An (Updated) Hacker’s Toolkit

hacker
Facebooktwittergoogle_plusredditpinterestlinkedinmail

We thought that this would be a good time to update this popular article, as new tools to hack private communications in WiFi hotspots are always evolving. This article discusses some of the most well-known WiFi hacking tools.

Instructions

Unfortunately, novice hackers don’t have to look very hard to find all they need to know regarding how to hack. For example:

  • Kali Linux is one of the best known hacking tool collections, and their website provides many how-to hacking links.
  • YouTube now has more than 300,000 videos on WiFi hacking, some with millions and millions of views. One of the first listed is called “how to hack any WiFi hotspot in about 30 seconds.”
  • There are many other hacking websites out there, but since many of them are dubious and may have malware installed on them, we do not want to link to them as they may put you at risk.

Software

The following is a list of the top 10 tools preferred by both ethical and black hat hackers in 2015:

  • Angry IP Scanner: Angry IP Scanner is a free network scanner that is very easy to use. It scans IP addresses and ports to find open ports.
  • Burp Suite:  A penetration testing tool that has several features that can map out the various pages and structure of a website by looking at cookies, and then initiates attacks on various web applications.
  • Cain & Able: This is a multi-purpose tool that can intercept network traffic, using information contained in those packets to crack encrypted passwords using dictionary, brute-force and cryptanalysis attack methods, record VoIP conversations, recover wireless network keys, and analyze routing protocols. Its main purpose is the simplified recovery of passwords and credentials. This software has been downloaded over 400,000 times.
  • Ettercap: This widely used hacking tool works by placing a user’s network interface into promiscuous mode and by ARP poisoning, which is a process in which the hacker gives the wrong MAC or IP address to the network in order to carry out a Man-in-the-Middle attack.
  • John the Ripper: This hacking tool is popular for dictionary attack. It takes text string samples from a large dictionary, encrypts it in the same way as the password being crack, and then compares the output to the encrypted string. This is an example of a brute force attack.
  • Metasploit: This hacking tool can be used for exploiting a network’s backdoor. While it’s not free, it is a huge popular penetration testing tool used by both ethical hackers, as well as unethical ones. It helps provide information about known security vulnerabilities for a network.
  • NMap: Also known as Network Mapper (or nmap for short), this free hacking tool is used by network administrators for security and auditing purposes. It uses IP packets to determine what hosts are available on the networks, what services they offer, what types of protocols are being used, what operating systems are being used on the network, and what type of packet filters and firewalls are being used.
  • Nessus Remote Security Scanner: This hacking tool can be used with client-server frameworks, and is the most popular vulnerability scanner worldwide.
  • THC Hydra: This is another password hacking tool that uses a dictionary or brute force attack to try various password and login combinations against a log in page.
  • Wapiti: This is a penetration testing tool that is able to scan hundreds of possible vulnerabilities. It can audit the security of web application by performing black box scans, which scans the HTML pages of the application it is trying to attack in order to inject data.

For hackers that prefer a turn-key package, there are also hardware wireless hacking tools available. We’ve highlighted one called WiFi Pineapple. It’s a simple, small, portable device that can be carried into any hotspot and used to attract any laptop trying to find a WiFi  access point. The Pineapple uses a technique called an Evil Twin attack. Hackers have used tools like KARMA to do the same thing for years, but with Pineapple, now you can buy a piece of hardware for only $100 that allows you to become a hacker without downloading or installing any software.

Here’s what their website says: “Of course all of the Internet traffic flowing through the pineapple such as e-mail, instant messages and browser sessions are easily viewed or even modified by the pineapple holder.”

Hacking Countermeasures

Fortunately, there are resources that you can use to help combat these threats. Below are two excellent books:

  • Hacking Exposed: Network Security Secrets & Solutions, by Joel Scambray. This book talks about security from an offensive angle and includes a catalog of the weapons hackers use. Readers see what programs are out there, quickly understand what the programs can do, and benefit from detailed explanations of concepts that most system administrators do not understand in detail. Hacking Exposed wastes no time in explaining how to implement the countermeasures that will render known attacks ineffective. Taking on the major network operating systems and network devices one at a time, the authors tell you exactly what UNIX configuration files to alter, what Windows NT Registry keys to change, and what settings to make in NetWare.
  • Wi-Foo: The Secrets of Wireless Hacking, by A. Vladimirov, K. Gavrilenko, and A. Mikhailovsky. This book is the first practical and realistic book about 802.11 network penetration testing and hardening, based on a daily experience of breaking into and securing wireless LANs. Rather than collecting random wireless security news, tools, and methodologies, Wi-Foo presents a systematic approach to wireless security threats and countermeasures starting from the rational wireless hardware selection for security auditing and describes how to choose the optimal encryption ciphers for the particular network you are trying to protect.

