in this rocky.txt
2:49:17file. So, let me pipe the output of cat
2:49:22command to wc command. So, type pipe
2:49:25character. Now, wc
2:49:28l press enter. As you can see guys, the
2:49:33rock.txt txt has over 1 million
2:49:37passwords. No, no, no, no. Not 1
2:49:39million, rather over 14 million
2:49:43passwords stored inside this royu.xt
2:49:47file. I can't view the passwords of
2:49:50royu.txt file because if I open uh this
2:49:53file, then the terminal will crash. The
2:49:56terminal will not be able to handle
2:49:59these many lines. But what I'm going to
2:50:02do is check the let's say first 10
2:50:06passwords. It is easy. Type cat
2:50:10rocket.txt. Pipe it to head command-
2:50:14n let's say 100. The head command is
2:50:17going to display the first 100 lines or
2:50:21passwords in this file. Press enter. As
2:50:24you can see guys, these are the
2:50:25passwords in the rocky.txt file. There
2:50:28are millions of such common passwords.
2:50:31Now we need to specify path to this
2:50:34rocky.txt file in air crackng. So back
2:50:38to the airrng. Now after providing the
2:50:42name of four-way handshake file specify
2:50:45w
2:50:46stands for word list. And now you have
2:50:48to specify path to the word list. So
2:50:51type forward slash user
2:50:55shareward slash
2:50:58word lists then rocku dot
2:51:02rocku.txt.
2:51:03Let me resize my terminal a bit. Now air
2:51:06crackng is going to initiate the
2:51:09password cracking process and it will
2:51:11use this uh specified word list. Make
2:51:14sure that you have provided a valid
2:51:16four-way handshake file and correct path
2:51:19to royu.txt. txt word list. Now press
2:51:22enter.
2:51:24As you can see guys, the air crack has
2:51:27started the cracking process. It is
2:51:30currently testing around uh 6 550 or 600
2:51:35passwords per second. But this number
2:51:39can be different and significantly
2:51:42higher for you if you have a high-end
2:51:45computer.
2:51:50As you can see guys, key found. This is
2:51:53what a cracked password looks like. This
2:51:57is the password of my Wi-Fi network. Now
2:52:01I can use this password or key to access
2:52:04my Wi-Fi network or access my cracked
2:52:08Wi-Fi network. Remember guys, the
2:52:10success of a dictionary attack depends
2:52:13on whether the password is in word list
2:52:16or not. If the password is in the word
2:52:19list, then it will be cracked. If not in
2:52:23the word list, then it won't be cracked.
2:52:27Now, passwords that contain only numbers
2:52:30are very easy to crack. In fact, a
2:52:33purely numerical password can be cracked
2:52:36within minutes without any problems.
2:52:40Like this, the numerical passwords are
2:52:42easiest and most vulnerable to cracking.
2:52:46However, if a password is stronger and
2:52:49includes numbers, letters, special
2:52:51characters, uppercase and lowerase
2:52:53characters, such passwords are very hard
2:52:56to crack. Often impossible to crack.
2:52:59Even passwords based on common
2:53:01characters can still be vulnerable, but
2:53:04it takes significantly longer time to
2:53:07crack. I know this is very simple. I
2:53:09just wanted to show you how to use a
2:53:12word list to crack passwords. We will
2:53:15use more effective and sophisticated
2:53:19password hacking techniques in the
2:53:21upcoming video. Thank you very much guys
2:53:24for sticking around. In the previous two
Detect De-authentication Attacks /Threats
2:53:26sections, we have seen how attackers can
2:53:28exploit or hack Wi-Fi networks using
2:53:32various methods. Right now, in this
2:53:34section, I will demonstrate how to
2:53:36detect and protect your network from all
2:53:40possible Wi-Fi attacks. This is the
2:53:42first video of the section. In this
2:53:44particular video, we will focus on
2:53:46detecting deauthentication attacks. The
2:53:50deauthentication attacks are central to
2:53:52both dictionary and able twin attacks.
2:53:55Right? The able twin attack specifically
2:53:58depends on a successful deauthentication
2:54:01attack to function properly. Without a
2:54:03successful deauthentication attack, the
2:54:06able twin attack is not impactful at
2:54:09all. Therefore, if we can detect the
2:54:13deauthentication attack, it makes
2:54:15safeguarding the network easier. In this
2:54:18video, we will learn how to detect
2:54:21deauthentication
2:54:22attacks using Wireshark. Now, let's jump
2:54:25into the practicals. I'm going to
2:54:27execute the deauthentication attack on
2:54:30my own network and then capture packets
2:54:35or deauthentication packets in
2:54:37Wireshark. Before we do that, we need
2:54:40some network details to launch the
2:54:43deauthentication attack such as the MAC
2:54:46address of the target network and the
2:54:48channel number where it is broadcasting
2:54:51on. Now, let me scan all Wi-Fi networks
2:54:54around me so I can note down the
2:54:56required details to launch the
2:54:59deauthentication attack.
