Wrapping Up
In this module, we started by using the Aircrack-ng suite
to crack a 4-way handshake.
To do this, we first used airmon-ng to put the card in monitor mode,
then used airodump-ng to identify the target access point and client,
and then saved their traffic.
We then deauthenticated the client to force it to reauthenticate and thus
generated a 4-way handshake.
After capturing the 4-way handshake, we used aircrack-ng to crack it,
and finally confirmed the key using airdecap-ng.
Although we staged the attack and knew the passphrase in advance
the techniques we practiced are exactly the same when it comes to real-world APs.
Besides needing a real client,
the complexity is in the (physical) environment.
We have to be close to both the client and the AP in order to hear
both sides of the handshake.
They each generate data needed to crack the handshake.
Default wordlists will rarely contain the passphrase, although they sometimes do.
In order to improve our chances, we covered augmenting and mangling wordlists
using tools such as John the Ripper, Crunch, and RSMangler.
We piped the results to aircrack-ng and covered how to save them to disk.
Other tools, such as hashcat and coWPAtty,
can be useful when it comes to cracking WPA1/WPA2.
Hashcat is a versatile password cracking tool using OpenCL,
but mainly used on GPUs.
coWPAtty is no longer being developed, but it can still be a useful tool.
With genpmk, coWPAtty is able to generate pre-computed hashing tables
to speed up cracking later or with with aircrack-ng.
Although it is much more time consuming than using aircrack-ng or GPU cracking,
it might be useful in some cases to generate tables
prior to the penetration test.