Now, the final airplay attack is the AAFP request replay attack.
I tell you, this attack is the most effective way to generate new initialization vectors.
The initialization vector is a continuously changing number used in combination with a secret key to
encrypt data.
So the attack listens for an ARP packet and then retransmit it back to the access point.
So this causes the access point to repeat the packet with a new initialization vector, and by collecting
enough of these Ivey's aircraft, engie can then be used to crack the Web key.
The address, resolution, protocol, or ARM, is used to convert an IP address into a physical address
such as a Mac address, right to a host that wishes to obtain the physical address of another machine
sends an ARP request broadcast on the network.
The host, with a matching address, replies with a unicast transmission and reveals its physical hardware.
All right, so that sounds simple enough, so let's get started.
For this attack, your wireless card needs to be in monitor mode and you will need a fake authentication
with the access point, as I showed you in the previous lecture's.
So I said the fake authentication, time to 60 seconds and it will associate again every 60 seconds.
All right.
My fake access point is up.
Now I'll open a new terminal screen and start AARP replay attack.
So give our replay attack parameter.
VSS idea of the access point.
And the Mac address of the associated client from fake authentication.
And let's run it.
So right now, it's sending our request packets to the access point.
After launching the requests replay attack, you might have to wait a couple of minutes or even longer
until an hour request shows up on the network.
Then once one is received.
The AAP requests replay attack will jump into action and start replaying the packet over and over and
over again, forcing the access point to generate new initialization vectors.
So, yeah, their process usually takes some time.
So this is where the authentication attack comes into play.
When a client is dedicated and then reconnects to the wireless network was very high likelihood that
it will send an art packet as it reconnect.
So let's start the authentication attack to speed up the process.
And we can wait for a bit.
Now, stop the deal, authentication attack.
And let's try to crack the whip key with air cracking.
So we need to provide the file captured by arrow dump, engie to air, crack engie.
And now run aircraft and jet and we will give the captured file.
An aircraft engine is trying to crack the key with the initialization vectors.
Yeah, this process also takes some time, so please be patient.
We'll look at that.
The he has been found, you're cracking found the Web key by using 38000 730 initialization vectors,
not too shabby.