6 Ways to Hack into Public Wi-Fi Hotspots – Cracking Passwords

By Asif

Disclaimer! Hacking Wireless networks that you do not own is forbidden in all the Countries. This Article has been created for Educational purpose only.

The Internet is a necessity today. From your work to your leisure, you are dependent on the internet.
It may be possible that internet connectivity is not available in an urgent situation. But, there are public Wifi Hot-spots in the vicinity. Unfortunately, they all are secured with passwords.
You’d be helpless in this particular situation if you don’t know ways to hack public WiFi Hot-spots.
Most of the WiFi hacking apps available on the internet can trick you into installing adware. You will end up infecting your computer with malware or unrelated software. They don’t serve the purpose of cracking WiFi passwords.

This post aims to create awareness about the genuine apps and software that can be used for cracking WiFi passwords.
No idea how WiFi works? Watch this video on you-tube
There are two principal ways to crack WiFi Passwords:
Passive sniffing, where the laptop’s WiFi settings are adjusted to detect and decipher all the network activities happening through a particular hot spot.
Man-in-the-middle Attack is another way in which a hacker sets up a fake Network Access point and tricks the user into connecting to it.
Before we discuss any further, let us have a look at the evolution of encryption levels in the Wifi hotspot security.

WiFi Encryption levels

It all started with WEP in the last decade of 20th century. WEP stands for “Wired Equivalent Privacy” which was launched in September 1999. From the starting, it was not a strong security system. It had many flaws. With time, increased revisions led to longer encrypted keys, revised algorithms for better protection until it was hacked officially by FBI using free software. Later, it was discontinued from 2004.
“Wifi Protected Access-Pre-Shared Key” (WPA-PSK) was the successor that used 256 bit key for advanced and stronger protection. A Special protocol called “Temporal Key Integrity Protocol” (TKIP) was used in WPA-PSK that was more secure than WEP.
But TKIP was an upgraded component for WEP that utilised some of the elements incorporated in WEP. This led to a security breach in WPA-PSK as well.
WPA2-PSK succeeded WPA-PSK. WPA2-PSK incorporated “Advanced Encryption Standards” (AES) algorithm for stronger encryption. But still, the “hashed password” obtained during the 4-way handshake (authentication protocol), can be cracked using Wi-Fi cracking softwares. Towards the end of this post, we have discussed cracking Stronger WPA2-PSK Wifi passwords using widely used Wifi hacking suite.

Six Ways to Hack any Public Wifi hotspot.

Let us now read on to know the various ways that i will be discussing here:

1. Getting quick Access by Pressing WPS button
2. Stealing Wifi passwords from already connected devices
3. Using Wifi password sharing apps for Smartphones
4. Using Wifi Hacking apps for Smartphones
5. Stealing Wifi Passwords using “WifiPhisher” Hacking Tool
6. Cracking Strong WPA2 Passwords using AirCrack-NG and Cowpathy.

The First Four methods are the easiest ones (straight forward) and need not require any extra efforts from your side.
While Methods 5 and 6 are also easy to execute, You will need to put in your efforts wisely and requires you to have Good Knowledge of Terminal Commands. Above all you need to have a lot of patience.
So lets get started!

1) Getting quick Access by Pressing WPS button

This is the easiest method of getting access to a wireless network.
Most of the routers have a Wireless Protected Setup (WPS) button adjacent to the Ethernet ports. You just have to press the button to activate it.

Your device will show the available wireless networks. Select the preferred network and you are all set to surf the internet.
Not only router but wireless printers and other wireless devices also have WPS button. The connecting procedure is similar to that of the router.

Watch these videos for detailed Instructions:

• Connection Windows machine
• Connecting Android Phone

The wireless network can be secured using an eight digit PIN code as well. You can either use the predefined PIN available in the WPS configuration page or set up the PIN code for the client to access the network.
In some cases, The PIN is also printed on the back side of the router. All you have to do is enter this PIN instead of Access point Password and you are in.
But what if you cannot reach out to the router? You could just try all the PIN combinations since the PIN code is vulnerable to brute attacks by the hackers. The code is stored in two separate blocks in the router. A hacker, with simple tools, can find the PIN code by brute force attacks and access the wireless network. Read on to method 4 to know the app that does just this.

