Aircrack/WPA Cracking - Revision history

Unknown user: /* Finish the Attack */

2025-06-22T15:10:02Z

Finish the Attack

← Older revision		Revision as of 15:10, 22 June 2025
Line 127:		Line 127:
	Now we've got what we need in our network capture file. Let's try and crack this password.		Now we've got what we need in our network capture file. Let's try and crack this password.

	You can use whatever you want for your wordlist, if you're attacking a network with a known passkey, just make sure it's in there. ~~I downloaded~~ a list of ~~the 10,000~~ most common passwords (~~"password" is number one on the list~~) ~~from~~ SecLists ~~on GitHub~~.		You can use whatever you want for your wordlist, if you're attacking a network with a known passkey, just make sure it's in there. Here is one of my favorite password list repositories: https://github.com/danielmiessler/SecLists/tree/master/Passwords

			Here is a list of common wifi passwords: https://github.com/danielmiessler/SecLists/blob/master/Passwords/WiFi-WPA/probable-v2-wpa-top447.txt

			Here is a list of 10k most common passwords (can be filtered for passwords shorter than 8 characters): https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt

	Now run Aircrack against the captured data to crack the WPA key, specifying the wordlist:		Now run Aircrack against the captured data to crack the WPA key, specifying the wordlist:

2025-06-22T15:05:29Z

The Hardware

← Older revision		Revision as of 15:05, 22 June 2025
Line 19:		Line 19:
	=The Hardware=		=The Hardware=

	~~The hardware for simulating~~ this attack ~~on my home network consisted of~~:		You need three things to simulate this attack:
	* a router/wireless access point - this router controls the wireless network being attacked
	* ~~a laptop~~ running Kali Linux ~~- this is where the attack is being launched from~~		* a router or wireless access point - this router performs authentication and controls access to the wireless network being attacked
	* ~~a third party on the network~~ (~~e.g.~~, a phone or a desktop~~) - not sure if this is necessary~~		* attacker machine running Kali Linux
			* victim (sheep) machine, a phone or a desktop, anything that connects to the wifi network

	=The Software=		=The Software=

2025-06-22T15:03:55Z

Find the Sheep

← Older revision		Revision as of 15:03, 22 June 2025
Line 96:		Line 96:
	The weakness we're taking advantage of in WPA is the handshake process: when a client (an unsuspecting sheep) authenticates with the network and sends the encrypted password so the network can verify the client. If an attacker captures packets during this handshake process, they have the encrypted password and can try and crack the sheep's passphrase by brute force.		The weakness we're taking advantage of in WPA is the handshake process: when a client (an unsuspecting sheep) authenticates with the network and sends the encrypted password so the network can verify the client. If an attacker captures packets during this handshake process, they have the encrypted password and can try and crack the sheep's passphrase by brute force.

	That means we need to find a sheep that will broadcast their passphrase to the router and anyone else who will listen. So once you're ready, and listening to the network, connect your sheep to the network. ~~(This might be a computer playing internet radio, for example.)~~		That means we need to find a sheep that will broadcast their passphrase to the router and anyone else who will listen. So once you're ready, and listening to the network, connect your sheep to the network.

	===Window 2: Deauthenticate Sheep===		===Window 2: Deauthenticate Sheep===

2015-08-19T05:15:10Z

2015-08-18T16:04:34Z

← Older revision		Revision as of 16:04, 18 August 2015
Line 1:		Line 1:
	Now that we've successfully walked through using [[Aircrack]] to crack WEP on our home router on the [[Aircrack/WEP Cracking]] page, let's try attacking the router in WPA encrypted mode.		Now that we've successfully walked through using [[Aircrack]] to crack WEP on our home router on the [[Aircrack/WEP Cracking]] page, let's try attacking the router in WPA encrypted mode.

			Notes on wireless in Kali 2.0: [[Kali_2.0/Wireless_Debugging]]

	=The Background=		=The Background=

2015-08-16T05:22:41Z

Finish the Attack

← Older revision		Revision as of 05:22, 16 August 2015
Line 119:		Line 119:

	==Finish the Attack==		==Finish the Attack==

			[[Aircrack/Cracking]]

	Now we've got what we need in our network capture file. Let's try and crack this password.		Now we've got what we need in our network capture file. Let's try and crack this password.

2015-08-16T05:16:03Z

Window 2: Deauthenticate Sheep

← Older revision		Revision as of 05:16, 16 August 2015
Line 103:		Line 103:

	<pre>		<pre>
	$ ~~ifconfig~~		$ aireplay-ng -0 1 -a <access point mac address> -c <sheep mac address> wlan2mon
	$ aireplay-ng --deauth 1 -a <access ~~point~~ mac ~~address~~> -c <sheep mac ~~address~~> wlan2mon		</pre>

			or,

			<pre>
			$ aireplay-ng --deauth 1 -a <access pt mac addr> -c <sheep mac addr> wlan2mon
	</pre>		</pre>

2015-08-16T05:09:24Z

Window 1: Monitor Traffic on the Network

← Older revision		Revision as of 05:09, 16 August 2015
Line 79:		Line 79:

	<pre>		<pre>
	$ airodump-ng --bssid AA:BB:CC:DD:EE -c XX -w aircrack_output wlan2mon		$ airodump-ng -d AA:BB:CC:DD:EE -c XX -w aircrack_output wlan2mon
			</pre>

			or,

			<pre>
			$ airodump-ng --bssid AA:BB:CC:DD:EE --channel XX -w aircrack_output wlan2mon
	</pre>		</pre>

2015-08-13T19:01:06Z

Window 2: Deauthenticate Sheep

← Older revision		Revision as of 19:01, 13 August 2015
Line 98:		Line 98:
	<pre>		<pre>
	$ ifconfig		$ ifconfig
	$ aireplay-ng --deauth 1 -a <~~target~~ mac address> -c <~~third party~~ mac address> wlan2mon		$ aireplay-ng --deauth 1 -a <access point mac address> -c <sheep mac address> wlan2mon
	</pre>		</pre>

	This will generate fake deauthentication packets and send them to the ~~shee~~. The sheep will think it has been deauthenticated and kicked off the network. Lonely and desperate and bleating madly, the sheep will begin to broadcast its packets to anyone who will listen - including its encoded passphrase.		This will generate fake deauthentication packets and send them to the sheep. The sheep will think it has been deauthenticated and kicked off the network. Lonely and desperate and bleating madly, the sheep will begin to broadcast its packets to anyone who will listen - including its encoded passphrase.

	If we're listening, we can hear it, and use Aircrack to crack it.		If we're listening, we can hear it, and use Aircrack to crack it.

2015-08-13T18:59:59Z

Window 1: Monitor Traffic on the Network

← Older revision		Revision as of 18:59, 13 August 2015
Line 82:		Line 82:
	</pre>		</pre>

			Make sure you've killed your prior-running airodump command, which was hopping channels, or this command will not work.

	===Find the Sheep===		===Find the Sheep===