Cant get PRGA for WEP crack...


"airmon-ng start wlan0"
"airodump-ng mon0"

ESSID: Linksys01
BSSID: xx:xx:xx:xx:xx:xx
Channel: 6

"iwconfig wlan0 channel 6"
"iwconfig mon0 channel 6"

"airodump-ng mon0 -c 6 --bssid xx:xx:xx:xx:xx:xx"

...sniffing starts

"aireplay-ng -1 0 -e Linksys01 -a xx:xx:xx:xx:xx:xx -h mm:mm:mm:mm:mm:mm"

"Sending Authentication Request
Authentication successful
Sending Association Request
Association successful :-)"

[Can see my MAC show up under stations on airodump-ng sniff]
[AUTH changes to OPN]

---------------------------------

At this point I'm confused/stuck... i perform "ls" in /root. but no .xor file.

I tried arpreply attack...

"aireplay-ng -3 -b xx:xx:xx:xx:xx:xx mon0"

It will continue to read packets and go no where.

I tried a Chop Chop...

"aireplay-ng -4 -b xx:xx:xx:xx:xx:xx -h mm:mm:mm:mm:mm:mm mon0"

It will continue to read packets and go no where.

I tried fragmentation...

"aireplay-ng -5 -b xx:xx:xx:xx:xx:xx -h mm:mm:mm:mm:mm:mm mon0"

It will continue to read packets and go no where.

Tested packet injection (works). Tried keeping my mac the same and changing it. I even tried restarting and rebooting my VMware. Same thing. I find it odd that AUTH never changes to SKA.


Any Ideas?


===============================================
ROUTER: Linksys WRtT54G w/DD-WRT v24 sp2
VMware player 5.0.0 build-812388 (4gig ram, 2 processors, 30 gig hard drive, Bridged network adapter)
Back Track 5r3
Alpha AWUS036H
IBM x230