2) Stealing Wifi passwords from already connected devices

This one is easy to accomplish. Let’s assume, you want to connect your device to the wireless network.
Now, you may remember the password or you don’t. In the latter case, you can either send a password information request to the administrator or you can directly ask for it.
If the administrator is your friend, don’t hesitate in grabbing the device and reveal password from the settings!

Here’s what you have to do:
For windows machines:
Open “Command Prompt” in Administrator mode (search for CMD, Right-Click on it and choose Run as Administrator )
Enter the following Command and Hit ENTER to reveal Wifi Password:
netsh wlan show profile name=hacker9 key=clear | findstr Key
Your password will be displayed in plain text next to “Key Content” field.
[ * ] Replace “hacker9” with your network name “SSID” of the WiFi hotspot you want to connect to.
For Mac:
Open Terminal >> Type the following command >> Hit Enter.
security find-generic-password -wa hacker9
You will be asked to authenticate yourself, Enter your Mac username and password and click ok. Your password will be displayed on the screen in plain text.
For Android Smartphones:
If your Android phone is Rooted, you can use this “Wifi Password Viewer” app to reveal your wifi password.

3) Use WiFi password sharing apps for Smartphones

There are smartphone apps with a database of credentials of various Wi-Fi access points across the world.
These Public but protected Wi-Fi access points can be of any coffee shop, hotel or hospital.
The users, who have already accessed these protected Wifi hotspot, share the details in the app for others to use.
In these apps, you could find the Wifi password of a restaurant in your locality or if you are traveling in any part of the world, there is a possibility that you get Wifi access information of a café or Airport there.
Here are some of the popular apps:

• Wifi Map – Android | iOS
• Swift Wifi – Android
• Wifi master key – Android | iOS

4) Use WiFi Hacking apps for Smartphones

There are two kinds of Wifi password cracking apps for smartphones.
1) Apps that abuse WPS PIN vulnerability found in the Router
These sophisticated apps can hack WPS-enabled Wifi Hotspots by exploiting the WPS protocol. Some work on rooted devices while others are compatible with non-rooted devices. At the same time, there are apps that can work on both rooted and non-rooted devices.
Popular apps that abuse WPS vulnerability:

• AndroDumpper (Android)
• WIFI WPS WPA TESTER (Android)

These apps make use of various algorithms like Zhao, TrendNet, Dlink and Arris to crack the password.
2) Apps that use Bruteforce and Dictionary attacks to crack passwords
Brute force attack is a trial and error method for deciphering the password. You can enter the alphabets and length of the password and the app will try all the possible combinations.
WIBR Plus is one such app for Android that will let you hack any Wifi connection that uses a weak password protection.
Essentially, the app makes use of a brute force attack that allows you to perform dictionary-based attacks on the targeted router and discover the password.
It may take from few thousand attempts to millions depending upon the password strength.

5) Stealing Wifi Passwords using “WifiPhisher” Hacking Tool

Note: Before you start reading about his method, I recommend you to go through Method #6 to understand what “Hacking suite” is made up of and what hackers rely on.
WifiPhisher has a different approach to obtain Wifi passwords.
In this method, The user itself reveals the password and you don’t need to crack the password by exploiting the algorithm or employing brute attacks.
Sounds Good?.. Yes, you can steal WiFi passwords using WiFiPhisher Tool from any secured network.

WifiPhisher uses the man-in-the-middle approach where the attacker creates a replica of the original Wireless Access Point. After that it compels the user to de-authenticate from the existing access points by jamming all the access points.
When the user tries to re-authenticate, the exact but fake Wireless Access Point’s interface is displayed with a webpage that notifies them that a “firmware upgrade” has taken place, and that they need to authenticate again.
The user Enters the password on that webpage thinking its a legitimate warning. The password is then passed to the hacker who had set-up fake Access point and as soon as he receives the password he then allows the user to connect to the real access point by disabling his fake one. This way, Wifi network credentials can be obtained.
Full Tutorial here: How to use WifiPhisher
Official Github repo: WifiPhisher

6) Cracking Strong WPA2 Passwords using AirCrack-NG and Cowpathy.

