+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Network Hacking (https://sinister.ly/Forum-Network-Hacking)
+--- Thread: So you want free WIFI? WPA/WPA2 *incomplete (/Thread-So-you-want-free-WIFI-WPA-WPA2-incomplete)
So you want free WIFI? WPA/WPA2 *incomplete - Apathetic1 - 02-28-2012
Hello,
This is my first thread as I decided to pass on an introduction, hopefully
you will find instructive and useful.
*TODO:
add pictures
add more methods
explain in more detail
add possible additional options
Prerequisites
Backtrack 4/5R1
Crunch Wordlist Generator
Optional
These are listed as optional as they are not needed, but I will be covering ways to use them.
Grim Wepa - Used in this tut for Handshake Captures
Pyrit & OpenCL/Cuda - Will be adding methods to use pyrit at 1 point or the other.
Capturing the handshake - Stage 1
I, personally, use 2 different methods for this stage depending on time constraints.
Method 1 - Easy;
Open GrimWepa and put your wireless adapter into monitor mode by following the on screen instructions and selecting the appropriate extension (Tip, it's not eth0).
If know all ready know the specific channel, set the slider to that. I'm not sure on your settings but most routers local to me default to channel 6. People who know a bit about wireless signals usually change the channel for less interference, so just go ahead and check the "all channels" box followed by "refresh targets".
Now, Select the SSID of the target then click "start handshake capture". All you have to do now is
sit back and wait. ******Add more detail on what this does******
Method 2 - Mediocre;
This uses modules of the Aircrack-ng kit and requires more time.
First things first, open a terminal - done that? Great.
Now type:
Quote:airmon-ng start Wlan0This tells the computer to put your wireless adapter into passive capture mode, if you've customized your wireless configuration or installed the driver via NDISWrapper or similar go ahead and type "iwconfig" in a terminal, this will tell you your appropriate wireless adapter extension.
Now you want to type the following
Quote:airodump-ng -w capture.cap --output-format pcap --channel 6 --encrypt WPA mon0Airodump-ng captures all network traffic it can pick up, so what does the rest of the statement say?
-w capture.cap; Tells the computer to save the file as capture.cap, what it actually saves at would be "capture-0x.cap" with x incrementing every time you run the command.
--output-format pcap; Well this should not need explaining. Why pcap? Well that's just what I use.
--channel 6; Should be pretty self explanatory it tells the adapter to only look on that specific channel and captures ALL traffic from there. You could remove this option and your adapter will attempt to capture everything, all though please remember that you're constantly skipping channels.
--encrypt WPA; This tells the adapter to target specific SSID that meet the criteria of having WPA/WPA2 encryption. Why is that specified, well for 1 you don't want to be monitoring open zones and for 2 WEP cracking is a totally different method.
mon0; This is the adapter extension. If this is not your default type in "iwconfig" and replace this with, most likely, the bottom option.
Another option I didn't use here is "--bssid", what this does is target 1 specific access point and the argument is in the form of a mac address.
Right, what do you do now? Simple sit back and leave this running, it's passive so it could take a while. A few tips, if you're looking to capture the handshake faster than usual try running these at "peak" times. For example, if you know the rough time your targets wake up, come back from work/school or use their internet in the evening then try running this 15 minutes before.
Note: airodump-ng captures everything, so don't discard of your capture files once you've gained the handshakes
.Cracking the handshake - Stage 2
There are so many methods for this and as such this is going to remain an uncompleted area for a while...
Method 1 - Dictionary attacks;
Okay, open your terminals ladies and gentleman then CD to where your capture files are.
Now you're going to want to type the following:
Quote:aircrack-ng -a 2 -b 00:00:00:00:00:00 -w /pentest/passwords/wordlists/darkc0de.lst Capture-0x.capaircrack-ng used for cracking your capture files.
-a 2; This tells the computer that the attack mode is WPA
-b 00:00:00:00:00:00 this is the mac address of the target, obviously you have to replace it with the actual mac address :headbash:.
-w /pentest/passwords/wordlists/darkC0de.lst; This tells the computer to use the specified wordlist (darkC0de.lst) located in /pentest/passwords/wordlists/. Obviously this is just a basic wordlist, find 1 that suites your needs as there are MANY out there.
Capture-0x.cap is your capture file.
Method 2 - Pipping Crunch into Aircrack;
Crunch is awesome. What more can I say? It's capable of generating huge wordlists, or being used for on the fly brute forcing. So lets get this started.
Open a terminal, CD to your handshake directory and type:
Quote:/pentest/passwords/crunch/crunch 7 14 abcdefghijklmonpqrstuvwxyzABCDEFGHIJKLMONPQRSTUWXYZ0123456789 -u | aircrack-ng -a 2 -b 00:00:00:00:00:00 -l file.txt -w- capture.capSo, what does this do?
I've used /pentest/passwords/crunch/crunch to specify crunch - if you've installed it correctly you can just use "crunch".
7 14; Minimum Length, Maximum Length. 7 is a good number to start on, 7 characters being the default used by many ISPs. 14 was random. You can change these values to your desire but I would suggest using 7 as the minimum.
Right the a-zA-Z0-9 specifies the character set. Please note, this can be changed. You don't have to use all 27 characters. Nor do you have to use both lower & upper case, or even numerical types. The only thing to remember when specifying here is you must start with lowercase, followed by uppercase then numerical and after that special characters.
-u | is used for pipping.
You should be aware of the aircrack options by now, the only difference in this method to that of method 1 is the fact that this also makes use of the -l option, which creates a file with the password in it. Also don't forget to add the extra - after -w. This is for pipping reasons.
This is far from complete. Please bear with me.
RE: So you want free WIFI? WPA/WPA2 *incomplete - chamkacte - 03-23-2012
Well done ! Thanks.
I have a question : do you know if some progress has been done to attack more efficiently WPA keys ? I mean, do you know if some theoretical weaknesses has been found ?
Thanks again !
Chamkacte
RE: So you want free WIFI? WPA/WPA2 *incomplete - kruelmind - 10-25-2012
You can sometimes capture a handshake faster by using the aireplay tool to deauthenticate clients. This way, they have to authenticate again to continue their traffic flow and makes it a little faster.
RE: So you want free WIFI? WPA/WPA2 *incomplete - chmod - 10-30-2012
Very nice you can also use John in a similar way to crunch to brute force however if WPA is enabled it will be quicker to brute force the pin using reaver
RE: So you want free WIFI? WPA/WPA2 *incomplete - hunt3r972 - 11-01-2012
Does it work even if the key is not referenced in the dictionary ?
I tried this way on my wireless network and after 1 hour it didn't find the password which was very simple (no numbers, special char and caps)
RE: So you want free WIFI? WPA/WPA2 *incomplete - chmod - 11-01-2012
This method does not use a dictionary but rather a brute force attack crunch will generate combinations of letters/numbers you specify and feed them into aircrack
RE: So you want free WIFI? WPA/WPA2 *incomplete - hunt3r972 - 11-02-2012
Gonna Try It Now
but a lot of people say that cracking WPA by brute force gonna take over 15 years with luck
RE: So you want free WIFI? WPA/WPA2 *incomplete - chmod - 11-02-2012
It can do which is why I attack the WPS pin takes a while but much quicker then attacking the password
RE: So you want free WIFI? WPA/WPA2 *incomplete - hunt3r972 - 11-02-2012
Right ! I will test WPS bypassing after trying this one. I will have to find someone with WPS
RE: So you want free WIFI? WPA/WPA2 *incomplete - chmod - 11-02-2012
Most wpa2 routers have it enabled by default