Now that we have associated with our target network we can start communicating with it.
It won't ignore us.
So now we can go and start injecting packets into the traffic to foris the access point to generate
new packets with New ivie's.
This will increase the number of data really really quickly allow us to cry.
W epee networks in minutes even if the network was not busy like the wine that we are targeting right
now.
Now there are a number of ways to do this.
What in this chorus um go on to explain the most reliable method which is using an eight hour piece
request to play a task.
I actually explained other methods in my network I can chorus.
They are a little bit more complex and have less success rate so this is the most reliable method and
it should work against most networks.
If you have a good signal a good wireless head dafter.
So the idea behind this method is to wait for I know your IP packet and I'll talk about a are happy
in more details later on.
So for now just think of it as a special type of a packet that we're going to be waiting on.
Was this packet is sent in the network will go to capture it and retransmitted was we do.
The writer is forest to generate a new packet with a new ivy.
So by repeating this process we will be forcing the writer to continuously generate new packets with
New ivie's.
Then whilst we have enough data we have enough ivie's we can run aircraft energy exactly as we seen
before and Crikey the key.
So let me show you how to do this in practice.
Now as you can see I am already running hot air or domke energy against my target network and I have
already associated with it as shown in the previous lecture.
So the only thing that's left right now is to run the AARP replace a task in order to inject packets
into the traffic and force the rotor to generate new packets and increase the number of data.
To do that we're going to use aeroplane energy again and the command is actually going to be very similar
to this commander right here.
So I'm actually going to copy all of this because I'm lazy and I'm going to clear this and paste the
command here.
Now there are a few things that I need to modify.
First of all I don't want to run a fake authentication attack so I'm going to remove all of this and
I want to run an a hour AP replay.
OK.
Also this does not take a number.
So I'm going to remove this number and I'm also going to replace the a with a B and we're done.
So if you look at it you'll see it's actually very similar to this command right here we're using a
ripply energy what instead of doing a fake authentication attack we are doing and they are people play
it like we are giving it the mike address of my target network after the B instead of a.
Then we'll give it the MAC address of my wireless adapter.
After the page which is identical to this and then were given my wireless adapter in monitor mode now
I'm actually going to associate again before I do that.
And then I'm going to hit enter here and what's happening right now is my wireless adapter is waiting
for an IP packet.
Once there is any IP packet transmitted in this network it's going to capture it.
It's going to retransmitted once it does that the access point will be forced to generate a new packet
with a new i.v.
And we'll keep doing this for a sim.
The access point to continually generate new packets with New ivey's.
So you should just wait for it.
Right now we're literally just waiting for any IP packets to be sent in the air.
And as you can see the number of data is increasing know very very quickly which means that we actually
managed to capture an IP packet.
This IP packet got to retransmitted forest the rafter to generate a new packet with a new i.v and we
continually do end this process forcing their outer to generate new packets with New ivey's.
So right now we can go ahead and run in a crack and to crack this network.
And before I do that I'll actually just associate one more time.
And then I'm going to do a crack.
G.
Give a name of the file which were restoring the data in which is called a p play.
0 1 Do a cab.
So I'm going to hit enter and you'll notice the cracking process right now will actually require more
data packets.
The reason for this is I've actually modified the settings of this network so that it uses 128 bit key
because in Web you can either use a 64 bit or a hundred in 28 key and obviously the 128 key is longer.
Therefore I actually modified the key length for this lecture to make sure it's the largest key possible.
And as you can see we still managed to get it within about 47000 parkettes.
We have the cure right here in ASCII and we have the key in here in hagues where we can use.
After we learn more.
The cons.
So perfect.
Now we managed to crack the terrorist network.
It was idle as you could see there was no data being sent.
We managed to do this by forcing the target access point to generate new packets with New ivie's.