aireplay help

Hello all,
First of all i'm new to backtrack, i've been using for like 1 week, so far i managed to dual boot installed XP and BT4 on my old sony laptop so that's an advance.

I've been playing around with both my linksys (flashed with dd-wrt) and my 2wire trying to break the wep keys, i've been doing it on both routers with no problems until i decided to hide the BSSID on the 2wire one, first 2 steps went well (airodump) but once i use aireplay i get this message:

Code:

No source MAC (-h) specified. Using the device MAC (00:1D:7E:9B:C6:42) 15:11:07 Waiting for beacon frame (BSSID: 00:24:56:A7:7F:C9) on channel 11 Please specify an ESSID (-e)

This is what i'm typing:

Code:

- aireplay-ng -1 0 -a (BSSID) wlan0...

I can see the BSSID when i use airodump but it only says "lenght 0" and i know that's mine cuz of the mac address but i've been searching on how to make it work if it's hidden with no luck.
BTW i'm using a linksys wireless USB adapter to do this with no issues (until now) i'm using the same USB adapter and BT4 to send this message everything works :)

anyone care to help?
thx all in advance, cheers

Re: aireplay help

Even though the ESSID is hidden you should specify the -e <ESSID Name> in your command:
aireplay-ng -1 0 -a (BSSID) -e (ESSID) wlan0...

read:
aireplay-ng [Aircrack-ng]

Quote:

Hidden SSIDs "<length: ?>"

Many aireplay-ng commands require knowing the SSID. You will sometimes see ”<length: ?>” as the SSID on the airodump-ng display. This means the SSID is hidden. The ”?” is normally the length of the SSID. For example, if the SSID was “test123” then it would show up as ”<length: 7>” where 7 is the number of characters. When the length is 0 or 1, it means the AP does not reveal the actual length and the real length could be any value.

To obtain the hidden SSID there are a few options:

Wait for a wireless client to associate with the AP. When this happens, airodump-ng will capture and display the SSID.
Deauthenticate an existing wireless client to force it to associate again. The point above will apply.
Use a tool like mdk3 to bruteforce the SSID

Re: aireplay help

hey thx for the quick reply

this is what i got:

Code:

CH 11 ][ Elapsed: 9 mins ][ 2010-12-03 16:42 ][ fixed channel wlan0: 14 BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:24:56:A7:7F:C9 -13 100 5210 25 0 11 54 . WEP WEP OPN kenneth's wifi BSSID STATION PWR Rate Lost Packets Probes

i connected to the wifi and the ESSID showed up
this is what i get when i typed it as you said

Code:

root@bt:~# aireplay-ng -1 0 -a 00:24:56:A7:7F:C9 -e kenneth's wifi wlan0 > <---just that nothing else happens

am i missing something? thx again for the help

Re: aireplay help

You should try using the "CODE" brackets, it's easier for someone to read the output like that.

Re: aireplay help

Quote:

Originally Posted by Gallo75

hey thx for the quick reply

this is what i got:

Code:

CH 11 ][ Elapsed: 9 mins ][ 2010-12-03 16:42 ][ fixed channel wlan0: 14 BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:24:56:A7:7F:C9 -13 100 5210 25 0 11 54 . WEP WEP OPN kenneth's wifi BSSID STATION PWR Rate Lost Packets Probes

i connected to the wifi and the ESSID showed up
this is what i get when i typed it as you said

Code:

root@bt:~# aireplay-ng -1 0 -a 00:24:56:A7:7F:C9 -e kenneth's wifi wlan0 > <---just that nothing else happens

am i missing something? thx again for the help

Maybe you can try the following:

Quote:

aireplay-ng -1 0 -a 00:24:56:A7:7F:C9 -e "kenneth's wifi" wlan0

With aireplay there can't be a "space" in the essid, otherwise it won't work. Don't know if this is your solution, but you can try.