[HackRain]

WPA EXPLOIT

--Brain Storm Section--

Spoiler (Click to View)
This section is in no way OFFICIAL, and i do realize the chances of finding an exploit may be minimal and has been tried Manny times before. I am not a complete idiot, I can understand how there can be tension towards a thread like this, feel free to pm me your thought's. but please keep your negativity out of this thread. Id like this to be a positive learning environment, in which we work as a team to achieve a goal. fail or not. there is no harm, only the ability to excel.

hey guy's

I have been hacking WPA for a short while now.
I have had Manny thought's (like im sure you all have)

"there must be a better way to crack WPA rather then a brute force or dictionary attack!?"

Now, I believe there must be a way to crack WPA that doesn't involve a typical BF or DA method.
Also, I know theirs no released "public exploit" for WPA hacking
But i think it all starts with a small group and brains storming method's!

(with the exception of "De-authenticate and retrieve a salted hash" technique)

Now id like to open this thread, in the hopes of some positive feed back and suggestion's.
my hope I's to come from this thread:
is maybe a typical question, and we all have a look into it and find the plausibility behind the question.
and confirm or falsify the suggestion.

Id really like to search for an exploit for this, for those who believe
" security is merely an illusion "
Id pressure you into helping the cause to this thread.

Who knows this could also be quite a learning experience for one another also 👍

So please offer some tactical questions! or even feel as free to help brain storm and confirm the plausibility in our attempt's

~Suggested idea's
Spoiler (Click to View)

Code

* Clone Slave's Access Point && Drive bye. In Hope to achieve a non salted direct Pass. #TESTING
* Using a Packet-forge technique to send a direct drive-bye to a AP.   #UNTESTED/UNLIKELY
* Attempt to Exploit the mdk3 issue " error: potentially leaked plain text." #TESTING
* "Beck-Tews attack" #UNTESTED/UNLIKELY
*
*
*
*
*
*
*

Feel free to add or help solve, to this suggestion box.

[Stevensan]

The question is not if WPA can be cracked, but when. When will be the graphics cards so powerfull that you can brute force. Perhaps in 10 years you can brute force. We are limited to the technogy that we have right now.

[HackRain]

The question is not if WPA can be cracked, but when. When will be the graphics cards so powerfull that you can bruteforce. Perhaps in 10 years you can bruteforce. We are limited to the technogie that we have right now.

Mate i totally agree with your statement!

with GPU's running how they are now, it makes WPA highly brute forceable.
(assuming were talking pyrit here)

i believe wpa will no longer be even slightly safe in 5-10 years. the graphics cards will be able to crack at unbelievable speeds!

but in the mean time. hardware isnt an option. i have no ability to creat a "godlike gpu"
but i do how ever, have the ability to start a thread like this in hopes we can get a few smart people here to do the job a little quicker then 5-10 years =]

thanks for your contribution.

[Darco969]

Man I wish I could help. I have been thinking about this for a while. I am way too nooby to think of a way to get round it. I'm sure there is a way round it, remember that if a human has created it, then a human can break it!

[Middle]

Add my potential method i outlined in another one of your threads

Herd users to a fake AP > DNS Spoof to a wifi key phisher

[HackRain]

Middle for the thread sake, can u explain this method please?
thanks =]

[Middle]

https://hackforums.net/showthread.php?ti...id11743255

Well if you are looking for alternative methods i can come up with a couple:

1) Go and SE your way into the building and then use WirelessKeyView on a PC or get access to the router and look for default settings on the back and hard reset

2) *You will like this one*, Clone the WPA AP, then use airdrop-ng to disconnect all the users from target AP, and boot them on to yours (Its cloned), then DNS spoof the users to a page saying 'Router error: Please re-enter your wireless key and router password', phish the input from their and then allow your own MAC to connect to the target AP using airdrop-ng + the wireless key (but still denying the others access) then you have access to the network + the router. Once you have had a look at the router settings, get the clients back on the network by killing airdrop-ng and your fake AP.

Never done it myself, but perhaps if you got really dedicated you could get that to work. However i still maintain the easiest way is to use social engineering, like is explained in my tutorials.

[HackRain]

middle, that comes under my first entry no?
take a look in the spoiler.

[sBep]

Your first suggestion seems the most plausible one: *Clone Slave's Access Point In Hope to achieve a non salted direct Pass.

As you and ~Middle were talking in your previous thread: "(just a thought) -finding a new wpa exploit." https://hackforums.net/showthread.php?tid=1274191

I was also trying to figure out a different method of obtaining a wpa key and I've pretty much came up with the same idea :D
But the biggest problem with this method is when you DNS spoof and a page shows up out of the blue to the user asking him for his router and wireless password, he would be suspicious (think about it, wouldn't you be 😁). So it all depends on the users knowledge on computers/networks to work.

My suggestion is to put something like this to pop-up when the user opens his/her browser asking them for their WPA password:

Spoiler (Click to View)
[img]http://img810.imageshack.us/img810/4817/unledcow.png[/img]


It's basically the same thing as the "Router error..." thing but it's a bit more belivable (at least i think it is 😖)

But now that I think about it it just makes no sense that someone would input their WPA key if they are already connected to the network...

But not minding the "makes no sense" part here's how I would do this attack (if I'm wrong anywhere please do enlighten me 🤣):

1. Make a fake AP with the same ESSID/BSSID as the network I'm attacking (possible)
2. Create my fake "Input WPA key page" (possible)
3. Take down the AP using mkd3 (possible)
4. Use airdrop-ng to redirect clients from their original AP to my fake AP (possible)
5. Wait for them to enter their WPA key (plausible)
6. Stop mdk3, stop airdrop, stop fake AP, they reconnect to their network, everything is working as it should be (possible)
6. Go to the fridge, take a cold beer and enjoy free Internet using their network 🤗 (do the first one even if I'm not successful in obtaining the WPA key)

In a few days I'll be home so I'll try this out with my laptop and computer and tell you guys the results...

[Middle]

Nah best way to social engineer some one into giving their key to a phisher is to find out the make of the router, and then make up a phisher based on that.

So if you are targeting a BTHomeHub2 Find what a BTHomeHub2 router page looks like and work off of that

[sBep]

Well you might have a point there... But again as I said it all depends on the knowledge the user possesses about computers/networks to work. So it probably won't work every time you try this...

[Middle]

Well you might have a point there... But again as I said it all depends on the knowledge the user possesses about computers/networks to work. So it probably won't work every time you try this...

Only takes one user to mess up, and if you can't get internet access, then people will cave in after 10 minutes : )

[sBep]

Hahah, you got me there, your right :D

Well now it's just a matter of testing this method and see if it really works 😁

(this fake ap-redirecting thing has just gave me another idea on sniffing wireless networks...)

[Darco969]

If you made a phishing page of the Bthomehub, how would you get them to enter their key?

[Das_Virus]

well there is a tool called tkiptun-ng which is a bit like the chop-chop attack with wep, but for wpa.
But you will not get the Key, only some informations about how the Network is set up, and it only works if it is WPA-TKIP with QuoS enabled. (idk if the name was QuoS)