4 ms·

>WPA/WPA2: 3177.6 kH/s 22.5 minutes (11.25 on average) to crack a randomized 8 hex digit password that a good number of wifi modem/routers come with (mine cert

>WPA/WPA2: 3177.6 kH/s 22.5 minutes (11.25 on average) to crack a randomized 8 hex digit password that a good number of wifi modem/routers come with (mine certainly did)

exhilaration 10y ago
Can you point me to some resources for learning how to do this? Starting with capturing my wi-fi traffic to running the right tools to crack it? I'd like to see how long it takes me to crack my own password.
- unbelievr 10y ago
  There are quite a lot of guides out there on sites like hackforums I reckon. The search keywords are "aircrack-ng WPA". In short terms, you need to sniff the 4-way handshake between a legitimate client and the AP it connects to. This can sometimes be forced by spoofing a "deauth" (disconnect) packet from the client, but requires support in the chipset for your wlan-card. (Injection and monitor mode). Once you have the handshake, your options are either aircrack-ng, hashcat or other password cracking tools. Some of these have a crazy amount of options and possibilities for cracking, and getting to know them can increase your success rate by a lot. However, the easiest way these days is to exploit WPS in the AP. Look up Reaver and Pixiewps.
- efraim 10y ago
  This[0] guide goes over how to use WiFite in Kali Linux[1] to capture a wpa handshake and how to use hashcat to crack it. You have to have a wifi-card that is compatible with aircrack-ng[2]. [0]https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-with-hashcat-kali-linux/ https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-wi... [1]https://www.kali.org/downloads/ https://www.kali.org/downloads/ [2]http://www.aircrack-ng.org/doku.php?id=compatible_cards http://www.aircrack-ng.org/doku.php?id=compatible_cards
snuxoll 10y ago
Things like this really make me consider using WPA-Enterprise on my home AP, enabling RADIUS on my pfSense VM wouldn't be too hard. I don't particularly care about the guest network, it's on a separate VLAN and has no access to the rest of the network (I should probably throttle the traffic).

>WPA/WPA2: 3177.6 kH/s 22.5 minutes (11.25 on average) to crack a randomized 8 hex digit password that a good number of wifi modem/routers come with (mine certainly did)

exhilaration 10y ago

Can you point me to some resources for learning how to do this? Starting with capturing my wi-fi traffic to running the right tools to crack it? I'd like to see how long it takes me to crack my own password.

unbelievr 10y ago
There are quite a lot of guides out there on sites like hackforums I reckon. The search keywords are "aircrack-ng WPA". In short terms, you need to sniff the 4-way handshake between a legitimate client and the AP it connects to. This can sometimes be forced by spoofing a "deauth" (disconnect) packet from the client, but requires support in the chipset for your wlan-card. (Injection and monitor mode). Once you have the handshake, your options are either aircrack-ng, hashcat or other password cracking tools. Some of these have a crazy amount of options and possibilities for cracking, and getting to know them can increase your success rate by a lot. However, the easiest way these days is to exploit WPS in the AP. Look up Reaver and Pixiewps.
efraim 10y ago
This[0] guide goes over how to use WiFite in Kali Linux[1] to capture a wpa handshake and how to use hashcat to crack it. You have to have a wifi-card that is compatible with aircrack-ng[2]. [0]https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-with-hashcat-kali-linux/ https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-wi... [1]https://www.kali.org/downloads/ https://www.kali.org/downloads/ [2]http://www.aircrack-ng.org/doku.php?id=compatible_cards http://www.aircrack-ng.org/doku.php?id=compatible_cards

snuxoll 10y ago

Things like this really make me consider using WPA-Enterprise on my home AP, enabling RADIUS on my pfSense VM wouldn't be too hard. I don't particularly care about the guest network, it's on a separate VLAN and has no access to the rest of the network (I should probably throttle the traffic).