Using Airolib-ng
To begin using airolib-ng,
we first need to create a text file containing the ESSID of our target AP.
The next step is to import the ESSID text file into the airolib-ng database
Using a database named wifu.sqlite,
we use the --import essid option with the ESSID file,
essid.txt.
If the database doesn’t already exist, it will be created automatically.
Passing –stats to airolib-ng
displays information about our database,
including the ESSIDs and number of passwords that are stored.
We have imported our ESSID successfully,
but the database does not contain any passwords yet.
Let’s import the small wordlist included with John the Ripper
with --import passwd and the wordlist’s path.
In the output, a number of lines were ignored in the wordlist.
This is because not all of the entries are eligible to be used as WPA passwords,
which are between eight and 63 characters long.
With the network ESSID and password list imported,
we can have airolib-ng batch process all of the corresponding PMKs
using –batch.
Once we’ve generated them,
we can use these PMKs against APs that have the same ESSID.
Once the batch operation is complete,
the output shows that all possible combinations have been computed
for our combination of ESSID and passwords.
We aren’t limited to one ESSID in the database.
We can add multiple ESSIDs,
and they can be added at any stage.
Adding a new one or multiple at this point,
then batch processing the database,
will compute each possible combination of ESSID/passphrases
that haven’t been processed yet.
We can run multiple instances
of airolib-ng batch processing at the same time as well.
Now, instead of using a wordlist with aircrack-ng,
we can pass the database name using -r instead.
Note in the aircrack-ng output
that the keys were being tested at over 2,600 per second!
Even this brief example displays the huge benefit
that using pre-computed PMKs can provide.