Probably one of the biggest classic threats to any wireless network is its susceptibility to being cracked.
So what we're going to be doing in this episode is we're going to be grabbing WPP WPA WPA too and WPX
passwords using standard hacking tools.
Now there is a lot of details that go into all of this so we're going to separate.
So first let's go ahead and let's go through an old school web crack
now the ability to crack WEP has been around for well a long long time.
Close to 20 years now with that you would think that most wireless networks would be off of WPP.
Well they're not.
We can find up to 15 percent of all wireless networks are still running WEP encryption.
So even though weapons old fashioned even though WEP is well-established in its ability to crack.
Well we're going to go through it.
The downside to Web is that the initialization vector the way it was being generated made it susceptible
to mathematical rigor.
And as a result we call this a IVI attack it's been around for a long time and it's actually kind of
fun to do.
So let me give you our set up so you know it's going on.
Now first of all I've just got a rig or wireless access point here.
I have hot rod it a little bit.
It's running.
Dash w r t firmware instead of the regular Linksys firmware.
Now I've got a machine over here.
Now this machine the only reason he's here is so I can show you what's happening on the wireless settings
on this wireless access point.
And over here I've got my good old colleague Linux box with my good Super-Duper network card on here
and we're going to be using a tool called aircraft to go through the process of grabbing the WEP keys
off of the system.
So what you're looking at here I'm over on my good computer right now and I'm physically plugged into
the back of this little router so you can see the router itself is set up as one entity 168 one out
one it's going to be a D.H. server passing out 192 168 up one addresses.
And what I'd like to do now is let's go over to the wireless side and you can see right now it's set
up as an access point and I've given it the SS ID of not secure WPP.
You need to remember that the next thing I want to do is head over to wireless security.
Now if you look here we've got it set to WEP if I wanted to I could do a lot of other ones but right
now i just because I want to show you how web works.
Now web remember has two different sized keys 64 bit or 128 bit.
Now I'm going to use 64 bit just because it cracks a little faster but it can crack 128 just as easily.
Now what we do is we usually type in some word and that generates these 64 bit keys.
So you can see the 64 bit keys are generated by this.
So it's 10 hexadecimal digits.
One two three four five six seven eight nine ten.
I want to use the passphrase total.
Let's generate on that.
And you can see I have four different keys.
Now normally we're just going to use the first key you can see the default transmit key is number one.
The other three keys are there in case somebody wanted to come visit.
Want to give a temporary key or something like that where you can generate that stuff.
Let me go ahead and save all this.
So we've got a little web enabled wireless access point that's running an SS ID of not secure WEP and
we'd gone ahead and we know what that key is.
So let's go and put the key down one more time.
So we got it.
All right.
So remember that key because we're going to use this guy and we're going to take advantage of the power
of the aircraft tool to actually make that crack.
So what we're going to do is we're going to go through the steps to do this.
Keep in mind that a lot of the steps that you're going to be looking at at the beginning are going to
be things for just like finding the network card getting the network card turned on to start grabbing
data sending it through a particular port.
Then we're going to take that data and we're going to look at it for a while and then literally there's
only one line that we're going to do that.
OK go ahead and crack it go go out and get started.
All right.
So here I am at a terminal within my Cali Linux and we're going to start running aircraft.
So air crack is actually a suite of different utilities.
Aircraft is actually the only tool that does the cracking.
We use other tools as well.
Like for example what I want to do is I want to see what kind of network cards I have.
So I'm going to use the command Ehrmann dash and G and you can see it has a W and 0 and that is my super
duper network card.
So that's what I want to use.
So I'm going to tell the Ehrmann tool to start monitoring
on that wireless device.
So I'm just saying go ahead and get started on W in 0.
So it's a little unhappy so I'm going to have to turn something off in.
Let's try again.
There we go.
OK so now it's up and running now.
What I want you to notice is right here you'll see where it says W land zero Mon that is in essence
all of the monitoring that it's doing is going through this interface and it's it's an interface we
can talk to it.
We can write from it we do whatever we want.
So now what I want to do is go out into the world and see what's out there for me to have some fun hacking
on so I'm going to use
arrowed dump
and I'm going to say hey go look out on W. Landman and tell me what you see.
And here are all the wireless networks in the area around here.
Let me open this up a little bit so we can see it better.
Ah that's better OK.
Now now we've got to spread out a little bit.
You can see that we have all of our IDs here nice.
No it says.
SS I.D. these are SS IDs.
So if you take a look here it's going to say not secure web.
So that is our target.
Wireless access point.
Now the other thing that's important here is we see the MAC address for that wireless access point so
we're going to need that information to go ahead and start grabbing data.
So what I'm going to do now is I'm going to use a tool called Aero dump and I'm going to say just grab
data.
But just from this one wireless access point so here's the MAC address.
Here's the channel that is currently on.
This is 2.4 gigahertz.
And here's the SS ID so to do all this when you just let that keep running for all I care.
Bring up a new window
yes I'm running in route.
Don't give me any trouble about that.
All right so I'm going I have to type in this fairly long command I'm going to use arrowed dump
and W means I'm going to have to write all the data that it's starting to grab.
So I'm going to give it a name.
Some of the really clever like dump file
I'm going to tell them what channel to monitor that's Channel 6 for this guy.
And now I have to type in the MAC address.
I know it says VSS ID but it's actually the MAC address.
And then I'm going to tell it which monitor do we want to use.
It's good old w lands 0 1.
So let's go and get that guy started
and he's up and cooking.
All right.
So what's happening now is ERDA is grabbing all of the very specific packets that I've asked for and
he's dumping that into this one file called dump file.
Now in order to use an I.V. attack on weap we have to have quite a few frames.
People will argue about the amount.
My general rule of thumb is go outside.
Go have a Coke and come back.
And it usually has enough.
So I'm going to let this run for about five 10 minutes probably about all I need and will come back
in just a minute and we'll see aircraft in action.
OK so we've let a little bit of time pass here.
So let's take a look on the screen now if you take a look.
As we've been running here this aero dump has been tracking this one particular wireless access point
and you can see down here these are actually systems that are connecting to it.
So we're actually getting information on systems that are making connections and we've got tons of frames
here probably way too many.
A lot of times they'll say as few as 5000 frames is all you need.
But I believe in a little bit of overkill here.
So what I'd like to do is go ahead and let's crack this guy so I'm going to stop that and we're going
to actually run Eric before I do.
Let me Backspacer it out before I do I want to show you something.
Now if you remember I said we're going to put them into a file called dump file.
Now you'll see that aero dump actually makes four different types of capture files.
And the one I want is the dump file dash 0 1 c.a.p.
Let's go ahead and run.
Eric
when we watch it for a second there it is.
So take a look right here.
There's the key that it's derived.
Now let's put that key we brought up earlier back on screen and compare them with the exact same key
we are officially cracked.
All I need to do now to get onto this wireless access point is on any client that I want simply go in
find that particular SS ID and type in that little bit of pass code and WEP is all over with now.
Granted WEP is a little old fashioned although it is still out there.
However that which replaced it WPA and WPA to also have some type of limitation.
So let's do a little more cracking but let's shift into the WPA WPA to world.