2:55:02Aerodyump.
2:55:04Now specify the name of your monitor
2:55:06mode.
2:55:09As you can see guys, my target network
2:55:11has appeared in this list. This is the
2:55:14network sunny. I want to execute the
2:55:16authentication uh attack on my network.
2:55:19Now once your target network appears
2:55:21here, press control + C to exit. Now I'm
2:55:24going to open uh open a new terminal
2:55:27window and note down the details. MAC
2:55:31address. This is the MAC address of my
2:55:34target network.
2:55:38Now let me note on the channel number
2:55:42where it is broadcasting on. Channel
2:55:44number is 11. Now we need the MAC
2:55:47address. If you use the AirPlay NG to
2:55:50execute the authentication attack and if
2:55:52you use MDK4 then you only need channel
2:55:57number. I'm going to use the MDK4.
2:56:01So type sudo mdk4
2:56:05space specify the name of your monitor
2:56:08mode. Now d is for deauthentication
2:56:12attack. It launches the deauthentication
2:56:14attack. Now C is for channel number. You
2:56:18have to specify the the channel number
2:56:20where your target network is
2:56:22broadcasting on. For me it is 11. Now
2:56:25guys, before I execute this attack, I'm
2:56:28going to open my wire shark so we can
2:56:30capture the deauthentication packets.
2:56:34Later we will analyze those packets to
2:56:37identify the attack.
2:56:40And uh now in this uh window of
2:56:43interfaces you will see the monitor mode
2:56:46here as you can see WLAN zero mon. So
2:56:48click on double click on your monitor
2:56:50mode
2:56:52and as you can see wireshark has started
2:56:56capturing the network traffic. Remember
2:56:59the wireshark is capturing all the
2:57:01network traffic. So count for captured
2:57:04packets will easily go in thousands
2:57:06within a few seconds. Now let me execute
2:57:09the deauthentication attack. Let me
2:57:11press enter.
2:57:13As you can see, it is sending a plenty
2:57:16of deau authentication packets per
2:57:18second over thousand uh per second on
2:57:21average. Wireshark is capturing
2:57:23everything. So guys, when you put your
2:57:25card into the monitor mode, you will not
2:57:28be able to identify the deauthentication
2:57:31attack because wire sharkark literally
2:57:34captures all your network traffic. Now
2:57:37what I'm going to do is stop the
2:57:39capturing packets. Click on the red
2:57:41button and I'm going to stop the de
2:57:43authentication attack as well. So we
2:57:46literally have uh over 100,000 packets
2:57:50as you can see. Now detecting the
2:57:52deauthentication packets among these
2:57:55thousands of packets is very difficult.
2:57:58Here we can use something called a
2:58:00filter. We need to use the filter for
2:58:04displaying only the deauthentication
2:58:07packets. So filter for that is type wan0
2:58:12dot fc dot type underscore then sub type
2:58:20equal to 12. Now in management frames
2:58:24the subtype 12 represents the
2:58:26deauthentication frames and 11
2:58:29represents the authentication frames.
2:58:31Right? We discussed uh this in the
2:58:33fundamentals section. Now press enter.
2:58:37This filter will display only the
2:58:40deauthentication
2:58:42frames or packets. As you can see guys,
2:58:44under the info column, these are all
2:58:47deauthentication frames. We literally
2:58:49have thousands of deauthentication
2:58:52frames. So it is certainly a
2:58:55deauthentication attack, right? Remember
2:58:58a router or wireless access point never
2:59:01sends this many deauthentication frames.
2:59:04In case of some maintenance or
2:59:06troubleshooting, it typically sends
2:59:08maybe 50 or something deauthentication
2:59:11frames. But if the count for
2:59:13deauthentication frame is anything above
2:59:1650, then it certainly is a
2:59:18deauthentication attack. Now click on
2:59:22any deauthentication packet and at the
2:59:24bottom let me expand the 8011 deau
2:59:29authentication flags. Now here we have a
2:59:31field called type subtype de
2:59:33authentication in bracket we have a
2:59:36hexad decimal number 0x000000
2:59:39c. If you convert this hexad decimal
2:59:41number into binary sorry decimal you
2:59:43will get 12. Now here we have the
2:59:46transmitter address which is this this
2:59:49MAC address. Now if I go back to my
2:59:51details that I have noted down, as you
2:59:54can see guys, this is the same MAC
2:59:56address. It means the deauthentication
2:59:59frames are coming from this MAC address.
