Tutorial - Cracking WPA/WPA2 - Any OS - Tools included

Wide (rest of width)

Narrow (200px)

Mafo

๑۩ﺴ۩๑ ♪ ♪ MeDiaZonE ™ GeNiuS ♪ ♪ ๑۩ﺴ۩๑

Status: Offline

Posts: 8004

Date: 12:42 01/13 2011

Tutorial - Cracking WPA/WPA2 - Any OS - Tools included

Permalink

PART 1

Hello, and welcome to my friendly guide! This is the first time i have made a tutorial and i aim to make it a good one.

**This guide is intended for the sole purpose of penetration testing only**

First of all here is what you need. I will cover all of these in more detail later.

You need:
-A wireless adapter with the RTL8187 chipset
-To be able to run Backtrack 4
-A good wordlist
-Access to a WPA/WPA2 Network
-Network Traffic (People connected to the network)
-A weak wireless key

Having the correct chipset
You need to have a RTL8187 chipset for the method that i am going to show for it to work. The easiest method of doing this is buying an ALFA AWUS036H Wireless adapter; these are very popular amung the hacker community as they have excellent range and they have the all important RTL8187 chipset, that allows it to work with the aircrack-ng suite. They cost around £30 so if you are not prepared to get one stop reading now.

However if you are then here is a link to the manufacturers website: Alfa

And here is a link to amazon [UK]: Alfa on Amazon UK

This adapter is compatible with all OS =]
Once you have your shiny new adapter, install the driver and have a play about!

If you don't want to get an Alfa you can look here, to try to find another compatible card.

Running Backtrack 4
Backtrack 4 is a Linux distro that specialises in penetration testing, not only is it good for wireless hacking it has a large collection of tools for all sorts of activities. There are three easy ways to run this OS.

Bootable USB drive
This method is probably the easiest and quickest method however it does mean sacrificing a 4GB USB stick! This is great if you have one lying about if not you will need to buy one or use the other method.

Ok first you need to install LiLi USB Creator; this allows you to burn .iso images onto your memory stick. The program allows you to select download and install many different Linux distros but what we are interested in is Backtrack 4 [That i will now refer to as BT4]

Here is the download link: LiLi Live USB
Once downloaded install the program and run it. I would create screen shots and a walk through of how to create the stick, but it would take a long time, and if you are unable to figure it out you shouldn't be here.

Creating a live CD
First you must download the BT4 .iso image [Or the Backtrack 4 R1 .iso; However this tutorial will be using BT4]

You can download it from here: Backtrack

Because i have never done this myself i will just give you this link [ulr=http://www.google.co.uk/#sclient=psy&hl=en&safe=off&q=how+to+burn+.iso+&aq=f&aqi=g4g-o1&aql=&oq=&gs_rfai=&pbx=1&fp=818a8bd2053ae4a6] .iso on a DVD[/URL] the rest is up to you.

Booting BT4
Once you have created your bootable device you need to boot into BT4, this is simply done by turning on your computer with your device inserted and pressing F[something - depends on your computer] to access the boot menu. Once you have done this select your USB stick your your CD and hit enter.

Once in BT4 you may need to login; to do this use the username "root" and the password "toor". To load the GUI [Desktop] you need to type the command "startx". Now is also a convenient time to type the following command "/etc/init.d/wicd start" this starts the inbuilt wireless manager.

Now that you are in BT4 the fun can commence! Oh wait, you may need to install the drivers for the AWUS036H Wireless adapter into BT4... [Just forgot about that step - figure it out yourself!]

Plug you adapter in and lets get going!

You will also need a good wordlist, i tried to upload one for you but my computer had a sapz attakc so i am going to let you find one for yourelf ;0

Safety First!!!
If you are practicing on a network that you do not have permission to test on [I don't know why you would ;)] Then it may be a good idea to spoof your mac address. This is like an IP address for your computer.

First you need to determine your devices names and modes. This is easily done by opening Konsole and using the following command

Code:
airmon-ng

You should see something like this

Here we can see all of my wireless devices and their chipsets. The first one is my AWUS036H, The second one is my inbuilt wireless card. [You can tell by the RTL8187 chipset]

We now need to put it into monitor mode; we do this by using the following command. Where i put <interface> you need to put the name given to your RTL8187. As you can see mine is "wlan0"

Code:
airmon-ng start <interface>

As you can see "monitor mode has been enabled on mon0" from now on the interface that you should use is "mon0"

Now moving on to hiding your ass

Code:
ifconfig mon0 down
macchanger -s mon0
macchanger -m 00:11:22:33:44:55 mon0
ifconfig mon0 up

You should see something like this. Your mac address will be different to mine of course.