Definitions

The following list includes common WiFi terms discussed in this white paper. For additional terms and definitions, please see our online glossary.

Brute Force Attack

Brute force (also known as brute force cracking) is a trial and error method used by application programs to decode encrypted data such as passwords through exhaustive effort (using brute force) rather than employing intellectual strategies. Just as a criminal might break into, or “crack” a safe by trying many possible combinations, a brute force cracking application proceeds through all possible combinations of legal characters in sequence. Brute force is considered to be an infallible, although time-consuming, approach.

Encryption

Encryption is the translation of data into a secret code. To read encrypted data, you must have access to the secret key or password that was used to translate the data into cipher text. That same key or password enables you to decrypt cipher text back into the original plain text. Encryption is the most effective way to achieve data security, but depends on using keys known only by the sender and intended recipient. If a hacker can guess (crack) the key, data security is compromised.

Evil Twin

This is a rogue WiFi access point that appears to be a legitimate one, but actually has been set up by a hacker to intercept wireless communications. An Evil Twin is the wireless version of the “phishing” scam: an attacker fools wireless users into connecting their laptop or mobile phone by posing as a legitimate access point (such as a hotspot provider). When a victim connects to the Evil Twin, the hacker can launch man-in-the-middle attacks, listening in on all Internet traffic, or just ask for credit card information in the standard pay-for-access deal. Tools for setting up an evil twin are easily available (e.g., Karma and Hotspotter). One recent study found that over 56% of laptops were broadcasting the name of their trusted WiFi networks, and that 34% of them were willing to connect to highly insecure WiFi networks – which could turn out to be Evil Twins.

HTTPS

Hypertext Transfer Protocol Secure (HTTPS) combines the Hypertext Transfer Protocol used by browsers and websites with the SSL/TLS protocol used to provide encrypted communication and web server authentication. HTTPS connections are often used to protect payment transactions on the Internet so that anyone that might intercept those packets cannot decipher sensitive information contained therein.

Man-In-the-Middle Attacks

A man-in-the-middle attack is a form of active eavesdropping in which the attacker makes independent connections a communication source and destination and relays messages between them, making those victims believe that they are talking directly to each other, when in fact the entire conversation is being controlled by the attacker. The attacker must be able to intercept all messages exchanged between the two victims. For example, an attacker within reception range of an unencrypted WiFi access point can insert himself as a man-in-the-middle by redirecting all packets through an Evil Twin. Or an attacker can create a phishing website that poses as an online bank or merchant, letting victims sign into the phishing server over a SSL connection. The attacker can then log onto the real server using victim-supplied information, capturing all messages exchanged between the user and real server – for example, to steal credit card numbers.

Sidejacking

Sidejacking is a web attack method where a hacker uses packet sniffing to steal a session cookie from a website you just visited. These cookies are generally sent back to browsers unencrypted, even if the original website log-in was protected via HTTPS.  Anyone listening can steal these cookies and then use them access your authenticated web session. This recently made news because a programmer released a Firefox plug-in called Firesheep that makes it easy for an intruder sitting near you on an open network (like a public wifi hotspot) to sidejack many popular website sessions. For example, a sidejacker using Firesheep could take over your Facebook session, thereby gaining access to all of your sensitive data, and even send viral messages and wall posts to all of your friends.

Sniffers

Packet sniffers allow eavesdroppers to passively intercept data sent between your laptop or smartphone and other systems, such as web servers on the Internet. This is the easiest and most basic kind of wireless attack. Any email, web search or file you transfer between computers or open from network locations on an unsecured wireless network can be captured by a nearby hacker using a sniffer. Sniffing tools are readily available for free on the web and there are at least 184 videos on YouTube to show budding hackers how to use them. The only way to protect yourself against WiFi sniffing in most public WiFi hotspots is to use a VPN to encrypt everything sent over the air.

