13 ms·
Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat
- infamousjoeg 9y agoHow long does the cracking process take? I remember WEP only taking 10 minutes using aircrack-ng in BackTrace... I imagine this takes substantially longer.
- jaclaz 9y ago>Naive-hashcat uses various dictionary, rule, combination, and mask attacks and it can take days or even months to run against strong passwords. The cracked password will be saved to hackme.pot, so check this file periodically.
- legojoey17 9y agoSo I don't have experience with WPA cracking, but if the access point has WPS (the click to connect button) you can sniff handshakes on the network and crack the WPA password it in relatively no time. In my experience this has usually been under 10 minutes.
- ty_a 9y agoOn most recent firmware, there is an exponential backoff on WPS connection attempts.
- rexicus 9y agoIt's not viable for those random 12-ish digit passwords most ISPs will use.
- Qub3d 9y agoYeah, which is why it is sometimes weirdly safer to not change your SSID - a cracker can assume that someone who figured out how to change the broadcast name could've also changed the WiFi password... often to something much less secure.
- tFXR89qo 9y agoSSID is used for password hashing, so better change it from default to avoid rainbow tables.
- deleted 9y ago[deleted]
- arprocter 9y agoTime taken to crack WEP depended on if it was a 64 or 128 bit key I did a study using an Atom netbook - a 64 bit key (10 digits long) took 8 mins to find, 128 (26 digits) took 30 mins
- mkagenius 9y agoIf it is as slow as SHA512 then it will take 20 days on AWS g2 x8 large for 8 characters (made of alphanumeric or some 10 other symbols).
- yedpodtrzitko 9y agoIs there anything novel in there? On a first sight it seems just like a guide done hundred times before...
- polpo 9y ago4,733,979 out of the 14,344,391 passwords (33%) in the rockyou.txt dictionary file used for cracking in this guide are too short to be WPA2 passwords, which have a minimum length of 8 characters. Are aircrack and/or hashcat smart enough to not bother hashing those short passwords?
- polpo 9y ago(looks like the case for aircrack-ng, at least: https://github.com/aircrack-ng/aircrack-ng/blob/master/src/aircrack-ng.c#L4753 https://github.com/aircrack-ng/aircrack-ng/blob/master/src/a...)
- domenukk 9y ago5 million hashes only take a few seconds for wpa2 anyway... Less than two for this system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
- stusmall 9y agoThey don't touch it in this tutorial but typically you don't check just whats in your dictionary. You also use a set of rules to manipulate your dictionary that massively increases the number of hashes to perform. Those 5 million entries quickly passes tens of billions hashes that need to be run. These initial entries might be too short like OP pointed out, but after the rules are applied it might generate many entries that will be long enough to spend time hashing. The keyspace for WPA is huge and the hash speed is still relatively slow, even with an extremely high end system like you linked to the quality of the initial dictionary is really important.
- weinzierl 9y agohashcat is smart enough in a subtle way. It will not bother with candidates that are unsuitable for a certain hash type. It checks this after the rules have been applied. (stusmall's comment explains the influence of rules better than I could). Hashcat shows these candidates as "Rejected". The interesting part is that you can't configure the minimum or maximum length anymore[1], the restrictions are hard coded for every hash type. This is because for fast hashes the branch introduced by the check would be slower than just hashing away[2]. [1] It was possible with the old CPU-based hashcat (--pw-min and --pw-max) [2] https://hashcat.net/forum/thread-3444.html?highlight=branch https://hashcat.net/forum/thread-3444.html?highlight=branch
- aerovistae 9y agoI attempted to do this once and it turned out to be monumentally difficult. I got as far as setting up a bootable kali thumb drive before getting stopped in my tracks by hardware incompatibilities and unexpected behaviors and errors. These articles make it sounds a LOT easier than it is. I was very disappointed because I was really excited about it.
- The_Sponge 9y agoIt's not for the faint of heart or faint of technical skill - different drivers have different behaviors and ways to enter the various capture and raw packet modes needed to do this. Personally, as long as I stick to supported chipsets, I've almost never had an issue.
- wil421 9y agoHave you found a wifi card that will work on any laptop or desktop?
- bebopfunk 9y agoI've had great luck with this wireless card. Works out of the box on any linux distro I've used it with. I bought it specifically for its aircrack compatibility (packet injection and monitor mode). https://www.amazon.com/Alfa-AWUSO36NH-Wireless-Long-Rang-Network/dp/B0035APGP6/ref=sr_1_2?ie=UTF8&qid=1500921879&sr=8-2&keywords=alfa+wireless+card https://www.amazon.com/Alfa-AWUSO36NH-Wireless-Long-Rang-Net... although some of the reviews seem to indicate there may have been a change in chipset/drivers. I wish you luck!
- rhinoceraptor 9y agoNot all Alfa products are OOB compatible, you definitely need to be careful. I have the AWUS036AC which requires compiling a DKMS module. It was a pain the get working on my Raspberry Pi, I had to try several different drivers and edit a Makefile to get it to compile. But I did eventually get it working as an AP, there's a script called create_ap which is very nice to painlessly run an AP on Linux.
- throwasehasdwi 9y agoI'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home networks and 60% for businesses. The attack is completely passive if you don't want to be noticed, and with a cheap dish you can pickup both ends of the handshakes from up to around a quarter mile away (line of sight).
- amluto 9y ago> Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack. There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents are possible, and, even when WPA was standardized, something should have been available.