Viewing available networks
Now we are ready to search for networks to target; type the following command to scan for networks

Code:
airodump-ng --encrypt WPA -a mon0

here we dump the wireless networks around us with the airodump-ng command, the switch "-a" searches only for networks that have people connected to them, which is what we want, --encrypt WPA Shows only WPA networks and mon0 defines what interface to use.

In this example "BTHomeHub2-NM6K" is my home hub that i am trying to obtain the network key for. As you can see there is one client connected to it (DE:03:74:C7:33:8E)

Target acquisition
Once we have a WPA/WPA2 network that has someone connected to it. We need to 'lock on'. To do this we run:

Code:
--bssid <bssid of the access point you wish to target>

You will also need to filter the list by the channel to do this add

Code:
-c <channel>

You also critically need to add

Code:
-w <filename>

This saves the handshake to your desktop

All of that together looks like this for my example:

Code:
airodump-ng --bssid 00:23:4E:55:B3:84 -c 1 -w WPA mon0

And this is what it should look like:

As you can see there are 3 Clients connected. We now need to kick one off!

Obtaining the WPA hand shake
This is the most important part of the process, as it is the only thing that involves the users of the network. What we are trying to do is disconnect a client from the access point and then wait for them to reconnect. When they do this they have what is called a 4 way handshake; what we are trying to do is witness the handshake so that we can crack it and obtain the network key.

We do this by using aireplay-ng to kick the user offline and then wait for them reconnect. By doing this we can capture and analyse the handshake. Use the following command:

Code:
aireplay-ng --deauth 10 -a <bssid of access poin> -c <mac address of client> <interface>

In my example the bssid of my access point is 00:23:4E:55:B3:84 and the client i want to kick of is DE:03:74:C7:33:8E

--deauth means "deauthenticate" [kick off] the number after it defines how many times to do this, i set it at 10, but you only really need one. Also if you are feeling mischievous you can set it to something like 10Billion to deny someone wifi access! Not the most effective but still lol worthy. Wait till you mate has a 24 kill streak on MW2 and kick him....

So i will open a new window and leave airodump-ng running and in the new window type

Code:
aireplay-ng --deauth 10 -a 00:23:4E:55:B3:84 -c DE:03:74:C7:33:8E mon0

It will look like this:

If it is successful the airodump windows will be displaying the wpa handshake in the top right of the screen. You can see this in the image below.

If not successful, wait for a while, as what we are waiting for is the client to reconnect. If they do not reconnect then try kicking a different client.

Cracking

-- Edited by Mafo on Thursday 13th of January 2011 12:44:56 PM

__________________

DANCEHALLSPOT.NET

Mafo

๑۩ﺴ۩๑ ♪ ♪ MeDiaZonE ™ GeNiuS ♪ ♪ ๑۩ﺴ۩๑

Status: Offline

Posts: 8004

Date: 12:47 01/13 2011

Permalink

PART 2

Also this is a good summary of the methods available to us!

Cracking
Now that you have your handshake you need to crack it. And this is a very popular subject in regards to wireless hacking as there are a few ways to go about it, all with varying opinions.

Dictionary attack
This is the standard method of cracking and is a very easy and simple method.

For this we use:

Code:
aircrack-ng <filename-01.cap> -w <file path of wordlist>

So for my example i would use:

Code:
aircrack-ng WPA-01.cap -w Pass/Example

For my example i made a wordlist that consisted only of my wireless key, so the result was instant, however when doing this in the real world it will take you many hours or even days to run through a decent wordlist.

When using a live CD/USB stick to boot BT4 save your wordlist to your desktop and use

Code:
-w <wordlist>

However the problem with this method is that it will take a VERY long time to go through a word list of any decent size. In my example i was only going through 350 keys a second, that may seem fast but if you think that a 1GB word list would contain about 100 million words you can see that it would in fact take a very long time.

So here is what you want to see:

An alternative bit of software that has more features, including the usage of rainbow tables, but also uses this method but a tad faster is coWPAtty. It is included in Backtrack, so open it up and have a look at what it can do.

Here's some example syntax for cracking a 4way handshake.

Code:
cowpatty -f <word list> -r <handshake>.cap -s <essid>

"Rainbow" tables
Now this is an interesting method that a lot of people have misunderstood. Basically the idea is that if you had a rainbow table that had a list of words that had all been precomputed for a WPA handshake you can go through them a lot faster. Now this is true, you can go through rainbow table at say 40,000 keys a second compared to 350 keys a second in the prior example. However the WPA handshake has been salted with the ESSID of the network. THis means that a rainbow table that has been generated for "johns network" will not work for "Erics network" as the ESSID is different so there is a different salt on the handshake.

