Every tutorial I look at shows people decrypting 802.11 packets by using handshake keys on a PASSWORD PROTECTED wifi. I see 802.11 packets on a Wi-Fi that doesnt have a password to connect to it. How would I decrypt 802.11 packets if there is no password for a handshake to occur?
If it's open, there is no encryption so there is no need to decrypt to see the actual data payloads sent between hosts. What you are likely seeing are management and control frames; these do not require decryption but also do not contain payload data that you might want to see.
To see just data, try a filter such as
wlan.fc.type_subtype in {0x20 0x28}
If you have a capture from a monitor mode device, then this filter should hide the management and control frames and just show data/QoS data frames. For a network that is open, the payloads here will be visible (for example, might be http, dns, whatever).
Sorry accidentally "Answered" my question. I meant to comment. This makes sense now. Sorry if I looked like an idiot. Also how do I know what frequency to put my monitor mode into so I capture the most interesting stuff. I am particularly looking to capture http protocols. What's the easiest way to do it?
The most interesting stuff is available via a channel that is certainly specific only to you and your location. No one here can answer this; what are you trying to do? If you have specific devices that you want to study, then find out what channel they use, and then that would be the channel with the most interesting stuff.
If you want to see web traffic from other hosts, find out what channels they are on and you want to be there. If you really have no idea, do a survey. Do some network reconnaissance across all the channels (many tools like aircrack-ng, kismet, bettercap, horst, etc) allow for scanning of channels so look around and pick a good one. Note that laws vary and sniffing other people's traffic might not be legal.
Some general guidelines - much of the world will only use channels 1-6-11 on 2.4GHz ...
Ok thanks. I appreciate your guys help. At least I wasn't going crazy.
Comments