- throwasehasdwi 9y agoYes, this is still a major problem with WPA. Also the fact that certain control packets aren't authenticated is nearly unforgivable. If correctly designed the only reasonable attack on wifi would be channel jamming, sadly after many years this still is not the case.
- d33 9y agoThis is probably a good occasion for a call for WPA3: https://github.com/d33tah/call-for-wpa3 https://github.com/d33tah/call-for-wpa3
- kees99 9y agoWEP, WPA, WPA2... why keep reinventing the same wheel? Each new iteration inevitable turns out to be less-than-perfect and keep adding more and more complexity and overhead - for one, join/leave times keep increasing, up to a point where we have a separate standard (802.11r) just to get back pre-WPA roaming speeds (at cost of even more protocol complexity overhead). Here's crazy idea: Why not run open network + IPSEC, or heck, even OpenVPN? Obviously, drop all non-VPN traffic right on the AP (or first router after it) to nip freeloaders in the bud.
- deleted 9y ago[deleted]
- baalimago 9y agomost people don't change password on their routers anymore
- webaholic 9y agoTo the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.
- jaimex2 9y agowhats the punishment in the US?
- quacker 9y agoIANAL, but from reading for a little bit, it seems to vary and states have their own laws. There's some discussion on Wikipedia here[2] of unauthorized piggybacking (which does not even require hacking the network), with a few examples of actual instances. In St. Petersburg, 2005, Benjamin Smith III was arrested and charged with "unauthorized access to a computer network", a third-degree felony in the state of Florida, after using a resident's wireless network from a car parked outside. A third-degree felony in Florida seems to be up to 5 years. In some states it is up to 10 years. Another person got "a fine of $250 and one year of court supervision". If it's unauthorized access to the computer of a government or financial institution (or "which is used in or affecting interstate or foreign commerce or communication", which can be interpreted very broadly), then the Computer Fraud and Abuse Act would apply[2]. From reading about the sections regarding "trespassing", punishment can be a fine and 1-5 years imprisonment (first offense), or up to 10 years (repeated offense). 1: https://en.wikipedia.org/wiki/Legality_of_piggybacking#United_States https://en.wikipedia.org/wiki/Legality_of_piggybacking#Unite... 2: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- djsumdog 9y agoTechnically using iodine to tunnel via DNS on captive portals is also illegal (I think .. although I'm not sure if anyone has been prosecuted for this .. IANAL)
- deleted 9y ago[deleted]
- nextstep 9y agoDoes this only crack single word passwords? If my password was two common dictionary words or a common word plus a single number, would this try that possibility?
- braxxox 9y agoUsing a wordlist with aircrack-ng seems to only try the literal passwords in the dictionary. If you use naive-hashcat, a series of dictionary, rule, combination, and brute-force attacks will be used. I recommend reading up on the hashcat wiki (https://hashcat.net/wiki/ https://hashcat.net/wiki/) to learn how to conduct your own custom hashing attacks.
- bobsgame 9y agoI had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the radios can't handle that sort of thing?
- pletnes 9y agoDid you mean this? http://gizmodo.com/264050/slurpr-wi-fi-box-sucks-up-six-signals-for-super-broadband http://gizmodo.com/264050/slurpr-wi-fi-box-sucks-up-six-sign...
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- crummy 9y agoProbably cracking passwords would be very slow on router hardware - cool idea though.
- goda90 9y agoThe load could be distributed between nodes, or the original node could be backed by a more powerful machine to do the cracking.
- braxxox 9y agoThat certainty breaks the Computer Fraud and Abuse Act, and while impractical, I think you could be charged separately for cracking each router. That said, interesting idea. If I were to do it, I wouldn't crack the passwords on the router itself, but rather attach 3G hardware to the router to "phone home" captured handshakes and run your cracking on GPUs in the cloud, sending results back to the router.
- rootsudo 9y agoHonestly, why reinvent the wheel. Use Wifite2 with a proper password list and done.
- thinkxl 9y agowifite2[1] is a wrapper tool that does all this automatically. Not trying to say that easier is better, in this case. Just wanted to show this tool for those who don't know it. [1] - https://github.com/derv82/wifite2 https://github.com/derv82/wifite2 edit: added wifite initially, replaced it with wifite2
- tambourine_man 9y agoAnyone tried Apple's Airport drivers and Linux on VirtualBox?
- nikkwong 9y agoCan someone help me understand why, from a technical perspective, it is necessary to capture the handshake?
- mattfaus 9y agoThe handshake contains the encrypted password. The idea is to reverse this encryption to obtain the plaintext password.
- nictrix 9y agoThe DSL provider in my area sets up customer's wireless networks with their home or mobile phone number as the password. If you know that number or can look it up in public records then you're in. If you can't find it maybe use a dictionary pertaining to the area code of phone numbers and then you're in. When the protocol changes to something more secure, the ISP's customer will still be as insecure as they always were.
- c3833174 9y agoThat's not as bad as deriving password and SSID (Provider-$generated_number) from the MAC address, it didn't take much for somebody to reverse the algorithm from the bootloader and make various programs to calculate the few possible password from SSID
- buschtoens 9y agoThe deauthentication packet looks interesting. Does that mean, that I could annoy the hell out of my neighbors by constantly forcing all of their devices to reconnect?
- billfor 9y agoJust fyi if you are using Kali the rockyou list is already in /usr/share/wordlists. Also to reduce the size of the pcap file, you may want filter it for EAPOL packets only: tshark -r input.pacp -R "eapol || wlan.fc.type_subtype == 0x08" -w small.pcap