Now from the previous lectures we learned in order to crack a WPA or a WPA to we need to first capturers
the handshake.
And second have a word list which contains a number of passwords that will go on to try and hopefully
one of them will be the password for the target network.
So right now I have both of these components and we are ready to go and crack the password to do this.
Aircraft energy is going to unpack the handshake and extract the useful information.
The M I see it right here or the message integrity code is what's used by the access point to verify
whether a password is correct or not.
So it's going to separate this and put it to the side and then go on to use all of the other information
right here combined with the first password from the word list to generate.
I see another message integrity code and then it's going to compare this I see to the one that's already
in the handshake.
If the ice you generated using this information plus the first password is the same.
Then the password used to generate this am I see is the password for the network.
Otherwise this password is wrong.
And still more to the next password.
Again it'll do the same.
It'll use all of this information combined with this password generate and you.
Am I see compared this new Am I see to the they want that or the handshake.
If it's correct then this is the password.
If it's nard then it's going to move on to the next password and it'll keep doing this through all of
the passwords in my wordlist.
If any of them generate the right am I see then this is the passwords for the network.
Otherwise we won't be able to get the password.
That's why the success of this attack really depends on your wordlist.
So let's see how to do this and practice.
Right now I have my wordless right here.
It's called Person ticks to you and actually manually added my password to the end of the list right
here just so that when I run the word list against her check I will actually find the password because
the word list did not contain my password by default.
I also have the handshake file right here as you can see and all of this is in my home directory which
is my root directory so if I do else in here you'll see I have the word list and the check file.
So we're ready to run.
Electric energy.
So we're going to type the name of the program as usual followed by the name of my capture file which
is w.p. a handshake zero on the car.
So so far it's identical to the way that we used to use it with the new epee.
The only difference right now because this is a WPA to network.
We have to specify a wordlist with a dash w option and the name of my word this is theirs.
There are T S T.
So very very simple.
Crack is the name of my program WPA a 01 dot cub is the name of the file that contains my handshake
and I'm using the W to specify my word this file.
I'm going ahead and 10.
And as he gets you know aircraft energy is running through the wordlist testing each word in the wordlist.
One by one as shown in this diagram calculate in NYC based on this information and that wordlist.
And then if the m s is quiroga It's going to tell me that this is the password.
Now the speed of this depends on your processor and the size of your wordlist file so if you have a
huge file obviously it'll take you longer time.
There are also online services that you can try.
Were you upload the handshake and they have huge lists and they have supercomputers to run through these
lists and try to give you the password.
Unfortunately I can't share their links with you but you can easily find them on Google if you search
for them.
Aren't perfect as you can see.
We managed to find the key cell must the key is found and this is the key to the network.
And this is the correct key because as you know this is the same key that we got when we exploited the
WP s future.
So now we can go ahead and connect to the network and we'll be able to run all of the cool stuff that
I'm going to teach you in the post.
Connection a tax section.
Now this is the only practical way known soulfire to crack.
WPA and WPA two keys.
There are methods to speed up this process so you can use the GP you for a cracking because it's much
faster than the see you.
That's if you have a GP you you can also use rainbow tables.
You can also pipe the wordlist as it's being created in crunch to air a.
N g.
This way you can create bigger word lists without using any storage on your computer.
There are also methods so that you can cause you're a cracking process and then come back after a while
without losing your progress.
But the main ideas are the same.
The only way right now to crack the beaupré and WPA too is through a short list attack.
You can use social engineering however to get the password using an evil twin attack where you trick
one of the users to give you the password.
This is actually all covered in my advanced network attacking course.
The cracking use in the depue Pipe in crunch to aircraft energy getting the password used in an evil
twin attack and much more vast network kiking techniques if you're interested in that then I highly
recommend you have a look.
On my advice network a kiking kooris check out the bonus lecture of this kooris The Last Lecture of
this course.
It contains links to all of my other courses and the comparison between them.