選擇無線網(wǎng)卡一直是一個既糾結(jié)又頭疼的問題，查找很多Kali無線網(wǎng)卡配置文章，絕大多數(shù)都是以Windows虛擬機進(jìn)行講解的，尚未發(fā)現(xiàn)一篇Mac OS下虛擬機的配置方法。經(jīng)過查閱大量材料及實踐后，將排雷經(jīng)驗記錄下來，希望能夠幫助大家。
Hack and Have fun！
無線網(wǎng)卡選擇
思路一：使用MacBook Pro自帶無線網(wǎng)卡
MacBook Pro無線網(wǎng)卡信息：
卡類型： AirPort Extreme (0x14E4, 0x133)
固件版本： Broadcom BCM43xx 1.0 (7.77.61.1 AirPortDriverBrcmNIC-1305.2)
翻墻查資料N久，最接近成功的是這篇教程Kali Linux Wireless/Wifi Adapter (Not detecting) [FIX] 2018，雖然ifconfig指令可以看到無線網(wǎng)卡信息，但是搜索不到周圍AP，也不能設(shè)置monitor模式。故放棄。
若有那位老兄使用MacBook Pro 自帶網(wǎng)卡可以設(shè)置成功，請您一定要在我博客下方留言告知！
思路二：使用外設(shè)USB無線網(wǎng)卡
- Alfa AWUS036H [b/g USB]
- Ubiquiti SRC [a/b/g Cardbus]
- Ubiquiti SRX [a/b/g ExpressCard]
- Airpcap series [USB]
- TP-Link TL-WN722N v1 [b/g/n USB] - Beware, if version is not specified by vendor, it is NOT v1
- Alfa AWUS036NHA [b/g/n USB]
- Alfa AWUS051NH v2 [a/b/g/n USB]
- MiniPCIe: anything that uses ath9k, especially AR92xx and AR93xx (ability to do spectral scan)
注意：TP-Link TL-WN722N 一定要選擇V1版本
本來想選用業(yè)界推崇的WN722N，但是此型號在電商平臺確實難求，所以在某寶選擇了“vendor”的無線網(wǎng)卡（Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter）。
無論我們選取哪款無線網(wǎng)卡做滲透測試，至少要滿足以下兩點：支持AP及monitor模式。
AP模式：可作為evil無線接入點
monitor模式：可以進(jìn)行抓包
配置無線網(wǎng)絡(luò)
環(huán)境：MacBook Pro - Mac OS Mojave
虛擬機：VirtualBox
無線網(wǎng)卡：Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
注意：一定要選擇USB3.0(xHCI)控制器，否則iw指令或設(shè)置monitor模式會存在問題
查詢無線網(wǎng)卡基本情況
root@kali:~# iwconfig
lo no wireless extensions.
wlan0 IEEE 802.11 ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry short long limit:2 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
eth0 no wireless extensions.
wlan0就是我們所選擇的無線網(wǎng)卡
root@kali:~# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.1.105 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 ▇▇::▇▇:▇▇:▇▇ prefixlen 64 scopeid 0x20<link>
ether ▇▇:▇▇:▇▇:▇▇:▇▇:▇▇ txqueuelen 1000 (Ethernet)
RX packets 1915 bytes 132391 (129.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 53 bytes 4933 (4.8 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 20 bytes 1116 (1.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 20 bytes 1116 (1.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlan0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether ▇▇:▇▇:▇▇:▇▇:▇▇:▇▇ txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
如果ifconfig命令中沒有發(fā)現(xiàn)wlan0，通過ifconfig -a查看無線網(wǎng)卡是否存在，若存在則證明wlan0沒有啟動，需要進(jìn)行配置
root@kali:~# ifconfig wlan0 up
通過iw list指令查看無線網(wǎng)卡詳細(xì)信息
root@kali:~# iw list
查看支持接口模式
root@kali:~# iw list
......
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* monitor
* mesh point
......
查看信道
root@kali:~# iwlist wlan0 frequency
wlan0 14 channels in total; available frequencies :
Channel 01 : 2.412 GHz
Channel 02 : 2.417 GHz
Channel 03 : 2.422 GHz
Channel 04 : 2.427 GHz
Channel 05 : 2.432 GHz
Channel 06 : 2.437 GHz
Channel 07 : 2.442 GHz
Channel 08 : 2.447 GHz
Channel 09 : 2.452 GHz
Channel 10 : 2.457 GHz
Channel 11 : 2.462 GHz
Channel 12 : 2.467 GHz
Channel 13 : 2.472 GHz
Channel 14 : 2.484 GHz
Current Frequency:2.447 GHz (Channel 8)
或者使用iw list指令
......
Frequencies:
* 2412 MHz [1] (20.0 dBm)
* 2417 MHz [2] (20.0 dBm)
* 2422 MHz [3] (20.0 dBm)
* 2427 MHz [4] (20.0 dBm)
* 2432 MHz [5] (20.0 dBm)
* 2437 MHz [6] (20.0 dBm)
* 2442 MHz [7] (20.0 dBm)
* 2447 MHz [8] (20.0 dBm)
* 2452 MHz [9] (20.0 dBm)
* 2457 MHz [10] (20.0 dBm)
* 2462 MHz [11] (20.0 dBm)
* 2467 MHz [12] (20.0 dBm) (no IR)
* 2472 MHz [13] (20.0 dBm) (no IR)
* 2484 MHz [14] (20.0 dBm) (no IR)
......
發(fā)現(xiàn)AP
root@kali:~# iw dev wlan0 scan
還可以通過管道進(jìn)行篩選：
搜索附近AP名稱
root@kali:~# iw dev wlan0 scan | grep SSID
SSID: 1▇▇▇▇
SSID: T▇▇▇▇
SSID: C▇▇▇▇
......
搜索附近AP名稱及信道
root@kali:~# iw dev wlan0 scan | egrep "DS\ Parameter\ set|SSID"
SSID: 1▇▇▇▇
DS Parameter set: channel 11
SSID: T▇▇▇▇
DS Parameter set: channel 11
SSID: C▇▇▇▇
DS Parameter set: channel 1
......
搜索名稱、信道及頻率
root@kali:~# iwlist wlan0 scanning | egrep "ESSID|Channel"
Channel:11
Frequency:2.462 GHz (Channel 11)
ESSID:"1▇▇▇▇"
Channel:11
Frequency:2.462 GHz (Channel 11)
ESSID:"T▇▇▇▇"
Channel:1
Frequency:2.412 GHz (Channel 1)
ESSID:"C▇▇▇▇"
Channel:1
monitor模式
增加monitor模式
對無線網(wǎng)卡添加monitor模式后才可以進(jìn)行無線抓包，命名規(guī)則在原有無線網(wǎng)卡名稱后添加mon，例：wlan0 -> wlan0mon
root@kali:~# iw dev wlan0 interface add wlan0mon type monitor
啟動wlan0mon
添加wlan0mon后不會自動啟動，需要手動進(jìn)行啟動
root@kali:~# ifconfig wlan0mon up
刪除monitor
抓包之后可以刪除monitor
root@kali:~# iw dev wlan0mon interface del
抓包
打開Wireshark 選擇wlan0mon
