[TUTORIAL] WiFi Cracking Tutorial - PART 2

[TUTORIAL] WiFi Cracking Tutorial - PART 2 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUTORIAL] WiFi Cracking Tutorial - PART 2 (/showthread.php?tid=4127410)

Pages: Pages 1 2

[TUTORIAL] WiFi Cracking Tutorial - PART 2 - SIM-2015410 - Mar 21, 2014

Hello Again HF!,

Welcome to another Hacking Tutorial by MeshCollider.

If you are interested, here are links to my other hacking tutorials:Spoiler (Click to View)

In this tutorial, I will demonstrate how to crack WEP's big brothers: WPA annd WPA2

In the last tutorial we saw how weak and easy to crack WEP encryption is. I will now show you how to crack the most popular replacement for WEP. WPA2 uses a stronger encryption algorithm, AES, that's very difficult to crack—but not impossible.

When a user connects to a WPA2 Access point, the client and AP ue a "4 way handshake" to authenticate the client. This is how we can crack the encryption: if we can capture the 4 way handshake, we can crack the password. We will again use aircrack-ng, and this time we will use a dictionary attack to crack the password.

1) Put your WiFi Adapter into Monitor mode, to monitor and capture traffic on the network:

Code 
airmon-ng start wlan0

Replace wlan0 with the identifier of your adapter, as in tutorial 1.
Note that airmon-ng has renamed your wlan0 adapter to mon0.

IF YOU WANT TO REMAIN ANONYMOUS FROM A SYSTEM ADMINISTRATOR, run these commands:
Spoiler (Click to View)

2) Begin capturing traffic:
We will again use airodump-ng to capture packets sent over the wireless network. First we need to get the information about the network we are trying to crack:

Code 
airodump-ng mon0

3) Capture traffic on the target AP:
Now we will focus on a single network, make sure its encryption is WPA2. Run this command:

Code 
airodump-ng --bssid 00:11:22:33:44:55 -c 11 --write example mon0

replace 00:11:22:33:44:55 with the bssid of the target network, and 11 with the channel. "example" is the file the captured packets will be written to.

4) Force a 4 way handshake:
To capture the password, we need to capture the authentication process. We can quickly do this by forcing them off the network, whereby there system will automatically reauthenticate them. Open a new terminal window and run this command:

Code 
aireplay-ng --deauth 1 -a 00:11:22:33:44:55 mon0

The 1 is the number of de-authenticate frames you want to send, and 00:11:22:33:44:55 is the bssid of the access point.
If the command was successful, we should see "WPA handshake." in the top corner of our airodump terminal. We now have the encrypted password!

5) Cracking the password
We can now use aircrack-ng to crack the encrypted password in our "example" file. This is a dictionary attack, so the attack is only as good as the dictionary file you use. Use Ctrl + C to stop the airodump process running, and then run this command in a new terminal:

Code 
aircrack-ng example-01.cap -w '/root/desktop/exampleworldlist'

We don't need to be in range of the network to crack the password. You can also use multiple wordlists to crack the password, but double ups in the 2 lists will increase the cracking time as the program will have to check the same password twice. You can download wordlists from the internet:

The default directory for wordlists on kali is "/pentest/passwords/wordlists/" so if you have a default dictionary there, feel free to use that.

6) Wait. This process of cracking could take a long time - hours to days. The stronger the password, the longer it will take to crack it - if ever. A strong password can sometimes only be cracked with a bruteforce attack (testing every possible combination of numbers, letters and symbols), and that takes much much longer. if you cant crack this password, find another network to attack. When the password is found, it will be displayed on your screen. You now have access!

Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.

Watch out for future hacking tutorials from me - further wireless cracking, metasploit and other common hacking topics!

Written by MeshCollider 🤝

* - CustomSync - Mar 27, 2014

If you are considering a bruteforce attack against WPA, one thing to try first may be the functions of a tool called "Reaver". Most newer routers are vulnerable and it can crack WPA in no time (depending on signal strength).

Good tutorial!

* - Nova1 - Mar 28, 2014

Thank you for this. I appreciate it dude.

* - SIM-2015410 - Mar 28, 2014

(Mar 27, 2014 06:16 PM)CustomSync Wrote: If you are considering a bruteforce attack against WPA, one thing to try first may be the functions of a tool called "Reaver". Most newer routers are vulnerable and it can crack WPA in no time (depending on signal strength).

Good tutorial!

Thanks for the feedback and the addition to the thread!

(Mar 28, 2014 02:26 AM)Nova1 Wrote: Thank you for this. I appreciate it dude.

Thanks for the reply, hope you find it helpful 🙂

* - opsafrica - Mar 29, 2014

Brilliant tutorial very helpful! Thanks a million!

* - Beznadzieja - Mar 29, 2014

A lot of cracking Wi-Fi tutorials with backtrack but it's best I seen. Thanks for sharing dude.

* - emvc05 - Apr 19, 2014

can someone help me please. i been trying to hack my home router but when i use reaver the router just timed out like if is protecting from the attack. can someone help me bypass this? do i have to use some port forwarding ?

* - LanceGrass - Apr 20, 2014

For anyone on the fence, I can attest to it's efficacy. Thanks for making it easy to understand M3sh.

* - WheredYouGo - Apr 22, 2014

This is very helpful. Thank you Mesh :D

* - SIM-2015410 - Apr 24, 2014

No problem guys, appreciate the feedback!
Im currently writing another tutorial, watch out for it!

* - linxx - May 8, 2014

Thank you so much for this awesome tutorial. Just cracked my first wpa network, and it sure feels good to have something work for a change.
One question...
Now that I have the password and can log onto the network, is there a way to access the router settings?

* - linxx - May 10, 2014

I tried that, and it looks like I will have to get the pass (brute force?) after all. No biggie as I can at least access the WiFi network, and that is, to me, amazing. Your tutorials are so complete and easy to follow that even an "old fart" like me can follow them and make them work.

Just another silly question...
When I am working with aircrack on a Wsp-2 network, I sometimes get this message after doing the aireplay-ng --deauth 1 -a (bssid) mon0.
Everything is working, except I don't get the handshake and I get this message...
NB: this attack is more effective when targeting
a connected wireless client (-c <client's mac>)

Now, I am wondering - how would I acquire the client's mac, and if I get it, where would I place it in the code line?

* - iDuL - May 11, 2014

This is an absolutely incredible tutorial OP, thanks for the share.

* - SIM-2015410 - May 11, 2014

(May 11, 2014 12:49 AM)iDuL Wrote: This is an absolutely incredible tutorial OP, thanks for the share.

I appreciate the feedback man, it has had hundreds of views but only 15 posts. So thanks for bothering to reply 🤝

* - Ihax1225 - Jun 20, 2014

I vouch for this method. It works for WPA2. Nice job.