3:00:02This MAC address or device is uh sending
3:00:04the de authentication packets. Now this
3:00:07is the MAC address of the target router
3:00:11or target network. But here the router
3:00:14did not send these deauthentication
3:00:18frames, right? It is the attacker who
3:00:21basically masked or spoofed this MAC
3:00:24address then sent the deauthentication
3:00:26frames on behalf of the network or
3:00:30target network. So guys that's how you
3:00:32can basically detect the
3:00:34deauthentication
3:00:35frames in Wireshark. This is as easy as
3:00:39that. Now this method of detecting
3:00:42deauthentication attack is not very
3:00:46efficient because when you put your card
3:00:49into the monitor mode and capture
3:00:52packets using Wireshark, the Wireshark
3:00:55essentially captures thousands of
3:00:57packets, right? the account for captured
3:01:00packets will easily go in millions and
3:01:03uh at some point Wireshark will
3:01:05eventually crash if you keep capturing
3:01:08packets for a longer period of time. So
3:01:12in the next video I will show you an
3:01:15efficient way to detect the
3:01:18authentication attack.
3:01:22Wireshark is a complicated tool, right?
3:01:25So in this video I'm going to simplify
Wireshark Tutorial
3:01:28Wireshark for absolute beginners. So
3:01:31guys if you are you know someone who is
3:01:34new to Wireshark or struggling with it
3:01:37then trust me by the end of this video
3:01:40you will be able to use Wireshark
3:01:43efficiently.
3:01:46Wireshark is a special tool used for
3:01:48monitoring computer networks. Wireshark
3:01:52helps you to you to see what is
3:01:54happening when your computer sends and
3:01:57receives a data. It monitors or captures
3:02:01all the network traffic. Wireshark is is
3:02:04of course free and open-source tool.
3:02:09Wireshark is a must know tool for
3:02:12security analysis. It is often used to
3:02:15detect and analyze network security
3:02:18threats such as hacking attempts
3:02:20unauthorized access to sens sensitive
3:02:23data and it can easily identify attacks
3:02:26or suspicious traffic on your network.
3:02:30It is a go-to tool for cyber security
3:02:33analysts.
3:02:36Wireshark can be used to analyze network
3:02:40traffic in real time to identify and
3:02:43resolve network related problems such as
3:02:46slow performance, dropped packets and
3:02:49other connectivity related issues as
3:02:52well.
3:02:54Developers can use Wireshark to
3:02:57understand how protocols work and
3:03:00identify issues related to their
3:03:02implementation. These are just you know
3:03:05the main uses of Wireshark. It is a very
3:03:09vast tool. It can be used for you know
3:03:12many other things.
3:03:14Now to download and install Wireshark go
3:03:18to the wireshark.org
3:03:20click on download. Here we have files
3:03:23for Linux, Mac and Windows. So download
3:03:27the appropriate file according to your
3:03:29operating system. Here, as you can see,
3:03:32guys, uh we do not have files for 32-bit
3:03:35systems, right? This is because
3:03:37Wireshark 4.0 or higher versions do not
3:03:41support 32bit systems, right? So, if you
3:03:45have an older uh computer or 32-bit
3:03:48system, then you have to download this
3:03:51uh this file 3.6.1.
3:03:54So, click on this down arrow. From here
3:03:57you can download 32bit file for your
3:04:01operating system. And I'm not going to
3:04:03go through the installation steps
3:04:05because installation process is very
3:04:08simple on all operating systems on
3:04:11Windows. Make sure that you do not check
3:04:14or uncheck anything during the
3:04:16installation. Right? Keep clicking on
3:04:19next. Next, then your installation will
3:04:22be successful. If you come up with any
3:04:24problems dur during the installation or
3:04:27any part of the video then let me know
3:04:30in the comment section and I will
3:04:32happily answer everything.
3:04:38All right. So once your installation is
3:04:40complete then open your Wireshark
3:04:44and this is the welcome window of
3:04:46Wireshark. It displays all the installed
3:04:50network interface cards and this list is
3:04:53going to be different for everyone. Most
3:04:56likely you are not going to see all
3:04:58these you know uh local area connections
3:05:01because they are not real or physical
3:05:05cards. They are created by my virtual
3:05:08machines. Now there are two inbuilt
3:05:11network cards on each system. Ethernet
3:05:15and wireless card. Ethernet is simply
3:05:18represented by Ethernet on Windows and
3:05:22wireless card is represented by Wi-Fi
3:05:25and on Linux the wireless card is
3:05:28represented by WLAN0 and Ethernet is
3:05:32represented by ETH0 on most Linux uh
3:05:37distributions. Now to start capturing
3:05:39packets you have to select one of these
3:05:42physical network cards. Now which one
3:05:45exactly you have to select? Well, it
3:05:48depends on your connectivity, how you
3:05:51are connected to your uh network or how
3:05:54you are accessing the internet. I'm
3:05:56connected to my network through Wi-Fi or
3:05:59wireless card. So, I'm going to select
3:06:01Wi-Fi. As you can see, it is showing uh
3:06:04some spikes, right? These spikes are
3:06:07indicating that there are some, you
3:06:09know, activities going on this
3:06:11particular interface. We also have
3:06:14spikes on on adapter for loop back
3:06:16traffic interface as well. Well, this is
3:06:20uh the local host. It does not capture
3:06:23your network's traffic. It only, you
3:06:26know, monitors your uh system traffic.
