Fluxion -- Crack WiFi Passwords in Minutes

Fluxion is a security auditing and social-engineering research tool. It is a remake of linset tool by vk496 which is not upgraded for last 6 years. Fluxion have much more functionality. The script attempts to retrieve the WPA/WPA2 key from a target access point by means of a social engineering (phishing) attack. It's compatible with our Kali Linux.

fluxion kali linux wifi auditing tool
 Work of Fluxion:
  1. Scan for a target wireless network.
  2. Launch the Handshake Snooper attack.
  3. Capture a handshake (necessary for password verification).
  4. Launch Captive Portal attack.
  5. Spawns a rogue (fake) AP, imitating the original access point.
  6. Spawns a DNS server, redirecting all requests to the attacker’s host running the captive portal.
  7. Spawns a web server, serving the captive portal which prompts users for their WPA/WPA2 key.
  8. Spawns a jammer, de-authenticating all clients from original AP and luring them to the rogue AP.
  9. All authentication attempts at the captive portal are checked against the handshake file captured earlier.
  10. The attack will automatically terminate once a correct key has been submitted.
  11. The key will be logged and clients will be allowed to reconnect to the target access point.
Installation

Installation process of fluxion in our Kali Linux is quite easy and simple. As the many other tools we also need to clone fluxion from it'd GitHub repository.

To clone it we use following command in our Kali Linux terminal:

git clone https://github.com/FluxionNetwork/fluxion
This command will clone the fluxion in our system.

clonning fluxion from GitHub

Now we navigate to fluxion by using simple cd command:

cd fluxion
Now for the first time we run the bash script called fluxion.sh with -i flag to install the requirements to use fluxion:

sudo ./fluxion.sh -i
From the next time we don't need to use the -i flag, we just run:

sudo ./fluxion.sh
 In the following screenshot we can see that we are installing our missing packages:

fluxion installing requirements

After installing requirements it will start automatically and prompts for choosing language:
choosing language in fluxion

Then we need to select the wireless interface. If our system's wireless interface supports packet injection and monitor mode then we can go with it. But our Laptop's wireless chipset does not support injection and monitor mode so we use a Alfa wireless adapter AWUS036NEH (Available on Amazon, all the external wireless adapter in market does not supports monitor mode & packet injection).

selecting wireless interface

Then we need to search for WiFi networks around us:

fluxion selecting a channel

We can search dual band or any specific channel signals here.
Then it will start searching wireless networks nearby us.

fluxion scanning for nearby wifi

We give it some time to detect all networks then we stop it we press ctrl+x, and it will show us the founded WiFi networks.

available wireless networks

Now we select the wireless interface for tracking (If we are not sure what to do then we can skip this by selecting option 3).

interfaces for target tracking

Then we need to choose handshake retrieval method:

handshake captureing methods

For jamming and monitoring we must need to select interface (in our case we need to select our Alfa card i.e wlan1)

Interfaces for jamming and monitoring

Now fluxion prompts for verification hash process we go with the recommended.

fluxion hash process

Rest all the options are basics and nothing much to tell about it. Fluxion will de-authenticate all the target connected with our targeted wireless network. When the de-authenticated devices try again to connects fluxion will capture the handshake.

We can do this type of things also in aircrack-ng but fluxion is advanced and user-friendly. 

Fluxion is also capable to perform a Evil-Twin attack. In this attack technique we send de-authentication packets continuously to the target that all the client of target device will got disconnect and that time we create another WiFi with the same name and if clients thinks your WiFi as their original they got trapped and we got their credentials. Almost like phishing.

fluction in action
Handshake Capturing in Fluxion
Liked our tutorial then visit us regularly to get news updates and tutorial updates follow us on Twitter and Medium.

Got any trouble ? Please comment below we are always happy to help you.

13 comments:

  1. i keep getting a message that states " Dependency installation failed"
    "Package dhcp is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source."

    "E: PAckage 'dhcp' has no installation candidate "

    ReplyDelete
  2. Try following command
    sudo apt-get install isc-dhcp-server
    Then dhcp will be installed. Now run Fluxion.. Happy hunting.

    ReplyDelete
  3. https://www.facebook.com/sabuj.dey.564

    ReplyDelete
  4. In evil twin attack when we create fake router there is no option for tenda router what should I do then?

    ReplyDelete
    Replies
    1. The fake router pages are stored in fluxion/attacks/Captive Portal/sites directory. You can modify one of them and manually create a html page for your tenda router. It will do your job. Thanks.

      Delete
  5. Can you please tell me how to modify it as I am a beginner.

    ReplyDelete
    Replies
    1. This requires some knowledge in HTML CSS and js. You need to learn some programming. Otherwise you will become a script-kiddie. Everyone starts from script kiddie but keep learning things. That will really improve you.

      Delete
    2. Can you please edit the file and give the link here as it will also help others. I will give you the required information about tenda router if needed. After some time I will learn programming. Please

      Delete
  6. I am using fluxion 6.9 and it stuck at Starting Captive Portal access point service I tried many times what should I do.

    ReplyDelete
    Replies
    1. Can you please specify the errors.

      Delete
    2. There are no errors but it stops at starting captive portal acces point service.

      Delete
    3. You should read this, here you will get all the information of captive portal. If the problem still comes then you should open an issue in fluxion github, developers can help you.

      Delete

Please do not spam here. It is comment box not a spambox. Promotional links are not allowed.

Powered by Blogger.