[Legolas]

When Wi-Fi was first developed in the late 1990s, Wired Equivalent Privacy was created to give wireless communications confidentiality.
WEP, as it became known, proved terribly flawed and easily cracked.

As a replacement, most wireless access points now use Wi-Fi Protected Access II with a pre-shared key for wireless security, known as WPA2-PSK. WPA2 uses a stronger encryption algorithm, AES, that's very difficult to crack—but not impossible.

The weakness in the WPA2-PSK system is that the encrypted password is shared in what is known as the 4-way handshake.
When a client authenticates to the access point (AP), the client and the AP go through a 4-step process to authenticate the user to the AP.
If we can grab the password at that time, we can then attempt to crack it.



Step 1: Put Wi-Fi Adapter in Monitor Mode with Airmon-Ng

Let's start by putting our wireless adapter in monitor mode.
This is similar to putting a wired adapter into promiscuous mode.
It allows us to see all of the wireless traffic that passes by us in the air.
Let's open a terminal and type:

• airmon-ng start wlan0
  

Note that airmon-ng has renamed your wlan0 adapter to mon0.



Step 2: Capture Traffic with Airodump-Ng

Now that our wireless adapter is in monitor mode, we have the capability to see all the wireless traffic that passes by in the air.
We can grab that traffic by simply using the airodump-ng command.

This command grabs all the traffic that your wireless adapter can see and displays critical information about it, including the BSSID (the MAC address of the AP), power, number of beacon frames, number of data frames, channel, speed, encryption (if any), and finally, the ESSID (what most of us refer to as the SSID).
Let's do this by typing:

• airodump-ng mon0
  

Note all of the visible APs are listed in the upper part of the screen and the clients are listed in the lower part of the screen.




Step 3: Focus Airodump-Ng on One AP on One Channel

Our next step is to focus our efforts on one AP, on one channel, and capture critical data from it.
We need the BSSID and channel to do this.
Let's open another terminal and type:

• airodump-ng --bssid 08:86:30:74:22:76 -c 6 --write WPAcrack mon0
  
  
• 08:86:30:74:22:76 is the BSSID of the AP
  
• -c 6 is the channel the AP is operating on
  
• WPAcrack is the file you want to write to
  
• mon0 is the monitoring wireless adapter*
  

As you can see in the screenshot above, we're now focusing on capturing data from one AP with a ESSID of Belkin276 on channel 6.
The Belkin276 is probably a default SSID, which are prime targets for wireless hacking as the users that leave the default ESSID usually don't spend much effort securing their AP.



Step 4: Aireplay-Ng Deauth

In order to capture the encrypted password, we need to have the client authenticate against the AP.
If they're already authenticated, we can de-authenticate them (kick them off) and their system will automatically re-authenticate, whereby we can grab their encrypted password in the process.
Let's open another terminal and type:

• aireplay-ng --deauth 100 -a 08:86:30:74:22:76 mon0
  
  
• 100 is the number of de-authenticate frames you want to send
  
• 08:86:30:74:22:76 is the BSSID of the AP
  
• mon0 is the monitoring wireless adapter

Step 5: Capture the Handshake

In the previous step, we bounced the user off their own AP, and now when they re-authenticate, airodump-ng will attempt to grab their password in the new 4-way handshake.
Let's go back to our airodump-ng terminal and check to see whether or not we've been successful.

Notice in the top line to the far right, airodump-ng says "WPA handshake."
This is the way it tells us we were successful in grabbing the encrypted password!
That is the first step to success!


Step 6: Let's Aircrack-Ng That Password!

Now that we have the encrypted password in our file WPAcrack, we can run that file against aircrack-ng using a password file of our choice.
Remember that this type of attack is only as good as your password file.
I'll be using the default password list included with aircrack-ng on BackTrack named darkcOde.

We'll now attempt to crack the password by opening another terminal and typing:

• aircrack-ng
  
• WPAcrack-01.cap
  
• -w /pentest/passwords/wordlists/darkc0de
  
  
• WPAcrack-01.cap is the name of the file we wrote to in the airodump-ng command
  
• /pentest/passwords/wordlist/darkc0de is the absolute path to your password file
  

How Long Will It Take?
This process can be relatively slow and tedious.
Depending upon the length of your password list, you could be waiting a few minutes to a few days.
On my dual core 2.8 gig Intel processor, it's capable of testing a little over 500 passwords per second.
That works out to about 1.8 million passwords per hour. Your results will vary.
When the password is found, it'll appear on your screen. Remember, the password file is critical.




Credits:

Spoiler:

occupytheweb

If you have any questions or problems,let me know.
Glad to help you.
Legolas:Thumbs-Up:

[DrakeBishop]

Gud Post But i really Need to Know if there Not A More Pretty A To do It Not On BAck track But on Windows ??

[DrakeBishop]

Gud Post But i really Need to Know if there Not A More Pretty A To do It Not On BAck track But on Windows ??

[chmod]

/moved to the correct section

[LaunchpadMcQuack]

When Wi-Fi was first developed in the late 1990s, Wired Equivalent Privacy was created to give wireless communications confidentiality.
WEP, as it became known, proved terribly flawed and easily cracked.

As a replacement, most wireless access points now use Wi-Fi Protected Access II with a pre-shared key for wireless security, known as WPA2-PSK. WPA2 uses a stronger encryption algorithm, AES, that's very difficult to crack—but not impossible.

The weakness in the WPA2-PSK system is that the encrypted password is shared in what is known as the 4-way handshake.
When a client authenticates to the access point (AP), the client and the AP go through a 4-step process to authenticate the user to the AP.
If we can grab the password at that time, we can then attempt to crack it.