SSL

A Netscape-defined protocol for securing data communications – particularly web transactions – sent across computer networks. The Secure Sockets Layer (SSL) protocol establishes a secure session by electronically authenticating the server end of any connection, and then using encryption to protect all subsequent transmissions. The Transport Layer Security (TLS) protocol refers to the Internet standard replacement for SSL. Websites that are addressed by URLs that begin with https instead of http use SSL or TLS.

WEP and WPA

WEP and WPA are security protocols used to protect wireless networks. Wired Equivalent Privacy (WEP) is a deprecated security protocol for IEEE 802.11 wireless networks. Because all wireless transmissions are susceptible to eavesdropping, WEP was introduced as part of the original 802.11 standard in 1997. It was intended to provide confidentiality comparable to that of a traditional wired network. Since 2001, several serious weaknesses in the protocol have been identified so that today a WEP connection can be cracked within minutes. In response to these vulnerabilities, in 2003 the Wi-Fi Alliance announced that WEP had been superseded by Wi-Fi Protected Access (WPA). Wi-Fi Protected Access versions 1 and 2 (WPA and WPA2) refer to certification programs that test WiFi product support for newer IEEE 802.11i standard security protocols that encrypt data sent over the air, from WiFi user to WiFi router.

Get Private Wifi   Protect your personal information.
Get DataCompress   Cut your mobile data usage.

Jared Howe

Jared Howe is PRIVATE WiFi’s Senior Manager, Product Marketing Communications. Working in high tech for over 15 years, Jared currently lives in Seattle with his wife, daughter, and their two cats.

  • Pingback: Private WiFi Overhauls the Private-i | Wordpress Blackhat SEO Guide()

  • Andrew Lamb

    Why is it there are no countermeasures offered? I want a program that captures a hackers information or follows them back home, Maybe like what the railroads did to discourage spying on the telegraph lines. They scheduled down time where high voltage would be run through the wires to destroy the coils of interception telegraph receiving sets. I have certainly wanted to plug my ethernet into the AC socket a time or two.
    I would be happy for a utility or a device that could reliably detect and log the IP address of every connection like caller ID does for phones. PITA to keep going to a whois. …To discover its Google as usual.

    AL.

    • DJHenjin

      Andrew Lamb,

      If you plug your ethernet cable into the AC socket not only will you destroy the cable, but you will also destroy a bunch of networking equipment on the way to your ISP, as well as modems in neighbors houses depending on the amount of them, when a hacker is connected to your machine there is no direct wired connection between them and your computer, all you will accomplish is destroying your own stuff, As for logging IP addresses of connections, there is software that your router will send the connection information of every active connection and it will log it to your computer. It tells you source IP source port, end IP and end Port, as well as being configurable to try and resolve source hostname, IE if it comes from google.com. The software does exist, you just have to know how to use it. the only reason sending HV down the telegraph lines in the olden days worked to destroy spying equipment connected is it was actually directly connected to the wire. modern internet is very low voltage and works off a voltage differential.

    • Danix Defcon 5

      Because the only real countermeasure is actually securing your network. WEP is highly broken and using it these days is the equivalent of setting up a fancy shmancy 18th century lock in your front door. Sure it looks nice, but modern lock pickers are going to get around it in a matter of minutes. The real solution is:

      – DON’T USE WIFI. Stop being a lazy ass and run up ethernet through your house.
      – If you really, REALLY need WiFi (say, roaming laptops or mobile devices) set it up with at least WPA2-AES/PSK as it is as of mid-2014 still safe. Even WPA/TKIP or WPA2/TKIP are “secure” enough if you don’t have a guessable passphrase, but I wouldn’t count on that. Just skip through to AES.

  • Aundrea S

    WHY are you giving the info to people on HOW to Hack and not HOW NOT TO BE HACKED???????