3:06:28This is not that important. Again, guys,
3:06:31I'm going to uh select Wi-Fi to start
3:06:33capturing packets. So, double click on
3:06:36the appropriate interface.
3:06:39As you can see, Wireshark is capturing
3:06:42packets right at the top. You can see
3:06:45capturing from Wi-Fi. Right now, first
3:06:47thing that I'm going to do is explain
3:06:51what all these different sections or
3:06:54components mean, what information they
3:06:57represent. So, go to the view. View menu
3:07:01allows us to control uh the components
3:07:04that you want to appear in your display
3:07:07area. As you can see, Wireshark has
3:07:10already pre-selected some of the
3:07:12components for us. First three selected
3:07:15components are main toolbar, filter
3:07:17toolbar, and status bar. This is the
3:07:20main toolbar. It contains the functions
3:07:23that you are going to use on a regular
3:07:26basis. I will get back to all these
3:07:29functions later in the video. Then we
3:07:32have uh filter bar. This is the filter
3:07:34toolbar. Here you can type your filters.
3:07:37Filters are basically used to hide
3:07:39unnecessary traffic. I will get back to
3:07:42filters later as well. For now, just uh
3:07:45remember that if you want to type and
3:07:48apply uh the filters, then this is the
3:07:51place where you can type the filters.
3:07:54Then we have a status bar at the bottom.
3:07:57This is the status bar. As you can see,
3:07:59it basically gives you a brief summary
3:08:02of captured or lost packets. Then we
3:08:06have packet list. This section is called
3:08:10packet list. Packet list displays or
3:08:14contains all the captured packets. Every
3:08:17single packet that Wireshark captures is
3:08:21going to be displayed or listed here.
3:08:24And then we have packet details. As you
3:08:27can see guys, the packet list uh section
3:08:31only gives you a brief overview of each
3:08:35captured packet. Now if you want to
3:08:38analyze packets in detail then you can
3:08:41use packet details section. For example,
3:08:44I'm going to let me stop the session
3:08:46first. I'm going to click on packet
3:08:48number 139. Now down here packet details
3:08:52section is displaying a detailed
3:08:55information about the selected packet.
3:08:57As you can see frame number 139. Now
3:09:00here you can analyze uh the selected
3:09:02packet in detail. Now let me click on
3:09:05different packets. As you can see the
3:09:07information keeps changing as I click on
3:09:10different packets. Then we have packet
3:09:14bytes on your right side. This section
3:09:18or panel is called packet bytes. It
3:09:21displays information in its raw or
3:09:24original form. Right? As you can see the
3:09:27default format is hexadimal and you can
3:09:30also change it to to binary. So click on
3:09:33the blank space. Click on as bits. Now
3:09:35as you can see information is in raw
3:09:38binary. I'm going to revert back to the
3:09:41to the hexodimal format because it is a
3:09:44little more presentable than uh than
3:09:46binary. And if your packet contains uh
3:09:50plain textual information, then that
3:09:54information will also be displayed here
3:09:56as it is in its raw form. Now go to the
3:10:01view. Let's say you do not want packet
3:10:04byes section. Then click on this packet
3:10:07bytes or whatever you want to hide. Now
3:10:09as you can see it has been completely
3:10:11hidden. So to get it back go to the view
3:10:15again click on packet byes. Now it is
3:10:18back here. Now let me walk you through
3:10:21what all these uh columns mean. Right?
3:10:24So first column that we have is N O. N O
3:10:28is short for number. It basically
3:10:31displays the packet number. Each packet
3:10:34is going to have a unique number. As you
3:10:36can see the first packet that Wireshark
3:10:39captures uh is automatically assigned uh
3:10:42number one second packet two and so on.
3:10:45Then second column is time. Time uh time
3:10:49column displays the exact time when a
3:10:52packet was captured. Right? Now the
3:10:54default format for displaying time is
3:10:58not uh not you know that uh uh
3:11:00presentable right. So let's change it
3:11:04first. So go to the view now. Click on
3:11:08time display format from from first half
3:11:11select time of the day. Again go to the
3:11:14view time display format from uh lower
3:11:18half select seconds. Now as you can see
3:11:20we have a much better or presentable
3:11:23format for displaying the timing of
3:11:26captured packets. Then we have source. A
3:11:30source column displays the IP address of
3:11:33sender who has you know sent the packet.
3:11:37Destination column displays the IP
3:11:39address of uh receiver where the packet
3:11:42has been delivered. So let me select
3:11:45let's say packet number uh 30. Sender of
3:11:48the packet number 30 is this IP address
3:11:51192.68
3:11:52uh 68 and it has delivered this packet
3:11:56to uh this uh device 35
3:11:59uh 3. Then protocol column displays the
3:12:03packet type whether it is TCP, ICM, ICMP
3:12:06or UDP packet. Length column displays
3:12:10size of each packet in bytes. Info
3:12:15column it gives you a brief overview of
3:12:19each captured packet. So that's what all
3:12:22these columns mean. Now let's uh go
3:12:25through all the uh toolbar functions.