Step 1: Put Wi-Fi Adapter in Monitor Mode with Airmon-Ng

Let's start by putting our wireless adapter in monitor mode.
This is similar to putting a wired adapter into promiscuous mode.
It allows us to see all of the wireless traffic that passes by us in the air.
Let's open a terminal and type:

• airmon-ng start wlan0
  

Note that airmon-ng has renamed your wlan0 adapter to mon0.



Step 2: Capture Traffic with Airodump-Ng

Now that our wireless adapter is in monitor mode, we have the capability to see all the wireless traffic that passes by in the air.
We can grab that traffic by simply using the airodump-ng command.

This command grabs all the traffic that your wireless adapter can see and displays critical information about it, including the BSSID (the MAC address of the AP), power, number of beacon frames, number of data frames, channel, speed, encryption (if any), and finally, the ESSID (what most of us refer to as the SSID).
Let's do this by typing:

• airodump-ng mon0
  

Note all of the visible APs are listed in the upper part of the screen and the clients are listed in the lower part of the screen.




Step 3: Focus Airodump-Ng on One AP on One Channel

Our next step is to focus our efforts on one AP, on one channel, and capture critical data from it.
We need the BSSID and channel to do this.
Let's open another terminal and type:

• airodump-ng --bssid 08:86:30:74:22:76 -c 6 --write WPAcrack mon0
  
  
• 08:86:30:74:22:76 is the BSSID of the AP
  
• -c 6 is the channel the AP is operating on
  
• WPAcrack is the file you want to write to
  
• mon0 is the monitoring wireless adapter*
  

As you can see in the screenshot above, we're now focusing on capturing data from one AP with a ESSID of Belkin276 on channel 6.
The Belkin276 is probably a default SSID, which are prime targets for wireless hacking as the users that leave the default ESSID usually don't spend much effort securing their AP.



Step 4: Aireplay-Ng Deauth

In order to capture the encrypted password, we need to have the client authenticate against the AP.
If they're already authenticated, we can de-authenticate them (kick them off) and their system will automatically re-authenticate, whereby we can grab their encrypted password in the process.
Let's open another terminal and type:

• aireplay-ng --deauth 100 -a 08:86:30:74:22:76 mon0
  
  
• 100 is the number of de-authenticate frames you want to send
  
• 08:86:30:74:22:76 is the BSSID of the AP
  
• mon0 is the monitoring wireless adapter

Step 5: Capture the Handshake

In the previous step, we bounced the user off their own AP, and now when they re-authenticate, airodump-ng will attempt to grab their password in the new 4-way handshake.
Let's go back to our airodump-ng terminal and check to see whether or not we've been successful.

Notice in the top line to the far right, airodump-ng says "WPA handshake."
This is the way it tells us we were successful in grabbing the encrypted password!
That is the first step to success!


Step 6: Let's Aircrack-Ng That Password!

Now that we have the encrypted password in our file WPAcrack, we can run that file against aircrack-ng using a password file of our choice.
Remember that this type of attack is only as good as your password file.
I'll be using the default password list included with aircrack-ng on BackTrack named darkcOde.

We'll now attempt to crack the password by opening another terminal and typing:

• aircrack-ng
  
• WPAcrack-01.cap
  
• -w /pentest/passwords/wordlists/darkc0de
  
  
• WPAcrack-01.cap is the name of the file we wrote to in the airodump-ng command
  
• /pentest/passwords/wordlist/darkc0de is the absolute path to your password file
  

How Long Will It Take?
This process can be relatively slow and tedious.
Depending upon the length of your password list, you could be waiting a few minutes to a few days.
On my dual core 2.8 gig Intel processor, it's capable of testing a little over 500 passwords per second.
That works out to about 1.8 million passwords per hour. Your results will vary.
When the password is found, it'll appear on your screen. Remember, the password file is critical.




Credits:

Spoiler:

occupytheweb

If you have any questions or problems,let me know.
Glad to help you.
Legolas:Thumbs-Up:

A little off topic but I'm curious, when did it become this simple to crack WPA2? Am I behind on this? And if it's this easy, what is going to come next to make it more difficult O.o

[hunt3r972]

It's not simple because the chance it succeeds are very low (the password must be in the dictionnary). A brute force attack will take a looooonnnngggg time if the password is strong enough. So to make a WPA2 password stronger:

-Use +16 chars passwords
-Don't use words
-Mix numbers, special chars, lower and upper case chars
-If you are french, use letters with accent, they are never used in dictionnaries (because dictionnary are from english most of the time)

[Legolas]

@Mariano A. Broqueza
Yes.
Check it and if you have any problems or questions,
let me know.
Glad to help you.

@D4rkn3ss
Thank you. mile:

[Cheshire]

Thank you so much! This was really helpful, @Legolas.

The only think I would add/tweak is that if you're running Kali instead of backtrack, all of the word lists are under

Code:

/usr/share/wordlists

There are a TON of wordlists there. Still trying to figure out which would be the best to go for first for a general attack!

You can also change your MAC for a little layer of security using macchanger before you start scanning.

[Charlesqw]

I tried this out on my room mates wifi for giggles however Im very new to the whole field and couldnt even get past step 2 cant manage to airodump.

>>>>>> NOOB <<<<<<<

any ideas?

[Cloud mod]

@Legolas Great tutorial man! I really like your layout and how you also gave history to it also. The instructions are clear and short. I'm going to give this a go on my laptop after I have gotten Linux.