You should gather the equivalent information for the network you will be working on. Then just change the values in the examples below to the specific network. This is because the madwifi-ng drivers are being used. For other drivers, use the actual interface name. In the response above, you can see that ath0 is in monitor mode, on the 2. So everything is good. It is important to confirm all this information prior to proceeding, otherwise the following steps will not work properly.
Note: If you are using a driver other than madwifi, then the Access Point field will be either invisible or show something other than your card's MAC address. This is normal. This will give you the frequency for each channel. In order for an access point to accept a packet, the source MAC address must already be associated.
In this state, no new IVs are created because the AP is ignoring all the injected packets. Do not proceed to the next step until you have the fake authentication running correctly. Meaning, the AP will not process or accept the injected packets. The objective of the chopchop and fragmentation attacks is to obtain a PRGA pseudo random generation algorithm file.
However, it can be used to create new packets for injection. The creation of new packets will be covered later in the tutorial. Either chopchop or fragmentation attacks can be to obtain the PRGA bit file. The result is the same so use whichever one works for you. The pros and cons of each attack are described on the aircrack-ng page.
You may need to try a few different packets from the AP to be successful. If the fragmentation attack was not successful, you can then try the chopchop technique next. In the previous step, we obtained PRGA.
It does not matter which attack generated the PRGA, both are equal. We can then use this PRGA to generate a packet for injection. We will be generating an arp packet for injection.
The objective is to have the access point rebroadcast the injected arp packet. When it rebroadcasts it, a new IV is obtained. Since you are testing against your own AP you are, right?
These steps are not required, they just prove to yourself that you have generated the correct packet. The system responds by showing how many packets it is injecting and reminds you to start airodump-ng if it has not already been started:.
You will notice that only one access point is being display since we included an airodump-ng filter to limit the capture to a single BSSID. This means injection is working well.
Also notice the data rate of packets per second which is also an indicator that the injection is working well. You can run this while generating packets. In a short time, the WEP key will be calculated and presented. As a reminder, the requirement is that you capture the full packet with airodump-ng. There is a neat trick which simplifies cracking WEP with no clients. Essentially it takes any packet broadcast by the access point and converts it to a broadcast packet such that the access point generates a new IV.
OK, at this point you are asking why didn't you show me this technique right at the start? The reason is that this technique rebroadcasts whatever size packet you receive. So if you receive a byte packet you then rebroadcast bytes. So we run kismet. To launch kismet, we type kismet.
Now, open up a new shell prompt, we are going to start creating ivs with wesside-ng, we type wesside-ng ath1 -v [bssid of network]. Once you have enough IVS you can crack the wep key.
To see if you have enough ivs, load a third shell prompt, type aircrack-ng wep. You are commenting using your WordPress. You are commenting using your Google account. You are commenting using your Twitter account. You are commenting using your Facebook account. Notify me of new comments via email. Notify me of new posts via email. Home About RSS. To determine what the name of your NIC card is, open a shell prompt and type iwconfig in the list, the main card is wifi0, and the ath0 means the card is an atheros card, but , if your list has wlan0, then you will be just fine.
Unless you're a computer security and networking ninja, chances are you don't have all the tools on hand to get this job done. Here's what you'll need:. It's right there on the taskbar in the lower left corner, second button to the right. Now, the commands. The only one I've got there is labeled ra0. Yours may be different; take note of the label and write it down. From here on in, substitute it in everywhere a command includes interface.
Now, run the following four commands. See the output that I got for them in the screenshot below. If you don't get the same results from these commands as pictured here, most likely your network adapter won't work with this particular crack. If you do, you've successfully "faked" a new MAC address on your network interface, To see a list of wireless networks around you.
Highlight the row pertaining to the network of interest, and take note of two things: its BSSID and its channel in the column labeled CH , as pictured below. I had to do this once or twice to find the network I was looking for. Once you've got it, highlight the BSSID and copy it to your clipboard for reuse in the upcoming commands.
Now we're going to watch what's going on with that network you chose and capture that information to a file. Enter anything descriptive for file name. I chose "yoyo," which is the network's name I'm cracking. You'll get output like what's in the window in the background pictured below. Leave that one be.
0コメント