3:12:29Red button stops the current running
3:12:32session and first button from left
3:12:35starts a new session. So click on it. As
3:12:39you can see before starting a new
3:12:41session, Wireshark is asking me whether
3:12:43you want to save already captured
3:12:47packets. So I'm going to click on save.
3:12:50Then give it a file name. Let's say
3:12:53packets. Now you don't have to write any
3:12:56extension after the file name. Remember
3:12:59Wireshark automatically saves your
3:13:02packets with pcap or pcapng extension.
3:13:06pcapng is the default extension for
3:13:09saving wireshark files. Click on save.
3:13:13Now a new session has been started. Then
3:13:16third button restarts a new session. So
3:13:18if you want to restart a new session
3:13:21when you already have a session running
3:13:24then click on this button. And here also
3:13:26if you want to save already captured
3:13:30packets then click on save before
3:13:32continuing. This time I'm going to go
3:13:34with continue without saving. Then third
3:13:38fourth button is capture options.
3:13:41capture options button cannot be
3:13:44accessed when you have a session
3:13:46running. So let me stop the session
3:13:49first. Now if I click on the capture
3:13:51option button as you can see now it is
3:13:54working. Now capture options uh window
3:13:58displays all the network interface cards
3:14:01just like your your welcome window. The
3:14:04only difference is that it gives you a
3:14:07much better control over interfaces. As
3:14:10you can see, we have additional options
3:14:12such as promiscuous mode and monitor
3:14:16mode. Okay, I will get back to capture
3:14:18options later. Then we have open a
3:14:22capture file button. So this button
3:14:25allows you to open a already saved file.
3:14:29So click on it. Now I'm going to double
3:14:32click on the file that I saved a few
3:14:35seconds ago. So double click on the
3:14:37file. Now continue without saving. Now
3:14:39as you can see at the top packets
3:14:42dotpcapng wireshark is reading packets
3:14:46from this particular file. Then next
3:14:49button that we have is save this capture
3:14:53file. So this button basically gives you
3:14:56option to save your packets quickly. So
3:14:59click on the button write the file name
3:15:02then click on save. It will save the
3:15:04packets. Now another way to save uh
3:15:07packets is go to the file, click on save
3:15:10as. Then next button is close. So close
3:15:14button takes you back to your welcome
3:15:17window as you can see. So let me start
3:15:19the session again.
3:15:22Now next button that we have is find. So
3:15:25click on the button. It basically allows
3:15:28us to search for packets based on
3:15:32different types of values. As you can
3:15:34see, we have a drop-own menu here. So,
3:15:36click on the down arrow and uh let me
3:15:39start with let's say string. Now, in
3:15:41this box, type a string or text. Let's
3:15:44say payload.
3:15:47Now, let me click on find. As you can
3:15:49see, guys, it is highlighting the
3:15:52package that contains the word payload
3:15:56right here. As you can see, so when you
3:15:58select the string option, whatever you
3:16:00type here, Wireshark is going to search
3:16:03for that particular uh text or string in
3:16:06each packet. Wherever it finds the word
3:16:09payload, then it will highlight those
3:16:12packets. As you can see, for now, it is
3:16:13highlighting packet number 55. Now, if I
3:16:16click on find, it is highlighting the
3:16:18next packet that contains the word
3:16:21payload like this. Then we have hex
3:16:24value option. Let me select it. Now here
3:16:26you can search by hexadimal values as
3:16:29well. So let's say 4 a. Now click on
3:16:33find. As you can see on the packet bytes
3:16:36panel 4 a is highlighted. And in the
3:16:40packet list section wire sharkark is
3:16:42highlighting the exact packet that
3:16:45contains this value. Then we have
3:16:48display filter. We have not covered uh
3:16:50the display filters yet. Right? Once you
3:16:53you will learn display filters then you
3:16:56will automatically learn to use this
3:16:58feature for now. You don't have to worry
3:17:01about it. Then next two buttons uh that
3:17:04we have are right and left arrow. So
3:17:07right arrow button basically takes you
3:17:10one packet up from your current
3:17:13position. My current uh position is let
3:17:15me click on it. So if I click on left
3:17:18arrow button, it will take you one
3:17:20packet up and right button it's going to
3:17:23take me one packet down from my current
3:17:26position. Then we have go to uh
3:17:28specified packet. Click on the button
3:17:31here in the box. Type the packet number
3:17:34let's say five and click on go to go to
3:17:38packet. Then as you can see it has taken
3:17:40me to the packet number five. It is
3:17:42being highlighted. So whatever number
3:17:45you type in here in this box, wire
3:17:48sharkark will take you to that
3:17:50particular packet. Then we have uh up
3:17:54and down arrow keys. The up arrow key is
3:17:58going to take you to the first captured
3:18:01packet in the list. Click on it. As you
3:18:03can see, it is highlighting the first
3:18:06packet in the list and down arrow key
3:18:08takes you to the last captured packet.
