WEP Cracking - Revision history

Ivc: /* References */

2009-09-05T21:46:24Z

References

← Older revision		Revision as of 21:46, 5 September 2009
Line 171:		Line 171:
	* [http://www.cs.montana.edu/~rudy/Wireless%20Security.pdf Wireless Security Gabe Rudy]		* [http://www.cs.montana.edu/~rudy/Wireless%20Security.pdf Wireless Security Gabe Rudy]
	* [http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks Cracking WEP and WPA Wireless Networks]		* [http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks Cracking WEP and WPA Wireless Networks]
			* [http://www.cyber-knowledge.net/blog/2007/01/08/cracking-wep/ Hacking WEP With Fake Authentication + Video]

Ivc: /* Packet re-injection */

2009-09-05T21:44:01Z

Packet re-injection

← Older revision		Revision as of 21:44, 5 September 2009
Line 119:		Line 119:
	[[Image:WEP_Cracking_fakeauth.png\|500px]]		[[Image:WEP_Cracking_fakeauth.png\|500px]]

	=== ~~Packet~~ re-injection ===		==== ARP re-injection ====
	For this step, open a new terminal window. This is the part where traffic is generated (stimulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV. The rate of injection is in the range of 250-500 packets per second, depending on the signal/distance to the AP.		For this step, open a new terminal window. This is the part where traffic is generated (stimulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV. The rate of injection is in the range of 250-500 packets per second, depending on the signal/distance to the AP.

Line 139:		Line 139:

	[[Image:WEP_Cracking_capture_packetbuildup.png.png\|500px]]		[[Image:WEP_Cracking_capture_packetbuildup.png.png\|500px]]

			==== Fragmentation attack ====
			If the ARP re-injection attack didn't work, try this.

			LATER

	=== Crack key ===		=== Crack key ===

Ivc: /* Packet re-injection */

2009-09-05T21:30:51Z

Packet re-injection

← Older revision		Revision as of 21:30, 5 September 2009
Line 120:		Line 120:

	=== Packet re-injection ===		=== Packet re-injection ===
	For this step, open a new terminal window. This is the part where traffic is generated (~~simulated~~) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV. The rate of injection is in the range of 250-500 packets per second, depending on the signal/distance to the AP.		For this step, open a new terminal window. This is the part where traffic is generated (stimulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV. The rate of injection is in the range of 250-500 packets per second, depending on the signal/distance to the AP.

	It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.		It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.

Ivc: /* Crack key */

2009-09-05T21:27:28Z

Crack key

← Older revision		Revision as of 21:27, 5 September 2009
Line 141:		Line 141:

	=== Crack key ===		=== Crack key ===
	It's interesting how the key is cracked. The frame is first reversed XOR'ed to reveal a small part of the RC4 stream cipher, a table is build of IVs and stream ciphers, statistical and algorithmic methods (PTW methodology, -z parameter) are used to predict the missing RC4 bytes to further decipher the key using the public IVs. The PTW method only works on captured ARP request packets, use another aircrack-ng mode for other ~~types~~ of ~~attacks~~.		It's interesting how the key is cracked. The frame is first reversed XOR'ed to reveal a small part of the RC4 stream cipher, a table is build of IVs and stream ciphers, statistical and algorithmic methods (PTW methodology, -z parameter) are used to predict the missing RC4 bytes to further decipher the key using the public IVs. The PTW method only works on captured ARP request packets, use another aircrack-ng mode for other kind of traffic.

	aircrack-ng -z -b 00:24:01:34:0E:23 dlink-01.cap		aircrack-ng -z -b 00:24:01:34:0E:23 dlink-01.cap

Ivc: /* Crack key */

2009-09-05T21:26:14Z

Crack key

← Older revision		Revision as of 21:26, 5 September 2009
Line 141:		Line 141:

	=== Crack key ===		=== Crack key ===
	It's interesting how the key is cracked. The frame is first reversed XOR'ed to reveal a small part of the RC4 stream cipher, a table is build of IVs and stream ciphers, statistical and algorithmic methods (PTW~~'s way~~, -z ~~paramter~~) are used to predict the missing RC4 bytes to further decipher the key using the public IVs.		It's interesting how the key is cracked. The frame is first reversed XOR'ed to reveal a small part of the RC4 stream cipher, a table is build of IVs and stream ciphers, statistical and algorithmic methods (PTW methodology, -z parameter) are used to predict the missing RC4 bytes to further decipher the key using the public IVs. The PTW method only works on captured ARP request packets, use another aircrack-ng mode for other types of attacks.

	aircrack-ng -z -b 00:24:01:34:0E:23 dlink-01.cap		aircrack-ng -z -b 00:24:01:34:0E:23 dlink-01.cap

Ivc: /* Packet re-injection */

2009-09-05T21:06:42Z

Packet re-injection

← Older revision		Revision as of 21:06, 5 September 2009
Line 120:		Line 120:

	=== Packet re-injection ===		=== Packet re-injection ===
	For this step, open a new terminal window. This is the part where traffic is generated (simulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV.		For this step, open a new terminal window. This is the part where traffic is generated (simulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV. The rate of injection is in the range of 250-500 packets per second, depending on the signal/distance to the AP.

