PHStrawberrry
Forum Veteran
Goodmorning PHC!
NOTE : Yung mga "@" ay letrang "A" or "a"
If you are interested, here are links to my other h@cking tutorials:
In this tutorial, I will demonstrate how to cr@ck WEP's big brothers: WPA annd WPA2
In the last tutorial we saw how weak and easy to cr@ck WEP encryption is. I will now show you how to cr@ck the most popular replacement for WEP. WPA2 uses a stronger encryption algorithm, AES, that's very difficult to cr@ck—but not impossible.
When a user connects to a WPA2 Access point, the client and AP ue a "4 way handshake" to authenticate the client. This is how we can cr@ck the encryption: if we can capture the 4 way handshake, we can cr@ck the password. We will again use aircrack-ng, and this time we will use a dictionary attack to cr@ck the password.
1) Put your WiFi Adapter into Monitor mode, to monitor and capture traffic on the network:
Replace wlan0 with the identifier of your adapter, as in tutorial 1.
Note that airmon-ng has renamed your wlan0 adapter to mon0
IF YOU WANT TO REMAIN ANONYMOUS FROM A SYSTEM ADMINISTRATOR, run these commands:
This will change your MAC address of your wireless adapter, you can run it again for mon0.
2) Begin capturing traffic:
We will again use airodump-ng to capture packets sent over the wireless network. First we need to get the information about the network we are trying to cr@ck:
3) Capture traffic on the target AP:
Now we will focus on a single network, make sure its encryption is WPA2. Run this command:
replace 00:11:22:33:44:55 with the bssid of the target network, and 11 with the channel. "example" is the file the captured packets will be written to.
4) Force a 4 way handshake:
To capture the password, we need to capture the authentication process. We can quickly do this by forcing them off the network, whereby there system will automatically reauthenticate them. Open a new terminal window and run this command:
The 1 is the number of de-authenticate frames you want to send, and 00:11:22:33:44:55 is the bssid of the access point.
If the command was successful, we should see "WPA handshake." in the top corner of our airodump terminal. We now have the encrypted password!
5) Cr@cking the password
We can now use aircr@ck-ng to crack the encrypted password in our "example" file. This is a dictionary attack, so the attack is only as good as the dictionary file you use. Use Ctrl + C to stop the airodump process running, and then run this command in a new terminal:
We don't need to be in range of the network to cr@ck the password. You can also use multiple wordlists to cr@ck the password, but double ups in the 2 lists will increase the cr@cking time as the program will have to check the same password twice. You can download wordlists from the internet:
6) Wait. This process of cr@cking could take a long time - hours to days. The stronger the password, the longer it will take to cr@ck it - if ever. A strong password can sometimes only be cr@cked with a bruteforce attack (testing every possible combination of numbers, letters and symbols), and that takes much much longer. if you cant crack this password, find another network to attack. When the password is found, it will be displayed on your screen. You now have access!
Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.
Watch out for future h@cking tutorials from me - further wireless cr@cking, metasploit and other common h@cking topics!
NOTE : Yung mga "@" ay letrang "A" or "a"
If you are interested, here are links to my other h@cking tutorials:
Spoiler contents are visible only to Established Members.
Spoiler contents are visible only to Established Members.
Spoiler contents are visible only to Established Members.
In this tutorial, I will demonstrate how to cr@ck WEP's big brothers: WPA annd WPA2
In the last tutorial we saw how weak and easy to cr@ck WEP encryption is. I will now show you how to cr@ck the most popular replacement for WEP. WPA2 uses a stronger encryption algorithm, AES, that's very difficult to cr@ck—but not impossible.
When a user connects to a WPA2 Access point, the client and AP ue a "4 way handshake" to authenticate the client. This is how we can cr@ck the encryption: if we can capture the 4 way handshake, we can cr@ck the password. We will again use aircrack-ng, and this time we will use a dictionary attack to cr@ck the password.
1) Put your WiFi Adapter into Monitor mode, to monitor and capture traffic on the network:
Code:
airmon-ng start wlan0Note that airmon-ng has renamed your wlan0 adapter to mon0
IF YOU WANT TO REMAIN ANONYMOUS FROM A SYSTEM ADMINISTRATOR, run these commands:
Spoiler contents are visible only to Established Members.
This will change your MAC address of your wireless adapter, you can run it again for mon0.
2) Begin capturing traffic:
We will again use airodump-ng to capture packets sent over the wireless network. First we need to get the information about the network we are trying to cr@ck:
Code:
airodump-ng mon03) Capture traffic on the target AP:
Now we will focus on a single network, make sure its encryption is WPA2. Run this command:
Code:
airodump-ng --bssid 00:11:22:33:44:55 -c 11 --write example mon04) Force a 4 way handshake:
To capture the password, we need to capture the authentication process. We can quickly do this by forcing them off the network, whereby there system will automatically reauthenticate them. Open a new terminal window and run this command:
Code:
aireplay-ng --deauth 1 -a 00:11:22:33:44:55 mon0If the command was successful, we should see "WPA handshake." in the top corner of our airodump terminal. We now have the encrypted password!
5) Cr@cking the password
We can now use aircr@ck-ng to crack the encrypted password in our "example" file. This is a dictionary attack, so the attack is only as good as the dictionary file you use. Use Ctrl + C to stop the airodump process running, and then run this command in a new terminal:
Code:
aircr@ck-ng example-01.cap -w '/root/desktop/exampleworldlist'We don't need to be in range of the network to cr@ck the password. You can also use multiple wordlists to cr@ck the password, but double ups in the 2 lists will increase the cr@cking time as the program will have to check the same password twice. You can download wordlists from the internet:
- You do not have permission to view the full content of this post.
Log in or register now.
- You do not have permission to view the full content of this post. Log in or register now.
6) Wait. This process of cr@cking could take a long time - hours to days. The stronger the password, the longer it will take to cr@ck it - if ever. A strong password can sometimes only be cr@cked with a bruteforce attack (testing every possible combination of numbers, letters and symbols), and that takes much much longer. if you cant crack this password, find another network to attack. When the password is found, it will be displayed on your screen. You now have access!
Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.
Watch out for future h@cking tutorials from me - further wireless cr@cking, metasploit and other common h@cking topics!