[Spagnum]

Disclaimer
I know brute forcing is stupid, but I still see all these questions asking how to brutefore WPA and WAP2 passwords. So I decided to give it a try. From now on you can referee to this tread if someone wants proof of brute forcing beening stupid.🙂

What this guide will show you:
How to install and use Crunch to do a bruteforce attack against a WPA or WPA2 network.

What this guide will not show you:
How to capture a handshake file from a WPA og WPA2 network. There is plenty of other guides to show you how to do this. I recommend this one by Middle.

Getting and installing Crunch:
I'm using Backtrack 4 here, and it's pretty strate forward getting and installing Crunch.
(If you are one another distro like Ubuntu or something you might need to install the gcc compiler first)

Open the console and use the following commands one by one:

Code

wget http://sourceforge.net/projects/crunch-wordlist/files/crunch-wordlist/crunch-3.0.tgz/download
tar -zxvf crunch-3.0.tgz
cd crunch3.0/
gcc -c crunch.c
gcc -lm -lpthread -o crunch crunch.o

[img]http://i57.photobucket.com/albums/g207/Spagnum/e89cf38a.jpg[/img]

Crunch should now be installed and you should be in the Crunch3.0 directory.

We will need to tell Crunch the minimum and maximum characters in the password, we do this like this:

Code

crunch <min-len>  <max-len>

We also need to tell crunch which carters to try with. This is simply done by typing all the carters you want it to use:

Code

abcdefghijklmnopqrstuvwyz1234567890

Finally we need to pipe crunch to Aircrack-ng which will do the actually cracking. Aircrack-ng will need two things, path to the handshake file and the ESSID of the AP. My handshake file is called WPAtest.pcap and the name of the AP is “Wireless AP” (the quotes are only necessary if there is a space in the ESSID)

All together the command looks like this:

Code

./crunch 8 8 abcdefghijklmnopqrstuvwyz1234567890 | aircrack-ng /root/WPAtest.pcap -e "Wireless AP" -w -

Aircrack-ng starts trying the all the possible password one by one:

[img]http://i57.photobucket.com/albums/g207/Spagnum/1-1.jpg[/img]

Notice that Aircrack-ng cracks around 620 k/s. Now lets take a look at how long that would take, accounting to Online Password Calculator.

[img]http://i57.photobucket.com/albums/g207/Spagnum/2-1.jpg[/img]

Okay so you see that bruteforce is stupid?🙂

Just for the fun of it, let’s help out crunch by limiting the charters to use as well as giving it the first part of the password. We need to tell crunch the first part of the password, like this:

Code

-t knownpassword@@@@

All together the command looks like this:

Code

./crunch 8 8 1234 -t test@@@@ | aircrack-ng /root/WPAtest.pcap -e "Wireless AP" -w -

[img]http://i57.photobucket.com/albums/g207/Spagnum/3-2.jpg[/img]

My first tutorial at HF, please forgive me for any grammar mistakes!

[captainmark]

Nice tut man.
I have a question and i dont rember if have been answered before so
is it possible to pipe crunch to pyrit?
Cause if its a yes then we all might still not be alive to see the ''KEY FOUND''
but atleast our grand children will have free internet lol
No seriously it would be very interesting if it could colaborate with pyrit and 4 hi-end GPUs

[Spagnum]

Thanks!

I haven't tried Pyrit yet, but it's on my "To do list". I remember having read somewhere that you can combine Pyrit with crunch, but I'm not sure...

[ziggycat]

@spagnum - bruteforcing is not stupid.

Pyrit is the only way forward if you plan to try and crack wpa. You can pipe the ouput directly from crunch and depending on the graphics card you are using instead of the 620 keys a second you can do 90,000+ a second.

[Middle]

@spagnum - bruteforcing is not stupid.

Pyrit is the only way forward if you plan to try and crack wpa. You can pipe the ouput directly from crunch and depending on the graphics card you are using instead of the 620 keys a second you can do 90,000+ a second.

Brute forcing is stupid

Only exception is if you know 1 or two characters and know its only 8 characters long (Phone number perhaps)

[Spagnum]

@spagnum - bruteforcing is not stupid.

Well in the case that you using "normal" hardware like most users would. I conclude brute forcing is stupid.🙂

[Ph0x]

Pyrit isn't yet configured to work with Aircrack-ng unfortunately.

http://www.backtrack-linux.org/documents...A_v2.0.pdf

<page 22> states that aircrack doesn't currently support the option for the passthrough from Pyrit,
however, there are options to build aircrack with CUDA capabilities <page 28>.

Still trying to get the cowpatty one working at the moment though! :-D

[ziggycat]

Brute forcing is stupid

Only exception is if you know 1 or two characters and know its only 8 characters long (Phone number perhaps)

Sorry mate I disagree,

Most people who don't change the ssid have a tendency to leave everything on default settings.

As we have discussed on other threads:

BTHH - 10 characters, comprising (a-f & 2-9 ) = 289 254 654 976 perms
SKY - 8 characters comprising (A-Z) = 208 827 064 576 perms

I am now using 2 machines, and 3 x 5850's. I'm not using pyrit serve but currently I'm achieving a combined total of 210K pmk's a sec, and plan to add a 5870 at the end of the month pushing this to over 300K.

(all 5850's have been purchased second hand at a total cost of £245, each card has been flashed with a 5870 bios. This enables me to push past the 775 overdrive limit).

Although this could potentialy take 11 days for BTHH, and 8 days for sky I defend my position that bruteforcing is not stupid (these are the maximum times, it's very possible that the key is found much earlier in the process)

Currently crunch does not have the ability to drop any number of repeating characters (although there is a feature request ticket for this on sf). I'm looking at something in perl or C to accomplish this, by accepting ouput from crunch and piping it to pyrit. The ability to drop 5 or more repeating characters on the fly will significantly reduce the number of permutations and therefore the overall procesing time.

[Middle]

But even with 300,000 keys/s it could still take you 8 days, and for most people that is really not an option...

I think that pursuing brute forcing attacks past the point where you are all ready aware of some of the characters (i.e i know it starts with 44 and is 8 characters long, so it can't take long to do 44xx) is just silly!

But hey if you have the resources and time there is nothing stopping you, my main concern is just that the newbies will think that they can get a 100% success rate with this awesome tool, whereas in fact unless they shell out several hundreds of pounds and rack up a massive electricity bill its not happening. Where as a pro like yourself who understands the attack doesn't need a tutorial on it...

Thanks why i don't like this tutorial!

EDIT: @Spagnum i just read the tutorial and it is nicely written and put in good context, good job! Oh and the bruteforce calculator is a great find! And spell my name right XD

[theboyz]

Great tutorial Thanks you very much :)

[MaXoNe]

Great tutorial , there is a bash script that generates passwords based on data you provide [ Pet name , date of birth etc ] that shit got me 2 WPA networks , but it took me some time to do the research [ it is a part of zer0day's Linux Script Collection ] :)

[Middle]

CUPP.py

CommonUserPasswordsProfiler

[Counter440]

Excellent tutorial, thx ✌

[Spagnum]

EDIT: @Spagnum i just read the tutorial and it is nicely written and put in good context, good job! Oh and the bruteforce calculator is a great find! And spell my name right XD

Thanks! - sorry about the name 😊 - can't edit it now.

[Gates]

Thanks For Posting...Nice Tutorial and layout. I'm waiting for amd to release it's 8-core cpu this fall and paring it with my GTX 460 2GB to see what I can get.