Till now, we discussed simple tricks and smartphone apps that can help in cracking or stealing the Wi-Fi hotspot password. With WPA2 encryption, most of the times, it is difficult to crack the password.
As mentioned earlier, WPA2 uses Advanced Encryption Standards (AES) protocol. This results in longer and stronger passwords.
To crack WPA2 wifi passwords, you need a reputed and effective hacking suite. Using a hacking suite requires software and hardware with heavy configuration.
Hackers and Penetration testers around the world use “Kali Linux Operating System” for carrying out any type of hacking, Including Wireless hacks.
Inside Kali OS, There are different hacking modules for different purposes. Aircrack-NG is the most widely used wireless hacking suite (module) in the world. It comprises of a complete set of tools that can be used for maneuvering and cracking Wi-Fi networks.
Despite being the most advanced hacking suite, it is sometimes very slow in cracking passwords. To compensate the slow speed, researchers have developed another wireless hacking tool called CoWPAtty which is an alternative for Aircrack-NG but often hackers use both to get optimal results. I.E. CoWPAtty can be used to speedup cracking WPA2 password by implementing dictionary or brute force attack.
Let us look at the basic steps to successfully crack strong Wifi passwords:
Our main task is to obtain “encrypted password”, So that we can decrypt it for plaintext password.

1. The first step is to make sure that our Wifi adapter/card is able to receive all traffic data. By default your wireless card will only receive packets that are intended for it.
   But since you do not have access to the network, you will not receive any traffic data unless you convert your wireless card into a promiscuous mode.
   So the first tool that is being used is Airmon-ng, which will allow our wireless card to hook-up with traffic data, no matter it was intended for it or not.
2. The next tool that is neing used is Airodump-ng, which enables us to capture packets that we are interested in.
   This tool will display all the Access points nearby with their BSSID (MAC address) including other information like the channel, the encryption method, the speed, the type of cipher used to hash the password, SSID, etc. We will be focussing only on the BSSID and the channel.
3. After finalising on best Access point with Knows SSID/ESSID, we will be carrying out attack on this particular Access point. To be able to capture the encrypted password for this Access point, we need to capture the 4 way handshake (authentication protocol) and this is only possible when someone (other client) is in the process of authentication.
   To be able to achieve this scenario, We will first de-authenticate any client and allow them to authenticate again. So we use another tool called Aireplay-Ng to de-auth any user.
4. Once we de-auth the client, he will automatically try to authenticate again and during this process out previous tool Airodump-ng will silently attempt to grab their encrypted password in the new 4-way handshake.
5. Now that we have the encrypted password, we now attempt to crack it by using a password file (Default password list included with aircrack-ng). Depending on the length of your password list, It might take a few minutes to a few days.

Refer this tutorial on using Cowpatty – Wireless hacking tool.
If you are using a normal PC to decipher the hashed password, it can take years to crack it. This is because of infinite possible combinations of characters.
To simplify your job, You need a fast and reliable multi-core CPU. Given the infinite number of possible combinations for a password, you cannot process the software on a normal CPU. The cores in the CPU make difference. Opt for a multi-core processor before initiating password cracking process.
You also require a powerful wireless adapter. Now, your device already has a WiFi adapter/card that can detect network and connect to them. But, it cannot be used for the hacking purpose. We cannot initiate our hacking process without the right wireless adapter.
The adapter should be able to accomplish two tasks. First, it should work in the monitor mode where it can detect all the networks irrespective of the frequency.
Secondly, it should be able to inject as well as detect all the packets in the air. A packet is a unit of data that is being transferred from the access point to the user and vice versa.
Now you know that you do need powerful resources to actually hack strong Wifi passwords and it is a Big deal to make your wireless passwords as much strong as possible.