3:18:11Right. Next button that we have is uh
3:18:14this automatically scroll to the last
3:18:16packet during live capture. So when you
3:18:19enable this button, it will
3:18:20automatically take you to the you know
3:18:23last packet that Wireshark captures
3:18:25during the live session. As you can see
3:18:28it has uh this light blue background
3:18:31color right it means it is enabled
3:18:34right. If I click on it now it is
3:18:36disabled. It is advised that you know
3:18:39always keep it enabled. Now next button
3:18:42basically enables the packet coloring.
3:18:45As you can see we have packets with
3:18:48different colors right TCP packets have
3:18:51a different color and ARP packets have a
3:18:54different color. So what uh basically
3:18:56wireshark does it assigns a unique color
3:19:00to most commonly used protocols or
3:19:03filters so we can easily identify the
3:19:06packets. Right? So when I'm going to see
3:19:08this light pink color, I can
3:19:10automatically recognize yeah this is a
3:19:12an ARP packet. Now if you want to find
3:19:16out which color is associated with which
3:19:19filter or protocol, then go to the view,
3:19:23click on coloring tools. Now here you
3:19:26can basically see which color is
3:19:29associated with which filter or
3:19:31protocol. UDP protocol is going to have
3:19:34this light gray background color. So
3:19:38feel free to go through the list. You
3:19:40can even customize these colors. Let's
3:19:42say for ARP you want a different color.
3:19:45So click on the AR. Then down here click
3:19:48on background. Then select a color of
3:19:50your choice. Then click on okay. And
3:19:54after that click on okay. Then color
3:19:57will be changed. In the same way you can
3:19:59change foreground or text color as well.
3:20:02Select the color, click on okay, then
3:20:04click on okay. Changes will be applied
3:20:07right away. Then next buttons that we
3:20:09have are plus and minus. Plus button
3:20:12basically is used to increase the font
3:20:15size as you can see and minus button is
3:20:18is for decreasing the font size and
3:20:22button next to minus button sets the
3:20:25font size to default. If I click on it,
3:20:28as you can see, the font size has been
3:20:31set to uh the default. Now the last
3:20:34button uh resize or sets the packet
3:20:38columns size to to default. As you can
3:20:41see my destination column is overlapping
3:20:44the source column. Right now if I click
3:20:47on this uh last button, as you can see
3:20:50the size has been set to to the default.
3:20:53Now I can see contents of each column
3:20:56easily.
3:20:59Filters are used to hide or filter out
3:21:03unnecessary traffic. For example, here
3:21:06as you can see I have thousands of
3:21:08packets. Right now let's say I only want
3:21:12to see HTTP packets in my packet list
3:21:17section. All other traffic is irrelevant
3:21:20or useless to me. In that case, if I
3:21:24manually try to locate every single HTTP
3:21:28packet among thousands of packets, then
3:21:31it is going to take a lot of time,
3:21:33right? So to solve this problem, we have
3:21:37something called filters. Filters allow
3:21:41us to exactly see what you want to, you
3:21:45know, analyze and see in in your packet
3:21:48list section. For example, I only want
3:21:51to see HTTP packets. Then all I have to
3:21:55do is type a valid HTTP filter. Then
3:21:58Wireshark is only going to show all the
3:22:01HTTP packets and other traffic will be
3:22:04hidden. So this is as simple as that. We
3:22:07have two types of filters in Wireshark.
3:22:11Display and capture filters. Display
3:22:14filters are used or applied on already
3:22:18captured traffic. As you can see, I
3:22:20already have you know captured packets.
3:22:23Here I can apply the display filters and
3:22:27I will get back to to uh capture filters
3:22:30later. Now let's do some practical
3:22:33examples of display filters. Display
3:22:36filters can be written and applied here
3:22:39in the uh filter uh display filter bar.
