WPA and WPA you are very good encryptions if you're using WPA you're using the for but you're using
T-Clip with that.
And if you're using WPA to while you're using a yes with CC MP and you are not going to be able to crack
these passwords except for one little problem and the problem is is the initial connection between a
wireless WPA or WPA to client to an access point has what we call a four way handshake and not that
many years ago there was a small weakness discovered in this four way handshake that allows us to do
something very interesting.
Now I need to be careful here when you're cracking WEP you can mathematically derive the password just
by looking at packets.
You can't do that with WPA and WPA to with WPA and WPA to think more instead that you've got this guy
who's really good at turning the numbers on a bicycle lock and then pulling on it.
So you can go to this guy and say hey try 0 0 0 0 and he could do that real quick and pull on it.
So if you wanted to you could tell this guy start with all zeros and then just keep going to go to 999.
Now now if there was only that would be 10000 different permutations that would work great.
But with WPA WPA to take that same bike lock analogy and turn it from four digits to like 128 digits
so it would take that guy even if he was fast a very very long time to go through all these.
Luckily for us we know that human beings don't use good randomized long passwords.
We know that most human beings are going to use like a phrase and then a number or their pets name and
then the date they were born or the number of kids they have in their wife's name and the date that
they got married.
Little simple things like that.
And if we know that we can tell the guy who's spinning on that bicycle lock.
No no no don't start at the zeros.
Just try all of these first so we've got to get this WPA WPA to cracker what we call a dictionary file.
Now a dictionary file is nothing more than a big text file that is full and I mean full of tens of millions
of different types of permutations of well-known words with numbers and all kinds of different things.
Now you think what tens of millions.
Well compared to 128 power stuff 10 million even my laptop give it a day could knock all that stuff
out.
So that makes a big difference.
So what we're going to be doing with WPA WPA too is we're going to go ahead and grab not a whole bunch
of packets.
What we're going to grab is those four way handshakes when people start to connect and using that we
can derive the passwords by using a dictionary file basically saying try all these.
And if people use it then we're going to have them.
So let's go ahead and start off by.
Let me show you how the setup works this time.
So I've got my same wireless access point.
Now he's still set to WEP at this moment so we're going to change him to regular old just WPA GSK and
get him up and running and we'll put a really weak password on here then we're going to go back over
to the Colley box and in this case what we're going to do is we're still going to monitor the traffic.
But we're just going to wait for somebody to authenticate and we've got him.
We'll run the cracker and with luck since it's a weak password we're going to be able to get it pretty
easily.
Let's take a look at the setup.
All right.
So let's go over here.
And first of all instead of calling it non-secure weap let's call it non-secure WPA and let me apply
that.
Well wait a second.
Now the next thing I'm going to do is go over to wireless security and we're going to take off weap
And let's go to WPA personal.
This type of attack will work with WPA or WPA to personal shared key.
So I've already got a password in here and I want to keep it.
Now the password is Timmy Timmy.
So it's a pretty simple password it's just a very common word used twice.
So let me go ahead and apply all this.
I'll save it.
And we're pretty much ready to go.
So this guy is now WPA personal.
He has a very simple password of Timmy Timmy.
And now what we're going to do is go over here.
We're going to grab a bunch of data.
But in particular we're not just grabbing data we're looking for handshakes.
And that's where arrowed dumped does a great job.
Let me show you now what I've got here is I've got aero dump still running on my screen.
Now if you take a look right here at top you're going to see there's not secure WPA.
You can even see that it's WPA and it's running T-Clip no great surprise there.
And there's the MAC address for it.
So what we're going to do now is let's start aero dump and we're going to watch for hand-shakes.
I'm going to put all the stuff that it finds into a file called WPA file
and this guy is on Channel 6
in the SS ID
is 20 colon.
They colon for the colon 42 colon for three colon the eight.
And we're going to tell them to listen.
W zero Oman.
So what we're going to do now is just keep watching this and see if somebody comes in
there it is.
Wow that was really quick.
Let's rewind that a little bit so we can see it.
What we just saw there was a handshake it flashed really really quick so I kind of missed it.
But what we now know is that we have a file of captures that include at least one if not two and shakes.
I've got a bunch of people in the studio all trying to connect at the same time.
So hopefully we've got a bunch.
So let's go ahead and take a look at that file and go ahead and see if we can pull the password out.
So we can go and just turn this off.
And let me make sure I've got a dictionary file in there.
There he is way up at the top.
You see the word dictionary.
That's a dictionary file that I've created.
So to actually go about the cracking is we just go ahead and run
aircraft.
A2 means I'm doing a W P-A attack on this guy.
So I got to tell him where my dictionary file is it's right here in the same folders.
I just type in dictionary and then I tell it which file I want to crack.
In this case it's going to be WPA file ash 0 1 c.a.p it ener.
There it is right there.
See it.
Timmy.
Timmy pretty easy stuff.
Now you look at it this is going to wait a minute wait wait wait wait wait Mike you put the right password
into your dictionary.
Yeah I did but I did that just to speed up this demonstration.
Trust me there are huge dictionary files and there they got to to me in there just as easily if you
have a weak WPA or WPA to K odds are good that people will be able to crack it almost as quickly as
what I've done right here.
The right answer is simple.
Use long complex private shared keys when you're dealing with WPA and WPA too a lot of people recommend
don't use any human words and make sure you use at least 20 characters which can sometimes be long to
remember but boy does it make it secure.
OK so now that we've cracked WEP and WPA and WPA two we can actually make life a lot easier cracking
with WPX.