Wesside-ng

[theprez98]

I know we have already talked a little bit about this tool (only available in the development version), but wow...

bt ~ # wesside-ng -i ath1 -a XX:XX:XX:XX:XX:XX -v XX:XX:XX:XX:XX:XX
...
KEY=(XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX)
Owned in 2.68 minutes

One command line: interface, own map, ap mac, and go. 128 bit wep done in 2.68 minutes from hitting the enter key.

Interestingly enough, the .cap file had 40,000 packets and aircrack-ptw was unable to find the key using this file, even though wesside-ng does in fact use the ptw attack.

[level]

Doesn't seem to be working with my ralink card. Gets hung-up on the authenticating process. I'm using Aircrack-ng 1.0.dev.svn.493, is that what you have?

[theprez98]

Doesn't seem to be working with my ralink card. Gets hung-up on the authenticating process. I'm using Aircrack-ng 1.0.dev.svn.493, is that what you have?

I have 512, which was the latest at least as of yesterday.

[shamanvirtuel]

it works well with my rt73
owned in 6 minutes

really great but they said your card MUST support fragmentation attack because it use it for getting prga if i understand well

BUT my rt73 doesn't suport -5 attack....im sure of that....and wesside had worked with this card.....

so maybe retry

ps im with 521 wich is the latest.....

[level]

I tried with my other ralink, WUSB54GC (rt73), and it still doesn't work, going to try the latest version.

shamanvirtuel,

Try the latest driver from ASPj's, it supports fragmentation with rt73.

[PrairieFire]

My atheros card gets stuck like this with

wesside-ng -i ath0

15:00:00 Got 8 bytes of prga IV=....
15:02:00 Got ARP request from (some mac I do not know, I do not live near anyone)
15:02:12 Guessing PRGA ec (IP byte=220)
and keeps counting up the minutes and never gets past that.
If I ping a non existent ip on my lan it gets further but finds a wrong IP and sends arp requests to the same wrong IP

* I am able to inject and can do fragmentation attack with this card and my AP.

[theprez98]

My atheros card gets stuck like this with

wesside-ng -i ath0

15:00:00 Got 8 bytes of prga IV=....
15:02:00 Got ARP request from (some mac I do not know, I do not live near anyone)
15:02:12 Guessing PRGA ec (IP byte=220)
and keeps counting up the minutes and never gets past that.
If I ping a non existent ip on my lan it gets further but finds a wrong IP and sends arp requests to the same wrong IP

* I am able to inject and can do fragmentation attack with this card and my AP.

I had the same result with my internal Broadcom card (which I confirmed as injection-capable).

[PrairieFire]

Some progress with Atheros in r536

Authenticated
Associated
Datalen 46 Known clear 8
Got 8 bytes of prga IV=.....
# Then the confusion begins "ERROR max retransmits..."

no difference with Prism2
ipw3945 gets hung at: Got 8 bytes of prga IV=....
Used Aireplay-ng -3 and it will continue, guess wrong IP and end with "Segmentation fault"

[shamanvirtuel]

after the confusing error thing begin
i let it for work and it finds me the key within 10 min to 1hour depending on the traffic there is on the network.....

for test you can locked wesside on network bssid and artificially create traffic with streaming some milworm vids in loop....

go in /root you will see your wep.cap grows.......

launch an aircrack-ng session when some megs are captured you will see number of IVS....

[PrairieFire]

Confirmed, working with Atheros, Prism2, IPW3945

I was using to monitor size

airodump-ng rtap0

Do you notice it is super fast at each step but might be why it has problems with some?