WEP Cracking by %ebx
DISCLAIMER: I DO NOT encourage cracking others wireless protection!. This is illegal! The AP I'm cracking belongs to me and I wrote this as a proof of concept. There's a reason they have a key, they don't want you stealing their bandwidth!
That beeing said:
Why would you want to crack WEP protected wireless networks?
1. Because you don't have a internet connection and that bastard neighbor of yours has the money to get one
2. Your dad pulls your ethernet cable out every night at 10 so you don't stay up all night talking to some bimbo
3. Because you can and you want to!
What do you need?
1. A wireless network card(obviouslly) with drivers up and running. Your need your driver to be able to inject packets, otherwise you're gonna spend days gathering enough packets for a successful crack. I had to recompile my kernel module because I use a damn Broadcom card, and injection wouldn't work..not sure why.
2. Linux (Ubuntu Gutsy in this case), though you can do this from Windows and MacOS too, with the appropriate software.
3. The aircrack-ng suite
| $sudo apt-get install aircrack-ng |
Ok..off we go
[NOTE] I color coded the "sensitive" information: AP MAC address, AP Name, miscelaneous MAC addresses and my MAC address. There's a legend on the bottom with the colours and what they correspond to
So..how do we crack WEP? Well basically...whenever a wireless card "talks" to a access point (AP from now on), it sends/receives some interesting info along with the packets, info that can be used to get the actual WEP key(using the aircrack utility).
What we need is to gather enough packets so that aircrack can do it's job
[NOTE] eth0 is our wireless card for the remaining of this tutorial
STEP 1:
We must put the wireless card in monitor mode. A wireless card in monitor mode basically allows us to sniff all the wireless traffic around us
We do this by issuing the following command: [check screenshot 1]
ebx@skynet:-$ sudo airmon-ng start eth0
You should see "monitor mode enabled" in there. That means we're good and can proceed to the next step
Step 2:
In this step we need to get the MAC address of the AP we're after, the AP name and the channel it's on. To do this we first sniff all the traffic so we can see what AP we're gonna focus on(the one with more beacons/data usually, if we want a random crack, or a specific one if you're set on someone "special")
We do this by running: [check screenshot 1]
| ebx@skynet:-$ sudo airodump-ng eth0 |
You should get a screen similar to the one in screenshot 2
I grayed out everything I don't need. The important part is the line with the AP I got my eyes on, the one with red. We just make a note of the MAC address, the AP name and the channel the AP is on.
Step 3:
This is the step where we actually start capturing packets for use in the cracking
We do this by running: [check screenshot 3]
| ebx@skynet:-$ sudo airodump-ng -c 1 --bssid [THE AP MAC ADDRESS] -w capture eth0 |
This starts the actual capture of packets. It captures all traffic on channel 1 (the channel the AP was on), but only the traffic going to our AP, and saves the packets in a file called capture-01.cap (airodump-ng adds the -01.cap)
You should get something similar to screenshot 4. The "#Data" field is what were's interested in getting high enough. We need thousands of packets to have a successful crack.
This is all fine and dandy, and we could just leave this for...hmmm...days 'till it gathers enough packets...Or we could speed the process QUITE A LOT! by using aireplay-ng :)
Step 4:
In this step we speed things up by sending a lot of packets to the AP, so we get responses from it (responses that contain that interesting data we're after ;)
This is done in 2 steps
I'm not going to explain the options I use, just trust me :). Or run aireplay-ng with no options so you can see the available options
A. First we need to associate out wireless card with the AP so it accepts packets from us [check screenshot 5]
| ebx@skynet:-$ sudo aireplay-ng -1 0 -e [AP NAME] -a [AP MAC ADDRESS] -h [MY MAC ADDRESS] eth0 |
If we get "Association successful :-)" then we can proceed to the next step of the packet sending speed up, otherwise something is wrong, eiter you're to far away from the AP, or it has MAC filtering enabled.
If we have a successful association, then we can see our MAC address appears as associated to the AP (check screenshot 5 - the left terminal)
B. Now we need to start sending packets. Again I'm not going to explain the options used, just RTFM! [check screenshot 6]
| ebx@skynet:-$ sudo aireplay-ng -3 -b [AP MAC ADDRESS] -h [MY MAC ADDRESS] -x 100 eth0 |
After a bit of packet reading you should see the sent packets run like crazy, wich also makes our "#Data" field go up like there's no tomorrow!. This is good news. If this step fails, your card/driver probably doesn't have injection capabilities..wich is bad news. But not entirely, just means that you're gonna spend a whole lot more time in cracking because packets come in A LOT slower!
This is it...now we just need to sit and wait for enough packets so we can begin our crack. You can just wait and try running the next step from time to time, or do it like I do, run the next step now as it updates the reading realtime.
Step 5:
In this step we start cracking the WEP using aircrack-ng [check screenshot 7]
| ebx@skynet:-$ sudo aircrack-ng -n 64 -f 4 capture-01.cap |
"-n 64" tells aircrack-ng to crack a 64 bit WEP (I already know the key is 64 bit as I have cracked it before :P). If not sure test with "-n 64" of with no "-n" at all if that fails.
"-f" is the fudge factor. If cracking doesn't work, try raising this to some other value(below 32)
If enough packets were gathered, you WILL have a successfull crack.
With 250.000 packets I (well aircrack-ng) cracked the key in 3 seconds! [check screenshot 8]
We get the key in HEX and ASCII. We will be using the ASCII one.
This is it. We have the key, now all there's left is to use it!
Now we can just stop capturing (CTRL+C in the other 2 terminals, then close them).
After packet capturing is over, we need to take our card OUT of monitor mode
| ebx@skynet:-$ sudo airmon-ng stop eth0 |
Step 6:
This is optional. You could use any GUI manager to set things up, but I prefer doing it manually
ebx@skynet:-$ sudo iwconfig eth0 essid [AP NAME]
ebx@skynet:-$ sudo iwconfig eth0 ap [AP MAC ADDRESS]
ebx@skynet:-$ sudo iwconfig eth0 key on
ebx@skynet:-$ sudo iwconfig eth0 key s:[THE ASCII KEY]
ebx@skynet:-$ sudo dhclient eth0 |
If you are having troubles!
Before you go and search for HOURS on end if step 4 isn't working for you.
IF YOU HAVE INTEL 3945ABG, OR THE 4xxxAGN(I forgot the entire number, but it has N in it) YOUR WIRELESS THINGY, IT DOES NOT SUPPORT PACKET INJECTING(...yet).
So, in other words, it WILL NOT work for you, and if you find a way post it here, i am currently looking for more ways too.
Read More......
Read More......