3:22:42So I'm going to start with filtering
3:22:44HTTP traffic. So traffic uh filter for
3:22:47filtering HTTP traffic is just HTTP. So
3:22:51type HTTP. As you can notice when you
3:22:54type a correct or valid filter,
3:22:56Wireshark automatically changes
3:22:59background color to green. Green
3:23:02background means a valid filter. Now if
3:23:04I type something that wireshark does not
3:23:07recognize then background color changes
3:23:11to to pink. So green means valid, pink
3:23:15means invalid filter. Now how to apply
3:23:18the filter? We have two options. First
3:23:21press enter. Now as you can see filter
3:23:24has been applied under the protocol
3:23:27column. Wireshark is only displaying the
3:23:31HTTP traffic because this is exactly
3:23:34what I have told Wireshark only show me
3:23:38HTTP traffic. Now another way to apply
3:23:41filters is click on this uh right arrow
3:23:45on your right side. Click on it then
3:23:47filter will be applied. You can clear
3:23:50filters by clicking on this cross
3:23:52button. Now as you can see we are back
3:23:54to the normal. Now let's uh filter let's
3:23:58say DNS packets. So filter for that is
3:24:01DNS. Hit enter. Now as you can see
3:24:03Wireshark is only displaying the DNS
3:24:06packets. Now I want to see let's say TCP
3:24:10packets only. So filter is TCP. As you
3:24:14can see it is only showing the TCP
3:24:16traffic. In the same way let let's say I
3:24:20want to see UDP packets. So filter for
3:24:22that is UDP. Now let me see whether I
3:24:26have any ARP packets. So type the ARP,
3:24:29hit enter and yeah this is the ARP
3:24:32filter for filtering ARP packets. In the
3:24:36same way you can filter all the possible
3:24:38you know network traffic. All you have
3:24:41to do is remember the protocol name then
3:24:45type that in here in the filter bar. Now
3:24:48let's filter encrypted or HTTPS traffic.
3:24:53Your first guess might be HTTPS. Right?
3:24:57As you can see, this is not a valid
3:24:59filter, right? So to filter secure or
3:25:02HTTPS traffic then you have to type TLS.
3:25:07So press enter. As you can see now
3:25:09Wireshark is showing all the encrypted
3:25:12traffic. TLS filter uh makes sense
3:25:15because uh HTTPS protocol is actually
3:25:19combination of HTTP and TLS. TLS takes
3:25:25the HTTP traffic then encrypts it and
3:25:29that makes the HTTPS protocol. Sorry I
3:25:32forgot to add S. Now till now we have
3:25:36used or filtered one type of traffic
3:25:40only. Right now let's say I want to see
3:25:44ARP and DNS packets simultaneously. It
3:25:47can be done through something called
3:25:49operators or operator. So type uh DNS
3:25:54then write or and ARP or operator is
3:25:59used to combine multiple filters. So
3:26:02here I am basically telling Wireshark if
3:26:05you find DNS packets or ARP packets then
3:26:09show me all those packets. So if I hit
3:26:13enter then Wireshark as you can see it
3:26:15is displaying all the DNS and ARP
3:26:18packets. In this way you can combine as
3:26:21many filters as you like. So let me add
3:26:25another filter TLS or ICMP. Okay. So
3:26:29feel free to add as many filters as you
3:26:32like and or operator can be uh written
3:26:36with two pipes as well like this UDP.
3:26:41This is also a valid filter or ARP. See
3:26:46guys uh the or operator pretty much
3:26:49works uh as it works with you know uh
3:26:52programming languages. So here it can be
3:26:54used to combine multiple filters. Now uh
3:26:58let's use uh not operator. So type not
3:27:03and TCP. Now what does it mean? Not
3:27:06operator basically negates the value
3:27:09that you supply to it. Here I'm telling
3:27:12not operator that okay don't show me TCP
3:27:15packets. Show me everything but not the
3:27:19TCP packets. So if I hit enter, you are
3:27:22not going to see any single TCP packets
3:27:25in the list. As you can see
3:27:29and not operator can be can be written
3:27:32with exclamation symbol as well. So
3:27:35exclamation TCP. It is also a valid
3:27:39filter. Now let's filter traffic by port
3:27:43numbers. So type uh let's say TCP. I
3:27:46want to filter traffic on port number uh
3:27:50let's say 80. 80 port is for HTTP,
3:27:53right? So if I hit enter, it is not a
3:27:56valid filter. Sorry, I forgot to add
3:27:59equal to signs. So port number 80 means
3:28:02it is going to uh list all the HTTP
3:28:05traffic. Here also you can use or
3:28:07operator or TCP.ORT
3:28:12EQ means equal to 443. So EQ or equal to
3:28:18sign both are same. So if you hit enter
3:28:22now this time I'm telling wireshark if
3:28:24you find https or htt http traffic then
3:28:29list all those packets. So 443 port
3:28:33number is obviously for secure or https
3:28:38traffic. Now let's cover another very
3:28:41important filter called IP header. IP
3:28:45adder filter is basically used for
3:28:48filtering traffic by IP addresses. Let's
3:28:51say you want to check all the packets
3:28:55that a particular IP address has sent or
3:28:58received. So write IP dot adder equal to
3:29:02then paste the IP address. Now this
3:29:05filter is going to only uh uh display
3:29:08the packets that this particular IP
3:29:11address has sent or received. So if I
3:29:14hit enter now as you can see under the
3:29:16source and destination column right you
3:29:19can use or operator to combine multiple
3:29:23IP addresses. So let's say you want to
3:29:25check packets that you know multiple IP
3:29:29addresses have sent or received then use
3:29:33or operator IP dot adder uh let's say
3:29:37here 79. Now this filter is going to
3:29:41display all the packets that these two
3:29:45IP addresses have sent or received. In
3:29:48this way you can combine as many filters
3:29:51as you IP addresses as you like. Now
3:29:54here also we can use not operator. So if
3:29:57I type not at the beginning then what
3:30:01I'm telling Wireshark at this time is do
3:30:04not show me packets that this particular
3:30:08IP address has sent or received. So if I
3:30:13hit enter, you are not going to see this
3:30:15IP address in the packet list as you can
3:30:19see because we have clearly told
3:30:22Wireshark don't show me packets that
3:30:25have been sent or received by this IP
3:30:29address. And another important filter
3:30:33that I'm going to teach you is contains.