    • Dash_Merc

      How to *hack* and how to *defend against hacks* involve the same knowledge. You have to know your enemy — how they think, how they operate — in order to stop them. Most wars throughout history (in *any* culture) were won by espionage, by “intelligence” — not by brute force. Why else do you think every major world power has spy agencies and elite hacker forces? The USAF (USA), IDF (Israel), and PLA (China), for example, have some of the world’s best hackers working for them — and often being *paid* to do it. Did you hear about that Anonymous take-down a while back, where several members were arrested on hacking charges? The FBI caught them because they had an informant in their ranks — a former member of Anonymous who was coerced into selling out his cohorts. You have to know how to do bad things in order to stop people from doing bad things. Ignorance is a weakness. Now go learn you some hacking, and maybe you can stop people from hacking you, or your employer — unless you live in Germany, in which case even learning to hack is a crime (so don’t get caught).

      • Vincent

        Finally!

    • meh

      aPasswordLikeThisWithWpa2-PSKshouldsufice!!!
      the longer your paswword the harder to crack there comes a point where an extra leter becomes hours, another few weeks, then years, then centuries, at least 20 should make the average cracker give up
      make it harder, buy having a few capital letters and numbers in it and symbols make it even harder, dont go over kill and make it a pain to remember keep it simple, just the longer… the better…

      if you can, change default ip of router
      set up static ip address on a diffrent subnet from dhcp
      dont broadcast ssid

      consider vpn+ddwrt

      • My Fake name

        meh aPasswordLikeThisWithWpa2-PSKshouldsufice is not actually an effective password as all of that is in a dictionary and I could easily run my english dictionary through john the ripper to get through.

        ip of your router does nothing, The cracking part to login just uses your signal and ip only matters after you been hacked (In which case all you do is look at your gateway ip and i have whatever ip you changed your router to)

        static ip address actually does not matter either because i could spoof my mac address to mimic yours and deauth you thus assuming your computers identity

        don’t broadcast ssid, many people assume that will help them yet when monitoring packets between the router and a communicating device the ssid is discovered by the packets.

        ddwrt is a firmware mod for your router (Just as easy as your standard router imo but does have fun local network features)

        and i don’t exactly know where you are trying to fit a virtual private network(VPN) in here as that does nothing as far as your actual wireless security goes.

        There are several definite ways to protect your network, ;) research it and then you will know for sure what they are.

        The 2 secrets to success are 1. Don’t tell people everything you know and 2. …

        • Nar S

          No english dictionary contains words combined like that. Can you explain how you can do it? Because afaik you can never! Checking words itself takes time. If you combine all words in different combinations….lol…good luck with john the ripper….it will rip your underwear sooner than this password.
          And yeah, you missed the three exclamation marks in the password.

    • Bild0

      There are people who are asked to hack networks to expose vulnerabilities before the dark side can get to them…aka penetration testers.

  • My Fake name

    As Aircrack-NG suite states in it’s name, this is defined as cracking not hacking.

  • Mark Welton

    Maybe you can help me. I am looking for an app to run on a mobile phone that will sniff and report on other mobile devices in the area. Need to capture the neighboring mobile device’s MAC ID, or IP or UDID or any other distinguishing ID. Do you know where I should look?

    Thanks
    Mark

  • Helen Adams

    if you ever require the service of a professional to consult for all your cyber/identity issues, then darkwebssolutions on gmail is your guy! Or text +19193076946 (Text only)

  • Carter Hill

    If you are going to claim adultery as the reason for your divorce, you are going to have to prove your claim in court. To do so, you will need to know what the law requires, what evidence to look for and retain, and how to present that evidence in court. I contacted CYBERNETICHACKER@GMAIL.COM to help me hack into my cheating wife’s phone to get the proof i needed and gave it to my attorney which really helped me win the custody of our daughter in court. I told him I was gonna do this for him if the result turned out well, and here I am testifying to the whole world the good job you did for me. Thank you (cybernetichacker@gmail.com) for helping me. Y’all can reach him if you need such services too and thank me later. They are also into all types of social media hacks, website & database hack, bank account hacks and many more at an affordable price, He’s fast and trustworthy.

