> For the complete documentation index, see [llms.txt](https://wifi-hacking.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wifi-hacking.cavementech.com/hidden-wifi-networks.md).
# Hidden WIFI Networks
### Finding the ESSID of the hidden AP
Put the adapter in monitor mode and scan all bands
```
sudo airmon-ng start wlan0
```
```
sudo airodump-ng wlan0mon -w ~/wifi/scan --manufacturer --wps --band abg
```
Now look at the terminal output on the slide. Many networks are visible. The network with MAC F0:9F:C2:6A:88:26 — has `` in the ESSID column. That's airodump-ng's way of telling you this AP is broadcasting a null SSID. That's our target. Note the BSSID and channel — channel 11.
{% hint style="info" %}
If you are listening passively and any client connects, real name of AP will be visible.
{% endhint %}
Before we run mdk4, we need the right wordlist. And this is where a bit of intelligence makes the difference between a fast hit and a very long wait.
Look at what we already know from the scan. All the other networks in range follow the same naming pattern — wifi-IT, wifi-management, wifi-offices. Every single one starts with \`wifi-\`. The hidden AP almost certainly follows the same convention. So instead of throwing a raw wordlist at it, we prepend \`wifi-\` to every entry.
The command does this in one line.
```bash
cat ~/10-million-password-list-top-100000.txt | awk '{print "wifi-" $1}' > ~/wifi-rockyou.txt
```
Once we have the modified dictionary we can use “mdk4” to launch probes with each of the ESSIDs until the AP responds.
{% hint style="info" %}
wifi-free
{% endhint %}
### Connecting to Hidden WIFI
Once we know your ESSID we can connect to the network, for that we create a “free.conf’ file to connect from bash using “wpa\_supplicant”.
```
nano free.conf
```
```
network={
ssid="$ESSID"
key_mgmt=NONE
scan_ssid=1
}
```
```
sudo wpa_supplicant -Dnl80211 -iwlan2 -c free.conf
```
* **`wpa_supplicant`**: A daemon used to manage WPA/WPA2 authentication for Wi-Fi networks.
* **`-Dnl80211`**: Specifies the wireless driver backend.
* `nl80211` is the modern driver used for most Linux wireless devices.
* If `nl80211` doesn't work, you might try `wext` (legacy driver).
* **`-iwlan2`**: Specifies the wireless interface (`wlan2` in this case).
* You should check your actual interface name using `iwconfig` or `ip link show`.
* **`-c free.conf`**: Specifies the configuration file (`free.conf`) containing network credentials and settings.
In another terminal as root:
```
sudo dhclient wlan2 -v
```
* **`sudo`**: Runs the command with superuser privileges.
* **`dhclient`**: A DHCP (Dynamic Host Configuration Protocol) client that requests an IP address from a DHCP server.
* **`wlan2`**: The name of the wireless interface requesting the IP.
* **`-v`**: Enables verbose mode to display detailed output.
Once connected to the network and get IP with “dhclient” we can access the IP at IP 192.168.16.1 where we see a login where we can test default credentials such as admin/admin, accessing the admin panel where you can find the flag.
```
admin/admin
```
{% hint style="info" %}
flag{680efaa62f7e953c24667285173711bc6bb6d3ff}
{% endhint %}
**Alternate Method to connect**
