So before we cracked web access points and we also cracked WPA to access and as we realized we were
able to get a handshake cracking WPA to exploit and drawing it against a wordless.
So it depends on the strength or through wordless sometimes the passwords will have upper characters
special characters numbers etc. and can take years to crack and access so the WP s writing is a guaranteed
cracking.
And it only works against structures that are not luck.
So what you're actually doing is cracking an eight digit PINs and you can do with the step by step you
can correct the first four digits and then you can crack the remaining three digits and the last digit
is a check some digit.
That is easy calculated.
So as you can see if you want to read the first four digits the combination is nine to the power force
which is like around ten thousand which is possible.
And the good thing is once you have this WPI spent even if the victim changed their WPA to best password
running the river again against the same access point with WPA spent will give you the current password
or the changed password in a matter of seconds.
So let's go data and invoke this Weaver application first of all we can issue the command wash minus
go Just flush so they knew what to do.
There are lots of options here that I can leave for you to go through but can't wash my sight and W
lenses you don't want.
So it's important here to enable the monitoring mode on our network quite so as we did before a month
that energy is already enabled in my case.
So if you want to enable it again.
So right.
Airman dash energy start and then the W lines you know what.
So let's run wash minus.
I believe 0 1 it will show you.
It will show you actually.
Or the neighboring access points.
I'll stop it here.
The controls see so little Shirley all the neighboring access points you will see the version of the
WTS here and whether it's sloped or not.
Many of these access points do not have the WTS locked all the mine since I've tried a couple of times.
No it became locked and I'm not able to run lever against my access points.
So actually it's a no go.
Once the deputy is locked.
But I'll tell you how to perform this.
So let's choose my X response was that X point here is the S is not locked.
So you go river and express enter again lots of options here which are totally beneficial if you go
through them one by one.
But I'll use the default comment.
So river minus I to specify the interface and then the access point there Mike I just apply X point
and run very verbose just to see what's going on.
So just invoke the command and if you want you can just leave it overnight at the end of day.
River will display WPA spent and it will spit out the WPA to password so I'll stop that here at this
point.
So once this is done it might take you a couple of hours maybe a couple of days breather will display
the pen here and under that it will display the WPA to password and you can try it to associate to the
access point.
Suppose that the victim changed this password only have to do is to run River again with the same element
here and just write e to specify the pin then enter the the then the 8 digit then that you already got
from the previous attack and river will just display the new password within a matter of seconds.