  • database expert

    For all school upgrade, and other hack jobs,
    we are the specialist and our client’s sastifaction is our priority
    Clone your partners phone to check his/her sincerity
    contact us at databaseexpert007@gmail.com
    No upfront payment

  • jenette plaster

    I’m so

    excited, I came across a brilliant and reliable hacker. You should be

    in touch with the uniqueinvisiblehackers they are capable of hacking

    what has been hacked before and recovered the deleted or lost files . I

    met a computer guy named web specialhackers not too long and he

    said to me; “anything internet/computer can be hacked,everthing has a

    hole”. I got convinced when he hacked into my fiancee gmail account,

    facebook account and at the same time,her whatsapp account. I know it’s

    kinda bad, don’t blame me. I needed to be sure. This dude gets into

    accounts like a ghost UNNOTICED, UNTRACEABLE AND UNTOUCHED. Information

    is the greatest tool one can ever haveI’m so excited, I came across a

    brilliant and reliable hacker. I know it’s kinda bad, don’t blame me. I

    needed to be sure. This dudes gets into accounts like a ghost UNNOTICED,

    UNTRACEABLE AND UNTOUCHED. Now I know when he’s telling the truth and

    how to curtail him, I think it is not a drastic step if it’ll make you

    feel better. My life got better, I stopped using my precious time to

    bother about his indiscretions and channelled my energy positively.

    Their services includes: phone calls, messages, contacts, social

    media(viber, whatsapp,facebook,kik e.t.c), emails, any kind of

    hacks ,Geo location tracking, all other hacking and web hacking

    issues.You can reach them via (Specialhacker4u@gmail. C O M)

    • amand parker

      great guys……there work is clean,affordable and fast…thank you for exposing my cheating ass husband

  • andy brain

    If you Need a well known hacker or specialized one,His job is secured without trace.I experienced him through a forum and his good at all sort of hack you required from him.His also specialize in hacking into email accounts(gmail, yahoo, aol etc.)If you want to gain access to various networks,(Facebook,Twitter,badoo etc.)His also specialized and has experienced to hack into criminal records, smartphone hack.finally you can also Increase your credit score OR Clear your depth?contact him at: darkwebcyberservice@gmail.com

  • Esther Smart
  • andreacross241@gmail.com

    (1)Do you need to hack into any school database server?
    improve your credit score, hacking of school of grades upgrade your credit scores, cloning your partners phone ….Hack all kinds of social media’s accounts….
    If Interested, contact via email on screen above

  • amazinghacker4u@gmail.com

    i’m a reliable and trust worthy hacker…..i don’t get involve in scam and i don’t charge much

  • surin

    If you need a professional, reliable and efficent hacker, then you should contact[ terabytetechnservices @ gmail . com.. They are a group computer penetration experts dedicated to providing the best hacker for hire service on the web. They make malware, ddos attacks, deletion of records from any database, creation of new identities, hack social networks (Facebook, Instagram, BBM, Skype, Snapchat, Twitter, Word Press, iCloud accounts etc.), hack mobile devices, unlock any device, hack mobiles apps, hack school result portals, hack amazon accounts, clone websites, create blank cards, hack bank accounts, can tap into your spouse’s phone to monitor calls and text message interception. This is for those who actually require the services of a good hacker, I can definitely attest to how good and efficient they are, I owe my life right now to this team. They are very reliable and you can count on them. Glad to be of help.

  • deb harper

    Don’t trust anyone it’s sad when your husband is having love affairs with your best friend, i noticed my husband is getting too much closer with my friend Joan, my husband chats now in private,his calls are in secret and he changed his phone password, I was wondering what going wrong, on till my sister introduced me to certifiednewhacker77@gmail. com who help me to hack my husband phone, you don’t need to touch his phone, in less than 7 hours after his phone was finally hacked, his messages coming into my phone instantly. contact certifiednewhacker77@gmail. com his services are affordable,text him on 616 947 7397 i am sure he will help you

  • web service

    Hello hire: darkwebcyberservice@gmail.com.They are professional hackers in the word when you meet the right one at the right time.

    I will provide you a better service and have work with alot of people out there and i will keep your work anonymous from other customer and i am able to hack into anything as long its conected to the internent.

