Rainbow Table Mode
The main purpose behind using coWPAtty is to use the pre-computed hashes,
similar to airolib-ng,
to crack a WPA passphrase.
Using these rainbow tables, which are pre-computed hashes,
significantly reduces the time required to crack WPA passphrases
as all of the computation is done ahead of time.
An important point to keep in mind when using pre-computed hashes
is that they need to be generated for each unique ESSID.
The ESSID is combined with the WPA pre-shared key to create the hash.
This means that the hashes for the ESSID of “wifu”
will not be the same as those for “linksys” or “dlink”.
As we did with airolib-ng,
we first need to generate the hashes
for our ESSID along with a dictionary file containing passwords.
coWPAtty includes a tool, genpmk, that generates the required rainbow tables.
We run genpmk with -f to define our wordlist,
-d to output to a file,
and -s to specify the ESSID.
Because our wordlist is exceptionally small,
generating the hashes for our AP took just over a second to complete.
Generating hashes using very large wordlists can take hours or even days.
But once they are generated for a specific ESSID,
they can be reused and shared.
Let’s run coWPAtty again,
but this time we’ll use the -d option to run it against the generated hashes file.
Rather than the second it took to crack our WPA passphrase in wordlist mode,
coWPAtty completed in less than 10ms!
Although coWPAtty has limited use compared to the speed of GPU cracking
it can be useful for creating pre-computed hashes
when we’re provided with SSIDs before a penetration test.
If the SSIDs aren’t provided, we might use Wigle,
a map-based Wi-Fi application, to locate possible SSIDs.