That means for every different ESSID a new rainbow table has to be produced to be used with it. It is like multiplication tables, everything has been worked out prior. Now this is where a few people get confused....

It is possible to create your own rainbow tables for networks with unique ESSID's however the rate at which you create them (the speed at which you precompute keys for the table) is exactly the same as the rate at which keys can be tested against a word list. So for me it was 350 keys a second being added to the table each second. You can then go through the word list at a very fast rate, i was able to go at 40,000 keys a second after i had generated the table. But the key point was that the time it took to generate the table could have been used to just go through the word list! So creating your own tables for unique ESSID's is just ridiculous!

However the idea about these tables is that someone with a large amount of computing power could generate tables for a list of popular ESSID's and then make the available for download. So the idea is that you capture a handshake from "WirelessHotspot" then check on the list of rainbow tables, you see that "WirelessHotspot" has a rainbow table, you download it and then you run through the word list at an accelerated rate. And believe it or not someone has done this!

in this thread you can see links to all of the tables for the most popular ESSID's if the network you are trying to crack has an ESSID in the list then you can download the table and run it through at great speed!

I will not cover the commands and screen shots of how to do this, as i have no need for this method, and there are no wireless networks with an ESSID in the list for me to crack; so you will just have to google it out for your self. It shouldn't be hard!

Accelerated word list with pyrit
Now this is the method that i believe is the best however it does require a decent graphics card! This method uses the power of your GPU (Graphics Processing Unit) in your graphics card to test a handshake against a word list at a very fast rate. This is the method i use as it makes the most sense to me, and i have a good graphics card! This method does still require a word list to work but it allows you to go through the word list A LOT faster than before. Here you can see that on my new system i am going at 5480 keys a second with the standard aircrack-ng dictionary attack:

Now when i use pyrit and my GPU i can get up to 56,000 keys a second!:

That makes a big difference!! Again i won't show you how to do all this as it is quite complex to set up and there are already a few guides out there. Look here for more info.

Online services
There are services online that use various techniques to crack WPA keys, although they do charge money! The best site is most likely to be http://www.recoverwpa.com as they do not charge an upfront deposit; you only pay if they find your key. However i do believe that this and a few other website are doing nothing more than what i would do, i do recall one website that charged $10 for <1 billion words in 2 hours, something i can do myself in 6 hours! So that option is there if you don't have the hardware or the time but do have the money! This is also a good test if you are a White hat, as it is possible that the blackhats would use a similar/same service.i recommend you google a round looking for the best service or maybe even ask me!

Bruteforcing
Now here is another method that is a tad ridiculous, basically what happens is that you pipe the out put of a program called crunch directly into a WPA cracker like aircrack-ng or pyrit. The idea is that it generates a wordlist as it cracks, and you can define the word list. so if you used:

Code:
8 10 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!?-_

With crunch and aricrack-ng you would be generating a list of all of the 8 to 10 character combinations of those characters. Me and a friend worked this out to be something like 84 Petabytes! And as you can imagine, not only is that impractical it would take an impossible amount of time to crack, even with a high end setup.

The only legitimate use for crunch and WPA cracking that i can see is that if you know that the wireless key is only numeric or you know that it is a certain length and contains certain characters that way you can cut down massively on the amount of words generated. So for example 0-9 for 8 letters long may only take a day to do, and that is very plausible, but only if you know that it is only 8 letters long and only numeric.

The ultimate word list!
This is the package that i use, there are 2 word lists included one that is 2GB and one that is 10.7GB, and to my knowledge there are no words that are less than 8 characters long, so it is 100% efficient for WPA cracking!

982963903 words in Super-WPA 10GB
185866729 words in Custom-WPA 2GB

You can get the torrent here

I hope you enjoyed reading this, and i hope that you will be able to put it into practice as soon as possible!

-- Edited by Mafo on Thursday 20th of January 2011 11:19:43 PM

-- Edited by Mafo on Thursday 20th of January 2011 11:22:03 PM

__________________

DANCEHALLSPOT.NET

UnDaGround

MZ Teacha

Status: Offline

Posts: 838

Date: 16:42 01/15 2011

	Permalink
yawn __________________ Spoiler Dj UnD@Ground BAND PAGE: http://www.reverbnation.com/undagr0und LIKE MA PAGE: http://www.facebook.com/UnDaGr0und FOLLOW ME: https://twitter.com/#!/crys2s