Showing posts with label Wifi Cracking. Show all posts
Showing posts with label Wifi Cracking. Show all posts
Reaver brute force attack Tool, Cracking WPA in 10 Hours
The WiFi Protected Setup protocol is vulnerable to a brute force attack that allows an attacker to recover an access point’s WPS pin, and subsequently the WPA/WPA2 passphrase, in just a matter of hours.
Reaver is a WPA attack tool developed by Tactical Network Solutions that exploits a protocol design flaw in WiFi Protected Setup (WPS). This vulnerability exposes a side-channel attack against Wi-Fi Protected Access (WPA) versions 1 and 2 allowing the extraction of the Pre-Shared Key (PSK) used to secure the network. With a well-chosen PSK, the WPA and WPA2 security protocols are assumed to be secure by a majority of the 802.11 security community.
Usage is simple just specify the target BSSID and the monitor mode interface to use:
Reaver has been designed to be a robust and practical attack against WPS, and has been tested against a wide variety of access points and WPS implementations.On average Reaver will recover the target AP's plain text WPA/WPA2 passphrase in 4-10 hours, depending on the AP. In practice, it will generally take half this time to guess the correct WPS pin and recover the passphrase.
WPS allows users to enter an 8 digit PIN to connect to a secured network without having to enter a passphrase. When a user supplies the correct PIN the access point essentially gives the user the WPA/WPA2 PSK that is needed to connect to the network. Reaver will determine an access point's PIN and then extract the PSK and give it to the attacker.
Get open source version of Reaver at Google Code
WEP Cracking( In Just 2 Minutes )
FUN FACTS:
-WEP stands for Wired Equivalent Privacy
-WEP is used to secure wireless networks from eavesdroppers
-WEP usually takes hours to crack
WEP has always been a long and tedious job, untill recently, when two FBI agents demonstrated how it´s possible to crack WEP in under 4 minutes (3 to be exact).
Here is how they did it:
1. Run Kismet to find your target network. Get the SSID and the channel.
2. Run Airodump and start capturing data.
3. With Aireplay, start replaying a packet on the target network. (You can find a ‘good packet’ by looking at the BSSID MAC on Kismet and comparing it to the captured packet’s BSSID MAC).
4. Watch as Airodump goes crazy with new IVs. Thanks to Aireplay.
5. Stop Airodump when you have about 1,000 IVs.
6. Run Aircrack on the captured file.
7. You should see the WEP key infront of you now.
PROGRAMS USED:
-Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.
It is designed for Linux.
You can download it at www.kismetwireless.net
A windows version can be downloaded at http://www.renderlab.net/projects/wrt54g/kiswin.html
-Aircrack (Includes Airodump, Aireplay, Aircrack and optional Airdecap for decrypting WEP/WPA capture files)
Aircrack is the 802.11 WEP and WPA-PSK keys cracking program that can recover this keys once enough encrypted packets have been captured with airodump.
Airdecap is used to decrypt WEP/WPA capture files.
Airmon can be used to configure the wireless card.
Save this Page