	It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.		It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.

Ivc: /* Packet re-injection */

2009-09-05T21:05:41Z

Packet re-injection

← Older revision		Revision as of 21:05, 5 September 2009
Line 120:		Line 120:

	=== Packet re-injection ===		=== Packet re-injection ===
	For this step, open a new terminal window. This is the part where traffic is generated (simulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP, it will be captured by aireplay-ng and re-injected into the network~~, generating~~ a ~~flood of ARP packets and thus~~ different ~~IVs~~.		For this step, open a new terminal window. This is the part where traffic is generated (simulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP it will be captured by aireplay-ng and re-injected into the network. The AP will normally rebroadcast them and then with a different IV.

	It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.		It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.

Ivc at 21:03, 5 September 2009

2009-09-05T21:03:42Z

@@ Line 103: / Line 103: @@
 [[Image:WEP_Cracking_start_capturing.png|500px]]
 === Packet re-injection ===
 For this step, open a new terminal window. This is the part where traffic is generated (simulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP, it will be captured by aireplay-ng and re-injected into the network, generating a flood of ARP packets and thus different IVs.
-It can take little while before a ARP packet is created even if the situation is ideal. Try to the --interactive mode and look for broadcast packets from a Client to the AP.
+It can take little while before an ARP packet is created on the network. Alternatively try the ''--interactive'' mode if there are client(s) connected and look for any broadcast packets (FF:FF:FF..) or packets originating from one of the Clients, and where the destination is the AP. Try a few packets until the data packet count starts to increase rapidly.
   aireplay-ng --arpreplay -b 00:24:01:34:0E:23 -h 00:11:22:33:44:55 [interface]
@@ Line 124: / Line 139: @@
 [[Image:WEP_Cracking_capture_packetbuildup.png.png|500px]]
 === Crack key ===

Ivc at 20:49, 5 September 2009

2009-09-05T20:49:55Z

← Older revision		Revision as of 20:49, 5 September 2009
Line 105:		Line 105:

	=== Packet re-injection ===		=== Packet re-injection ===
	For this step, open a new terminal window. This is the part where traffic is generated (~~stimulated~~) by injecting ARP packets back into the network. In the ~~next section when a fake authentication is performed~~, ~~sometimes (not always)~~ the ~~AP will create/broadcast~~ a ~~new~~ ARP ~~request,~~ thus ~~a new packet with a~~ different IV. It can take little while before a ARP packet is created even if the situation is ideal ~~(give it at least~~ a ~~minute)~~.		For this step, open a new terminal window. This is the part where traffic is generated (simulated) by injecting ARP packets back into the network. Once an ARP packet created by the AP, it will be captured by aireplay-ng and re-injected into the network, generating a flood of ARP packets and thus different IVs.

			It can take little while before a ARP packet is created even if the situation is ideal. Try to the --interactive mode and look for broadcast packets from a Client to the AP.

	aireplay-ng --arpreplay -b 00:24:01:34:0E:23 -h 00:11:22:33:44:55 [interface]		aireplay-ng --arpreplay -b 00:24:01:34:0E:23 -h 00:11:22:33:44:55 [interface]

Ivc: /* Fake authenticate */

2009-09-05T20:41:25Z

Fake authenticate

← Older revision		Revision as of 20:41, 5 September 2009
Line 124:		Line 124:

	=== Fake authenticate ===		=== Fake authenticate ===
	Now, open another new terminal to perform a fake authentication. ~~If there are any clients connected~~ to the ~~Access Point~~, ~~it will create an ARP request~~. This ~~ARP packet is then captured by~~ aireplay-ng ~~(-3)~~. ~~It's important to note that the ARP request~~ will only ~~be created if there already~~ is ~~one or more clients connected to~~ the AP~~. If there aren't any, wait until a client connects~~.		Now, open another new terminal to perform a fake authentication. For injection to work the MAC address of the source has to be associated with the AP, else the packets are discarded by the AP.

			This command will associate the MAC address of the adapter with the AP and allow further aireplay-ng attacks. Fake authentication will only work when MAC filtering is not enforced by the AP.

	aireplay-ng --fakeauth 0 -a 00:24:01:34:0E:23 -e dlink -h 00:11:22:33:44:55 [interface]		aireplay-ng --fakeauth 0 -a 00:24:01:34:0E:23 -e dlink -h 00:11:22:33:44:55 [interface]