aircrack not finding passphrases

[jesse33]

I have 2 access points and I used to be able to crack them with bt2.
But in bt3 aircrack reports that the passphrase is not in the dictionary,
for neither of the AP's, while they really are in there.

I've tried downgrading to aircrack beta r830 but it doesn't help.

I'm running bt3 in vmware fusion (mac) installed on the HD.
I use an alfa 500mw adapter.


btw.

when I try cowpatty, it reports that the handshake is incomplete, I've captured it multiple times, doesn't work.

[level]

Open your capture file in wireshark and see if you captured the correct keys, as shown in the wpa.cap sample file found in aircrack directory.

[shamanvirtuel]

so the pb comes from your handshake........

try to deauth & capture on 2 diff cards or use airserver....

[jesse33]

Open your capture file in wireshark and see if you captured the correct keys, as shown in the wpa.cap sample file found in aircrack directory.

I opened it in wireshark and you can see it captured 4 keys.

so the pb comes from your handshake........

try to deauth & capture on 2 diff cards or use airserver....

I disconnected and connected my connection manually so I didn't need to deauthenticate and captured that handshake.

Still got the same probleem though, I also tried using my netgear stick (which has also a realtek chip) but that didn't help.

What is airserver? I tried to look it up, but I can't find anything about it.

[shamanvirtuel]

i sometimes use airserv-ng in order to put one of my card in server mode
mean it will serv monitor mode on 127.0.0.1:666

that is weird ... but when you got only one card it seems that capturing & dumping on the same card can cause pbs and corrupt dumped packets

the fact you go through the served card , seems to avoid this problem that can be avoided too with using 2 cards ...

you connect like this : airodump-ng -c xxx -i 127.0.0.1:666 , aireplay-ng xxxxxxxxxxxxxxxxxx -i 127.0.0.1:666


more clear ?

[jesse33]

i sometimes use airserv-ng in order to put one of my card in server mode
mean it will serv monitor mode on 127.0.0.1:666

that is weird ... but when you got only one card it seems that capturing & dumping on the same card can cause pbs and corrupt dumped packets

the fact you go through the served card , seems to avoid this problem that can be avoided too with using 2 cards ...

you connect like this : airodump-ng -c xxx -i 127.0.0.1:666 , aireplay-ng xxxxxxxxxxxxxxxxxx -i 127.0.0.1:666


more clear ?

Yes!

using airserv-ng worked with 1 of the access points, which has a simple dictionary passphrase and uses WPA TKIP, but the second AP still can't be cracked which uses WPA2 AES and a difficult passphrase.

[shamanvirtuel]

you use cowpatty or aircrack ?

because cowpatty won't work with wpa2/aes

only wpa 1 ..

[jesse33]

you use cowpatty or aircrack ?

because cowpatty won't work with wpa2/aes

only wpa 1 ..

yes I know, I use aircrack.

[jesse33]

YES!

I've found the problem.
For some reason aircrack (and cowpatty) don't use the last word in a dictonary file.

Since I entered my own passphrase at the end of the dictionary, it couldn't find the passphrase for the 2nd AP.

I just typed in a few lines of mumbo jumbo at the end and it worked.

Thanx for all your help shaman!