3:30:36So type TCP. Let's say contains.
3:30:41Now within the double quotes write
3:30:44YouTube.
3:30:47Now what this filter is going to do it
3:30:50will check every single packet in the
3:30:52list and see whether the packets contain
3:30:57the word YouTube. If any packet contains
3:31:01YouTube then that packet will be listed
3:31:04here. If I hit enter and as you can see
3:31:07there are no such packets that contain
3:31:10YouTube. Now let's try some let's try
3:31:13the DNS.
3:31:15DNS Now as you can see we do have DNS
3:31:19packets that contain YouTube. So as you
3:31:23can see youtube.com
3:31:25so this IP address visited this website
3:31:30YouTube or it basically made DNS queries
3:31:33to youtube.com right
3:31:38now let's move to the capture filters
3:31:41now capture filters allow you to have
3:31:45control over your traffic what you want
3:31:48to capture capture filter as the name
3:31:51suggests
3:31:52You can basically tell Wireshark before
3:31:55starting a new session what you want to
3:31:58capture. Right? By default, Wireshark
3:32:01captures all types of traffic floating
3:32:04on your network now. Let's say you only
3:32:07want to capture HTTP traffic, right? You
3:32:09don't want to capture any other traffic,
3:32:12just FTP or HTTP. Then you can tell it
3:32:16to Wireshark before starting a new
3:32:18session. then wireshark will only
3:32:21capture whatever traffic you tell it uh
3:32:24to capture. So you have to go back to
3:32:27your uh welcome window. Now first thing
3:32:31that you have to do is select the
3:32:34interface where you want to capture the
3:32:37traffic. Then here as you can see we
3:32:39have uh the box where you can type the
3:32:42capture filter. capture filters are
3:32:44different in terms of uh syntax from
3:32:47display filter. So if I type let's say
3:32:50HTTP then as you can see it is not a
3:32:53valid filter right. So to write a filter
3:32:57to capture HTTP traffic then we have to
3:33:00write port then port number 80. So port
3:33:04for HTTP is 80. So this filter is going
3:33:08to capture the HTTP or traffic on uh
3:33:12port 80. Now to start capturing packets,
3:33:15double click on the interface.
3:33:17Now as you can see guys at the top
3:33:20capturing from Wi-Fi on port number 80.
3:33:23So it is only going to capture traffic
3:33:26on 80. So let me visit uh let's see this
3:33:29is an HTTP website. As you can see not
3:33:32secure.
3:33:33It is capturing HTTP traffic. Now let me
3:33:37visit a website which uses HTTPS let's
3:33:40say YouTube. As you can see it is not
3:33:43capturing anything right. So to confirm
3:33:46it further let me apply the TLS filter.
3:33:50As you can see TLS found nothing because
3:33:54this filter capture filter is only going
3:33:56to capture the HTTP traffic. Now back to
3:34:00the welcome window again.
3:34:03Another place where you can type the
3:34:06capture filter uh filters is go to the
3:34:09capture options. Now here select the
3:34:12interface first then write the filter
3:34:15here. As you can see at the bottom we
3:34:18have a box. So port number 80. Now let's
3:34:22say I want to capture FTP traffic. Then
3:34:25you have to write the port number for
3:34:27FTP which is 21. Here also you can use
3:34:30or operator. So type port now let's say
3:34:3422. Now this time Wireshark is going to
3:34:37capture both HTTP and sorry SSH and FTP
3:34:42traffic. You can combine as many you
3:34:44know uh filters as you like here. And if
3:34:49you click on start then it will start
3:34:52capturing traffic.
3:34:55Now if you want to capture let's say
3:34:57only TCP traffic then you can directly
3:35:00write TCP. TCP and UDP filters are
3:35:04common for both display and capture
3:35:07filters right let's say UDP.
3:35:10Now let's say you only want to capture
3:35:14traffic that a particular IP address
3:35:17sends or receives. Uh then write the
3:35:20host filter then paste the IP address.
3:35:23Now this filter is only going to capture
3:35:25the traffic that this specified IP
3:35:28address sends or receives. So guys that
3:35:31is it for filters. If you want to learn
3:35:35more about filters, then feel free to
3:35:38check my Udemy course where I have, you
3:35:41know, covered a plenty of advanced
3:35:44filters. That's a