Results 1 to 4 of 4

Thread: Mystery about sniffing WPA data

  1. #1
    Just burned his ISO
    Join Date
    Feb 2010
    Posts
    13

    Default Mystery about sniffing WPA data

    Hi,

    I tried to sniff all Traffic on a WPA Secured AP with airodump-ng. I use a Atheros Card with madwifi-ng and Patch. If I’m right I must sniff a Handshake for decrypting the packages with airdecap-ng . I tried a deauth an a special Client in the Network but no Handshake is shown in airodump. When I deauth all the Clients on the Net I get the BSSID of the AP as valid Handshake.
    Now I tried to decrypt the dump with airdecap but I got only a few decrypted packages.
    On a second try I authenticated a client after starting airodump and I get the handshake.
    Anybody with the same Problems, or a hint to sniff special Client data or all traffic on a WPA Secured AP. There are a lot of Hints in the iNet to sniff WEP Traffic but I hope opening a Thread to clear all the Mystery about sniffing WPA data.

    Greetings
    phobos

  2. #2
    Moderator theprez98's Avatar
    Join Date
    Jan 2010
    Location
    Maryland
    Posts
    2,533

    Default

    Quote Originally Posted by pho_bos View Post
    Hi,

    I tried to sniff all Traffic on a WPA Secured AP with airodump-ng. I use a Atheros Card with madwifi-ng and Patch. If I’m right I must sniff a Handshake for decrypting the packages with airdecap-ng . I tried a deauth an a special Client in the Network but no Handshake is shown in airodump. When I deauth all the Clients on the Net I get the BSSID of the AP as valid Handshake.
    Now I tried to decrypt the dump with airdecap but I got only a few decrypted packages.
    On a second try I authenticated a client after starting airodump and I get the handshake.
    Anybody with the same Problems, or a hint to sniff special Client data or all traffic on a WPA Secured AP. There are a lot of Hints in the iNet to sniff WEP Traffic but I hope opening a Thread to clear all the Mystery about sniffing WPA data.

    Greetings
    phobos
    Please post the airdecap command lines you're using.
    "\x74\x68\x65\x70\x72\x65\x7a\x39\x38";

  3. #3
    Just burned his ISO
    Join Date
    Feb 2010
    Posts
    13

    Default

    I used this to capture traffic:

    airodump-ng -w /tmp/dump-01.cap -c 8 --bssid 00:xx:xx:xx:xx:xx ath1

    and airoscript to deauth one client or all clients from the ap

    then I used this for decrypting:

    airdecap-ng -e "Testing" -p remote-exploit /tmp/dump-01.cap

  4. #4
    Just burned his ISO
    Join Date
    Feb 2010
    Posts
    13

    Default

    No suggestions!? Has nobody tried to sniff traffic from a WPA prodected AP!?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •