-=Xploitz=- VIDEO: Volume #3 "E-Z WPA/WPA2 Cracking Tutorial"

[imported_cybrsnpr]

thanks for the great tutorial....i now understand how this works my only issue is the handshake...im deauthing
Sending 64 directed DeAuth. STMAC: [00:1F:29:F8:3F:3A] [14|20 ACKs]

but am having no luck with the 4 way , i deauth it like 20 times, sometimes i get more acks sometimes less.....any ideas?

What kind of client are you deauthing? Sometimes linux will not auto-reconnect to a WPA network.

Sending 64 directed DeAuth

! 64 times is probably overkill. Remember, the purpose of sending a deauth packet is to force the client to reconnect. Your victim may be dieing from so many deauths. Cut it down to 3 or 4 deauth packets.

You don't mention how long you wait for the client to re-auth? It can take a few minutes depending on the victims wireless management software. Do you see your victim box loose it's connection and do you see the victim reconnect?

Make sure you are sniffing only on the channel your victim and AP are using.

Have you looked through your capture using wireshark to see if you have captured the 4 way handshake? Filter for "eapol" (no quotes) to check.

Without knowing exactly what you did command (and response) wise, that's about all I can think to check.

Good Luck...

[CableTech]

thanks for the reply cyber. i was being kind of impatient, i was waiting only 30 seconds or so for the victim to come back up, it is in fact disconnecting then reconnecting though...im new to the wireshark thing (im actually reading a pdf on it now) hopefully i can figure it out .
as far as command i used
aireplay-ng -0 3 -a (bssid) -c (client) wlan1

im looking through the caps with the eapol filter now to see if maybe airodump just didnt print it...

thanks again for your help

[imported_=Tron=]

I am having the same issue like mohsen1...the last command with results of "sending 64 directed DeAuth...." is this wrong? or is it my crappy card that I cannot get a handshake? I cannot even get my card to inject (highly believe it's my driver issue)...thinking on getting a real card now if it's really the problem.

Just for reference, the "sending 64 directed DeAuth." message that you are seeing does not mean that 64 deauthentication attacks are being performed and is a perfectly normal output for directed deauthication. Aireplay-ng will send out 128 packets for each directed deauthentication, 64 packets to the AP and 64 packets to the client, this is what the message states.

bt ~ # aireplay-ng -0 1 -a 00:11:50:1C: D3:1D -c e8:8d:75:de:80:5c ath0

20:01:34  Waiting for beacon frame (BSSID: 00:11:50:1C:D3:1D) on channel 11
20:01:34  Sending 64 directed DeAuth. STMAC: [E8:8D:75:DE:80:5C] [ 0| 1 ACKs]

I have highlighted the important part of the message. What these numbers mean is that, out of the 64 packets sent to each destination, 0 ACKs was returned by the client and 1 ACK from the AP. In other words the client is not able to hear your packets at all while the AP barely received one packet. Low values like this will tell you that you need to get closer to the target in question.

[CableTech]

so what would be a good number of acks [0|0] ? i usually get 11 or better on each, is that good enough or is that still to low? i have my "man cave" setup in my detached garage [keeps kids and wife away while i play ]and my router is about 100 ft from me..i can surf fine from here but cannot get a 4 way handshake

[imported_=Tron=]

so what would be a good number of acks [0|0] ? i usually get 11 or better on each, is that good enough or is that still to low? i have my "man cave" setup in my detached garage [keeps kids and wife away while i play ]and my router is about 100 ft from me..i can surf fine from here but cannot get a 4 way handshake

It is hard to say an exact number that could be considered good, but the higher the better is the rule of thumb.

In your case you are sending out 64 packets and only receiving 11 responses which means that 53 of the sent packets are dropped, that is roughly 83 %. As capturing the handshake requires that you intercept 4 consecutive packets, 2 sent from the AP and 2 from the client, such a high packet drop will prove to be problematic.

[CableTech]

thanks for the info tron (still havent caught the handshake, from my garage) i can when i bring the laptop inside now

[llvllonk]

Thanks for the information Tron....I had over 100s acks for both client and AP...but still no success...now that I got the new card, I concluded it's an issue with my old card, because I got 4 way handshake instantly with the Alfa card. I finally got to experience what the injection test will show me..lol...I read through pages that negear MA401 works...now I need to research more to figure it out (tried flashing the card itself too)

[swpark]

your welcome & well done, it's nice 2 see that the hardwork by Xploitz video has paid off & the knowledge he's passed onto me, which i have now passed onto you actually DOES work

so now you know that WPA is not safe, so please please protect your network & keep secure & use alphanumeric passwords with special characters

Hi, I also have same problem, I can't get any WPA 4 handshakes. so Could you tell me how you solved it? I'm using ALFA AWUS036H as same as yours in VMware. Thank you.

[Sicnarf]

Excellent tut just the like the two previous ones on wep I have used, thanks for the info.
Am also downloading your wordlist torrent but that is going to take some time as I am traveling at the moment and don't have regular access at my current location.

I do have a question about doing a dictionary crack, I can currently get about 80 Kp/s which is ok i suppose for my little eeepc 1.6 ghz, 1 gig ram. But the thing that bugs me is the display which shows multiple key attempts per second which is a waste of processor time in my opinion. I did a little programming a long time ago and when making a prime number generator the teacher showed me I could signafincatly speed up the process if I only displayed 1 in 10 of the numbers generated, he claimed the output to screen used a chunk of resources that were best left working on the prime numbers.
So my question is how do I get the screen output to only refresh once a minute, I don't want to turn it off all together as I like to know what letter I'm at plus I would like to know if it makes a noticable diffrence to Kp/s.

[imported_=Tron=]

Excellent tut just the like the two previous ones on wep I have used, thanks for the info.
Am also downloading your wordlist torrent but that is going to take some time as I am traveling at the moment and don't have regular access at my current location.

I do have a question about doing a dictionary crack, I can currently get about 80 Kp/s which is ok i suppose for my little eeepc 1.6 ghz, 1 gig ram. But the thing that bugs me is the display which shows multiple key attempts per second which is a waste of processor time in my opinion. I did a little programming a long time ago and when making a prime number generator the teacher showed me I could signafincatly speed up the process if I only displayed 1 in 10 of the numbers generated, he claimed the output to screen used a chunk of resources that were best left working on the prime numbers.
So my question is how do I get the screen output to only refresh once a minute, I don't want to turn it off all together as I like to know what letter I'm at plus I would like to know if it makes a noticable diffrence to Kp/s.

I do not know how you would achieve this, but since the function is coded into the program already you will probably not achieve any improvement even if you can get the screen to refresh more seldom. The reason is that the program still will run the necessary code to display the attempts even though you might be able to prevent it from showing up, this is unless you actually manipulate the source code directly.

However, even though you do see multiple words per second I have a hard time believing that aircrack-ng will show each and every attempt. Most likely what you are seeing is already about 1/10 words so I think any improvement by further lowering this number would be diminishable.