    1- I can fix and increase your credit score to excellent result.
    2- I can hack any smart phone to spy on it even monitor chat messages like watsapp or track it
    3- I can hack social media sites like twitter , instagram , facebook , myspace
    4- I can hack into websites and edit criminal records.
    5 I can make bank transfers or send money to your credit cards
    6- I can hack university web servers to change student grades

    If you need such assistance contact me on:

    darkwebcyberservice@gmail.com

  • Blosch Kiriakidis

    I am posting this Testimony as a way to openly thank botspy*AT* cyberservices*com for helping me achieve what none of this other so called hackers could do. It was like a dream come true for me and I am recommending botspy*AT* cyberservices*com to anyone that has any hacking issues that needs to be addressed. feel free to contact botspy*AT* cyberservices*com for Facebook, Snapchat, Cloning, Upgrading of Grades, Gmail, Yahoo, Instagram and Whatsapp hacks. Don’t waste your time thinking about this issues botspy*AT* cyberservices*com

  • Rick

    Are you need a genuine hacker that can hack any kind of social network, upgrade score, bug phone lines and many other hacking services?…
    Contact: polymorphic_h@gmx.com

  • yulasihuf

    Hi,I have worked with; terabytetechnservices @gmail.com and he is a real genius when it comes to intercepting calls,Hacking Facebook,whatsaap,Emails,websites hack,who your spouse talking/Chatting with lately…You don’t need to find around!A trial will convince you.We are the best in hacking services.

  • Carta Robert

    I GOT MY PROGRAMMED BLANK ATM CARD TO WITHDRAW A MAXIMUM OF $5000 DAILY.
    I AM SO EXCITED BECAUSE I ORDERED AND PAID FOR DELIVERY, DIDN’T GET SCAMMED, AND I NOW OWN MY HOME,
    MY BUSINESS HAS GROWN BIGGER.
    GEORG BEDNORZ (georgbednorzhackers@gmail.com) IS THE NAME OF THIS USA HACKER THAT GAVE ME THE CARD AND MADE MY
    FAMILY MORE HAPPIER THAN EVER.
    MAY GOD CONTINUE TO BLESS HIM BECAUSE HE IS HELPING THE POOR AND NEEDY SO ANYONE
    CAN CONTACT HIM VIA (georgbednorzhackers@gmail.com)

  • Sandra

    I notice my husband used to be free with everything and never kept any secret until recently everything changed so i began to suspect some foul play.he keep late to bed most night and clear all his chat which his not use to it,this went on for long until one day i decided to notify my friend about this and that was how she introduced me to Mr Dark Web who help her when she was willing to raise her credit score.I never believed he could do it until he proved it to me by hacking into my husbands phone where i found so many evidence to proof that my husband had several affairs outside our marriage.well here is his email address if you need his help. darkwebcyberservice@gmail.com

  • Monica James

    cyberlord231@gmail.com made me happy after a sad experience with some fake hackers,Talent speaks for itself, at the beginning of the job i knew he has potentials and by the time he delivered to me i was totally blown away. I wanna say thanks to him again for letting me get the value of my money.

  • Good hacking tools

  • loki

    Our goals is to render a successful hack service , without traces, notification or track from host . And that is what we have been doing over the years.. ( We offer services like School Grade Hacks, Increase Credit score, Erasing of Criminal Records, spy on someone conversation , Emails and social medial Hacks ) If you really need a hacking service, the choice is yours to find a better hacker. Contact, terabytetechnservices @gmail.com]
    ..

  • Hargrave Mercy

    I have been a victim of scam to different hackers who almost ruined me till i read about spycyber452@gmail.com, i decided to give him a try and just last night i checked my credit score and saw the positive changes he had made!! i have since then connected him to friends and family who all were flabbergasted by his results, i feel its only right i share him with the public as I’m sure there are so many in my situation.

  • Daniel S hathaway

    Thank you so much jeajamhacker @ gmail. com, he helped me run some hacks and did perfectly, if you need your job done by the real deal, then contact him .jeajamhacker hacked into my spouse phone and brought me awesome results(call logs,whats-app messages,text messages,viber,Facebook,deleted text messages and many more) i need not talk much because talk is cheap, give him a try.

  • Valerie Hugart Beal

    Hey everyone , I don’t really know much about this hack things but I can direct you to a professional hacker who helped me to track and hack my husband Phone and his Facebook respectively… For any social network or iPhones and other phones hacking , you can just contact them at (971) 333-1125 email;repaircard at gmail dot com… Their charges are minimal and negotiable…. You can thank me later